Merge pull request #6335 from MicrosoftDocs/main

12/8/2021 PM Publish

Author: Taojunshen

memdocs/autopilot/known-issues.md

@@ -28,6 +28,10 @@ This article describes known issues that can often be resolved by configuration
 
 ## Known issues
 
+### TPM attestation failure on Windows 11 error code 0x81039024
+
+Some devices may fail TPM attestation on Windows 11 during the pre-provisioning technician flow or self-deployment mode with the error code 0x81039024. This error code indicates that there are known vulnerabilities detected with the TPM and as a result will fail attestation. If you receive this error, please visit your PC manufacturer’s website to update the TPM firmware.
+
 ### Delete device record in Intune before reusing devices in self-deployment mode or Pre-Provisioning mode
 
 You have devices enrolled using Autopilot self-deployment mode or pre-provisioning mode. If you redeploy an Autopilot profile, it fails with a `0x80180014` error code. To resolve this error, delete the device record in Intune, and then redeploy the profile.

memdocs/intune/configuration/device-restrictions-android-for-work.md

@@ -7,7 +7,7 @@ keywords:
 author: MandiOhlinger
 ms.author: mandia
 manager: dougeby
-ms.date: 11/15/2021
+ms.date: 12/08/2021
 ms.topic: conceptual
 ms.service: microsoft-intune
 ms.subservice: configuration
@@ -333,15 +333,21 @@ Use these settings to configure a kiosk-style experience on your dedicated devic
         - **Number of seconds the device is inactive before showing screen saver**: Choose how long the device is idle before showing the screensaver. Enter a value between 1-9999999 seconds. Default is `30` seconds. You must enter a number greater than zero (`0`).
         - **Detect media before starting screen saver**: **Enable** (default) doesn't show the screen saver if audio or video is playing on the device. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might show the screen saver, even if audio or video is playing.
 
-      - **Sign-in screen**: **Enable** shows a sign-in screen on the Managed Home Screen. When set to **Not configured** (default), Intune doesn't change or update this setting. This sign-in screen and related settings are intended for use on dedicated devices enrolled with AAD Shared device mode.
+      - **MHS Sign-in screen**: **Enable** shows a sign-in screen on the Managed Home Screen. When set to **Not configured** (default), Intune doesn't change or update this setting. This sign-in screen and related settings are intended for use on dedicated devices enrolled with AAD Shared device mode.
 
         When enabled, also configure:
 
-        - **Set custom URL background for sign-in screen​**: Enter the URL of the URL background for the sign-in screen. The sign-in screen must be enabled to configure this setting.
-        - **Set custom URL branding logo for sign-in screen and session pin page​**: Enter the URL branding logo for the sign-in screen and session pin page. ​
+        - **Set custom URL background for sign-in screen**: Enter the URL of the URL background for the sign-in screen. The sign-in screen must be enabled to configure this setting.
+        - **Set custom URL branding logo for sign-in screen and session pin page**: Enter the URL branding logo for the sign-in screen and session pin page.
         - **Require user to set a PIN for sign-in session**: When set to **Enable**, the user must set a PIN for their sign-in session. When set to **Not configured** (default), the user isn't required to set a PIN. This setting must be enabled to show the sub-settings.
-          - **Choose complexity of PIN for sign-in session**: Choose the complexity of the session PIN. Options include **Not configured**, **Complex**, or **Simple**. Complex requires alphanumerical characters and simple only requires numbers. ​
-          - **Require user to enter session PIN if screensaver has appeared​**: Select **Enable** to require the user to enter their session PIN to resume using the Managed Home Screen after the screensaver has appeared. 
+          - **Choose complexity of PIN for sign-in session**: Select the complexity of the session PIN. Your options:
+            -  **Not configured**: Intune doesn't change or update this setting. By default, MHS requires at least one character in the session PIN.
+            -  **Simple**: Requires numbers. There are no restrictions on repeating (444) or or ordered (123, 321, 246) sequences.
+            - **Complex**: Allows users to create a PIN with alphanumeric characters. Can't use repeating (444) or ordered (123, 321, 246) sequences.
+
+            For more information on this setting, see **Complexity of session PIN** at [Configure the Microsoft Managed Home Screen app for Android Enterprise](../apps/app-configuration-managed-home-screen-app.md).
+
+          - **Require user to enter session PIN if screensaver has appeared**: Select **Enable** to require the user to enter their session PIN to resume using the Managed Home Screen after the screensaver has appeared. 
         - **Automatically sign-out of MHS and Shared device mode applications after inactivity**: Select **Enable** to auto sign-out of the Managed Home Screen based on inactivity. This setting must be enabled to show the sub-settings.
           - **Number of seconds device is inactive before automatically signing user out​**: Define the period of inactivity, in seconds, before user is automatically signed out from Managed Home Screen. By default, this value is set to 300 seconds. 
           - **Number of seconds to give user notice before automatically signing them out**: Define the amount of time, in seconds, for user to have option to resume their session before getting automatically signed out from Managed Home Screen. By default, this value is set to 60 seconds. 

memdocs/intune/protect/advanced-threat-protection-configure.md

@@ -7,7 +7,7 @@ keywords: configure, manage, capabilities, attack surface reduction, next-genera
 author: brenduns 
 ms.author: brenduns
 manager: dougeby
-ms.date: 10/05/2021
+ms.date: 12/08/2021
 ms.topic: how-to
 ms.service: microsoft-intune
 ms.subservice: protect
@@ -50,14 +50,16 @@ You only need to enable Microsoft Defender for Endpoint a single time per tenant
 
 1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
 
-2. Select **Endpoint security** > **Microsoft Defender for Endpoint**, and then select **Open the Microsoft Defender Security Center**.
+2. Select **Endpoint security** > **Microsoft Defender for Endpoint**, and then select **Open the Microsoft Defender Security Center**. 
+
+   This opens the **Microsoft 365 Defender** portal at *security.microsoft.com*, which [replaces the use of the previous portal](/microsoft-365/security/defender/microsoft-365-defender?view=o365-worldwide) at *securitycenter.windows.com*.
 
    > [!TIP]
    > If the **Connection status** at the top of the page is already set to **Enabled**, the connection to Intune has already been made, and the admin center displays different UI than in the following screen shot. In this event, you can use the link **Open the Microsoft Defender for Endpoint admin console** to open the Microsoft Defender Security Center and use the guidance in the following step to confirm that the **Microsoft Intune connection** is set to **On**.
 
    :::image type="content" source="./media/advanced-threat-protection-configure/atp-device-compliance-open-microsoft-defender.png" alt-text="Screen shot that shows the patch to open the Microsoft Defender Security Center.":::
 
-3. In **Microsoft Defender Security Center**:
+3. In **Microsoft 365 Defender**, (previously the *Microsoft Defender Security Center*):
    1. Select **Settings** > **Endpoints** >**Advanced features**.
    2. For **Microsoft Intune connection**, choose **On**:
 

memdocs/intune/remote-actions/remote-help.md

@@ -7,7 +7,7 @@ keywords:
 author: brenduns
 ms.author: brenduns
 manager: dougeby
-ms.date: 12/07/2021
+ms.date: 12/08/2021
 ms.topic: how-to
 ms.service: microsoft-intune
 ms.subservice: remote-actions
@@ -134,18 +134,18 @@ The most recent version of remote help is **10.0.100110.16384**
 
 ### Deploy remote help as a Win32 app
 
-To deploy remote help with Intune, you can add the app as a Windows win32 app, and define a detection rule to identify devices that don’t have the most current version of remote help installed.  Before you can add remote help as a Win32 app, you must repackage *remotehelp.exe* as a *.intunewin* file, which is a Win32 app file you can deploy with Intune. For information on how to repackage a file as a Wind32 app, see [Prepare the Win32 app content for upload](../apps/apps-win32-prepare.md).
+To deploy remote help with Intune, you can add the app as a Windows win32 app, and define a detection rule to identify devices that don’t have the most current version of remote help installed.  Before you can add remote help as a Win32 app, you must repackage *remotehelpinstaller.exe* as a *.intunewin* file, which is a Win32 app file you can deploy with Intune. For information on how to repackage a file as a Wind32 app, see [Prepare the Win32 app content for upload](../apps/apps-win32-prepare.md).
 
-After you repackage remote help as a *.intunewin* file, use the procedures in [Add a Win32 app](../apps/apps-win32-add.md ) with the following details to upload and deploy remote help. In the following, the repackaged remotehelp.exe file is named *remotehelp.intunewin*.
+After you repackage remote help as a *.intunewin* file, use the procedures in [Add a Win32 app](../apps/apps-win32-add.md ) with the following details to upload and deploy remote help. In the following, the repackaged remotehelpinstaller.exe file is named *remotehelp.intunewin*.
 
 1. On the App information page, select **Select app package file**, and locate the *remotehelp.intunewin* file you’ve previously prepared, and then select **OK**.
 
    Add a *Publisher* and then select **Next**. The other details on the App Information page are optional.
 
 2. On the Program page, configure the following options:
 
-   - For *Install command line*, specify **remotehelp.exe /install /quiet acceptTerms=Yes**
-   - For *Uninstall command line*, specify **remotehelp.exe /uninstall /quiet acceptTerms=Yes**
+   - For *Install command line*, specify **remotehelpinstaller.exe /install /quiet acceptTerms=Yes**
+   - For *Uninstall command line*, specify **remotehelpinstaller.exe /uninstall /quiet acceptTerms=Yes**
 
    > [!IMPORTANT]
    > The command line option *acceptTerms* is always case sensitive.
@@ -161,7 +161,7 @@ After you repackage remote help as a *.intunewin* file, use the procedures in [A
 
    - For *Rule type*, select **File**
    - For *Path*, specify **C:\Program Files\Remote Help**
-   - For *File or folder*, specify **RemoteHelp.exe**
+   - For *File or folder*, specify **RemotehelpInstaller.exe**
    - For *Detection method*, select **String (version)**
    - For *Operator*, select **Greater than or equal to**
    - For *Value*, specify the [version of remote help](#download-remote-help) your deploying. For example, **10.0.10011.16384**

memdocs/intune/user-help/install-company-portal-android-china.md

@@ -7,7 +7,7 @@ keywords:
 author: lenewsad
 ms.author: lanewsad
 manager: dougeby
-ms.date: 09/27/2021
+ms.date: 12/08/2021
 ms.topic: end-user-help
 ms.prod:
 ms.service: microsoft-intune
@@ -35,6 +35,7 @@ ms.collection:
 Install the Intune Company Portal app to access school or work resources from your Android device. The app is available in the People's Republic of China and can be installed from the following app stores: 
 
 * [Google Play](https://go.microsoft.com/fwlink/?linkid=871947) (not available everywhere)
+* [Huawei](https://go.microsoft.com/fwlink/?linkid=836948)  
 * [Lenovo](https://go.microsoft.com/fwlink/?linkid=2125082)
 * [Xiaomi](https://go.microsoft.com/fwlink/?linkid=836947)
 * OPPO
@@ -46,7 +47,7 @@ Company Portal is also available from the [Baidu App Store](https://go.microsoft
    3. Select the Company Portal ![Company Portal icon](./media/company-portal-logo-small-2101.png) listing.  
 
 
-If the app stores listed above are unavailable, you can download [Microsoft Intune Company Portal for Android](https://www.microsoft.com/download/details.aspx?id=49140) on your Android device and sideload the app. When installed this way, the app doesn't receive updates or fixes automatically. You must be sure to regularly update and patch the app manually.  
+If the app stores listed above are unavailable, you can download [Microsoft Intune Company Portal for Android](https://www.microsoft.com/download/details.aspx?id=49140) on your device and side-load the app. When installed this way, the app doesn't receive updates or fixes automatically. You must be sure to regularly update and patch the app manually.  
 
 ## Next steps  
 After you install the app on your device, follow your organization's instructions to set up your device for school or work. For enrollment help, see [Enroll Android device with Intune Company Portal](enroll-device-android-company-portal.md). 

memdocs/intune/user-help/sign-in-to-the-company-portal.md

@@ -1,13 +1,13 @@
 ---
 # required metadata
 
-title: How to sign in to Company Portal app | Microsoft Docs
-description: Learn where to get the Company Portal app and how to sign in.
+title: Get the Intune Company Portal app | Microsoft Docs
+description: Learn where to get the Company Portal app and how to sign in.  
 keywords:
 author: lenewsad
 ms.author: lanewsad
 manager: dougeby
-ms.date: 11/01/2021
+ms.date: 12/08/2021
 ms.topic: end-user-help
 ms.prod:
 ms.service: microsoft-intune
@@ -29,41 +29,55 @@ ms.custom: intune-enduser
 ms.collection: 
 ---
 
-# How to sign in to Company Portal  
+# Get the Intune Company Portal app   
 
-There are three ways to sign in to the Intune Company Portal app: 
+Microsoft Intune helps organizations manage access to their internal apps, data, and resources. Intune Company Portal is the app that lets you, as an employee or student in your organization, securely access those resources. 
 
-* Sign in with your school or work email address and password.  
-* Sign in with certificate-based authentication.  
-* Sign in from another device.   
+The app is available for desktop (Windows and macOS) and mobile (Android and iOS) devices. You must have a work or school account through your organization to sign in to the app.    
 
-This article describes how to sign in using each of these methods. For the best experience, use the method that your organization recommends or requires. 
+## Install app  
+Company Portal is available for Android, iOS, macOS, and Windows. 
 
-## Install Intune Company Portal  
+### Android  
+Install Company Portal for Android from these stores:  
 
-Company Portal is available for Windows, Android, iOS, and macOS and can be installed from the following app stores.  
-
-* [Microsoft Store](https://www.microsoft.com/p/company-portal/9wzdncrfj3pz?rtc=2&activetab=pivot:overviewtab)  
-* [Google Play](https://play.google.com/store/apps/details?id=com.microsoft.windowsintune.companyportal) 
+* [Google Play](https://play.google.com/store/apps/details?id=com.microsoft.windowsintune.companyportal)  
 * [Amazon Appstore for Android](https://www.amazon.com/Microsoft-Corporation-Intune-Company-Portal/dp/B092BCFLBJ/)  
-* [Apple App Store](https://apps.apple.com/app/intune-company-portal/id719171358)  
-* [Enroll my Mac](https://go.microsoft.com/fwlink/?linkid=853070): Selecting this link will immediately download the Company Portal installer package on your device.  
 
-For app availability in the People's Republic of China, see [Install Company Portal app in People's Republic of China](install-company-portal-android-china.md).  
+If the app stores listed above are unavailable, or you're using a device that doesn't support Google Mobile Services, you can [download Microsoft Intune Company Portal for Android](https://www.microsoft.com/download/details.aspx?id=49140) on your device and side-load the app. When installed this way, the app doesn't receive updates or fixes automatically. Be sure to regularly update and patch the app yourself.  
 
-## Sign in with school or work account    
-Complete the following steps to sign in to Company Portal with your school or work account. 
+Google Play Store is not available in People's Republic of China. You can install the Company Portal app from select Chinese app marketplaces instead. For more information, see [Install Company Portal app in People's Republic of China](install-company-portal-android-china.md).   
 
-1. Open the app and tap **Sign In**.  
+### iOS  
+Install Company Portal for iOS from the [Apple App Store](https://apps.apple.com/app/intune-company-portal/id719171358).  
+
+### macOS
+Install Company Portal for macOS from [Enroll my Mac](https://go.microsoft.com/fwlink/?linkid=853070.) Selecting this link will immediately download the Company Portal installer package on your device.  
+
+### Windows  
+Install Company Portal for Windows from the [Microsoft Store](https://www.microsoft.com/p/company-portal/9wzdncrfj3pz?rtc=2&activetab=pivot:overviewtab).  
+
+## Sign in to app   
 
-2. Enter the email address associated with your school or work account and then tap **Next**.
+There are three ways to sign in to Company Portal:  
+
+* Sign in with your school or work email address and password.  
+* Sign in with certificate-based authentication.  
+* Sign in from another device.  
+
+ For the best experience, use the method that your organization recommends or requires. 
+
+### Sign in with school or work account    
+
+1. Open the app and tap **Sign In**.  
 
-3. Enter your password and tap **Sign In**.
+2. Enter the email address associated with your school or work account and then tap **Next**.  
 
+3. Enter your password and tap **Sign In**.  
 
 4. Wait while the app verifies your credentials. When done, you can access the features in the app and your organization's resources.  
 
-## Sign in with certificate  
+### Sign in with certificate  
 You'll only see this sign-in option if your organization allows certificate-based authentication and you have a certificate available to use.  
 
 1. Open the Company Portal app on your device.  
@@ -75,7 +89,7 @@ You'll only see this sign-in option if your organization allows certificate-base
 4. Tap **Continue** to use the certificate.  
 5. Wait while the app verifies your certificate. When done, you can access the features in the app and your organization's resources.  
 
-## Sign in via another device    
+### Sign in via another device    
 
 If you normally use a smart card to access work resources, follow the steps in this section to sign in to Company Portal.  
 
@@ -99,5 +113,6 @@ If you normally use a smart card to access work resources, follow the steps in t
 
 
 ## Next steps  
+After you install the app on your device, follow your organization's instructions to set up your device for school or work. For enrollment help, see [Enroll Android device with Intune Company Portal](enroll-device-android-company-portal.md). 
 
 Stuck or need help? Contact your IT support person. For contact information, check the [Company Portal website](https://go.microsoft.com/fwlink/?linkid=2010980).  

windows-365/business/TOC.yml

@@ -11,6 +11,20 @@ items:
   href: windows-365-business-sizing.md
 - name: Cloud PC location 
   href: cloud-pc-location.md
+- name: How-to guides
+  items:
+  - name: Device and user management
+    items:
+    - name: Add a user and assign licenses
+      href: add-user-assign-licenses.md
+    - name: Assign or unassign a license
+      href: assign-unassign-license.md
+    - name: Change organization defaults
+      href: change-organization-default-settings.md
+    - name: Remotely manage Cloud PCs
+      href: remotely-manage-business-cloud-pcs.md
+    - name: Reset a user's password
+      href: reset-user-password.md
 - name: Troubleshoot
   items:
   - name: Troubleshooting