Merge branch 'main' into release-intune-2204

Author: v-alje

memdocs/intune/apps/app-configuration-managed-home-screen-app.md

@@ -128,7 +128,7 @@ The following table lists the Managed Home Screen available configuration keys,
 | Exit lock task mode password | string |   | Enter a 4-6-digit code to use to temporarily drop   out of lock-task mode for troubleshooting. | ✔️ |
 | Enable easy access debug menu | bool | FALSE | Turn this setting to True to access the   debug menu from the Managed Settings app or from swipe-down while in Managed   Home Screen. The debug menu is currently where the capability to exit kiosk   mode lives, and is accessed by clicking the back button about 15 times. Keep   this setting set to False to keep the entry point to debug menu   only accessible via the back button. | ✔️ |
 | Show device's name on MHS | bool | FALSE | Turn this setting to True to easily view the device's Intune portal "device name" property from the Managed Settings app or from swipe-down while in Managed Home Screen. When using app config, make sure to also include the string property "Device's name," which is auto-populated by Intune with the correct value. | ❌ |
-| Device's serial number | bool | FALSE | Set this setting to easily view the device's serial number from the Managed Home Screen app. | ❌ |
+| Device's serial number | choice | `{{SerialNumber}}` | Set this setting to easily view the device's serial number from the Managed Home Screen app on all Android OS versions 8 and later. This property is auto-populated by Intune with the correct value. | ❌ |
 | Enable MAX inactive time outside   of MHS | bool | FALSE | Turn this setting to True to automatically   re-launch Managed Home Screen after a set period of inactivity. The timer   will only count inactive time and, when configured, will reset each time the   user interacts with the device while outside of Managed Home Screen. Use   **MAX inactive time outside MHS** to set the inactivity timer. By default,   this setting is off. This setting can only be used if **Exit lock task mode   password** has been configured.  | ❌ |
 | MAX inactive time outside MHS | integer | 180 | Set the maximum amount of inactive time, in   seconds, that a user can spend outside of Managed Home Screen before it is   automatically re-launched. By default, this configuration is set to 180   seconds. **Enable MAX inactive time outside of MHS** must be set to true to   use this setting. | ❌ |
 | Enable MAX time outside MHS | bool | FALSE | Turn this setting to True to automatically   re-launch Managed Home Screen after a set period of time has passed. The   timer will factor in both inactive and active time spent outside of Managed   Home Screen. Use **MAX time outside MHS** to set the inactivity timer. By   default, this setting is off. This setting can only be used if **Exit lock   task mode password** has been configured. | ❌ |

memdocs/intune/apps/app-protection-policies-monitor.md

@@ -79,7 +79,7 @@ Users with devices that are flagged by the **Require threat scan on apps** condi
 
 ## Reporting view
 
-You can find the same reports at the top of the **App protection status** pane. To view these reports, select **Apps** > **App protection status** > **Reports**. The **Reports** pane provides several reports based on user and app, including the following:
+You can find the same reports at the top of the **App protection status** pane. To view these reports, select **Apps** > **Monitor** > **App protection status** > **Reports**. The **Reports** pane provides several reports based on user and app, including the following:
 
 ### User report
 

memdocs/intune/apps/app-protection-policy-settings-ios.md

@@ -52,7 +52,7 @@ There are three categories of policy settings: *Data relocation*, *Access requir
 | <ul>**Select universal links to exempt** | Specify which iOS/iPadOS [Universal Links](#universal-links) should open in the specified *unmanaged* application instead of the protected browser specified by the **Restrict web content transfer with other apps** setting. You must contact the application developer to determine the correct universal link format for each application.   |   |
 | <ul>**Select managed universal links** | Specify which iOS/iPadOS [Universal Links](#universal-links) should open in the specified *managed* application instead of the protected browser specified by the **Restrict web content transfer with other apps** setting. You must contact the application developer to determine the correct universal link format for each application.   |   |
 |<ul>**Save copies of org data** | Choose **Block** to disable the use of the Save As option in this app. Choose **Allow** if you want to allow the use of *Save As*. When set to *Block*, you can configure the setting *Allow user to save copies to selected services*. <br><br>**Note:**<ul><li><i>This setting is supported for Microsoft Excel, OneNote, Outlook, PowerPoint, and Word. It can also be supported by third-party and LOB apps.</i></li><li><i>This setting is only configurable when the setting **Send org data to other apps** is set to **Policy managed apps**, **Policy managed apps with OS sharing** or **Policy managed apps with Open-In/Share filtering**.</i></li><li><i>This setting will be "Allow" when the setting **Send org data to other apps** is set to **All apps**. </i></li><li><i>This setting will be "Block" with no allowed service locations when the setting **Send org data to other apps** is set to **None**. </i></li></ul> | **Allow** |  
-| <ul><ul>**Allow user to save copies to selected services** | Users can save to the selected services (OneDrive for Business, SharePoint, and Local Storage). All other services are blocked. OneDrive for Business: you can save files to OneDrive for Business and SharePoint Online. SharePoint: you can save files to on-premises SharePoint. Local Storage: you can save files to local storage.| **0 selected**  |
+| <ul><ul>**Allow user to save copies to selected services** | Users can save to the selected services (OneDrive for Business, SharePoint, and Local Storage). All other services are blocked. OneDrive for Business: you can save files to OneDrive for Business and SharePoint Online. SharePoint: you can save files to on-premises SharePoint. Local Storage: managed apps can save copies of org data locally. This does NOT include saving files to the local unmanaged locations such as the Files app on the device.| **0 selected**  |
 |<ul>**Transfer telecommunication data to** | Typically, when a user selects a hyperlinked phone number in an app, a dialer app will open with the phone number prepopulated and ready to call. For this setting, choose how to handle this type of content transfer when it is initiated from a policy-managed app:<ul><li>**None, do not transfer this data between apps**: Do not transfer communication data when a phone number is detected.</li><li>**A specific dialer app**: Allow a specific dialer app to initiate contact when a phone number is detected.</li><li>**Any dialer app**: Allow any dialer app to be used to initiate contact when a phone number is detected.</li></ul> <p>**Note**: *This setting requires Intune SDK 12.7.0 and later. If your apps rely on dialer functionality and are not using the correct Intune SDK version, as a workaround, consider adding "tel;telprompt" as a data transfer exemption. Once the apps support the correct Intune SDK version, the exemption can be removed.*| **Any dialer app** |  
 |<ul><ul>**Dialer App URL Scheme** | When a specific dialer app has been selected, you must provide the dialer app URL scheme that is used to launch the dialer app on iOS devices. For more information, see Apple's documentation about [Phone Links](https://developer.apple.com/library/archive/featuredarticles/iPhoneURLScheme_Reference/PhoneLinks/PhoneLinks.html#//apple_ref/doc/uid/TP40007899-CH6-SW1). | **Blank** |
 | **Receive data from other apps** | Specify what apps can transfer data to this app: <ul><li>**All apps**: Allow data transfer from any app.</li><li>**None**: Do not allow data transfer from any app, including other policy-managed apps.</li><li>**Policy managed apps**: Allow transfer only from other policy-managed apps.</li><li>**All apps with incoming Org data**: Allow data transfer from any app. Treat all incoming data without a user identity as data from your organization. The data will be marked with the MDM enrolled user's identity as defined by the `IntuneMAMUPN` setting.<p><p>**Note:** _The **All apps with incoming Org data** value is applicable to MDM enrolled devices only. If this setting is targeted to a user on an unenrolled device, the behavior of the **Any apps** value applies._</li></ul> Multi-identity MAM enabled applications will attempt to switch to an unmanaged account when receiving unmanaged data if this setting is configured to **None** or **Policy managed apps**. If there is no unmanaged account signed into the app or the app is unable to switch, the incoming data will be blocked.<br><br> | **All apps** |

memdocs/intune/apps/quickstart-add-assign-app.md

@@ -50,7 +50,7 @@ An app can be included so that Intune can manage aspects of the app.
 Use the following steps to add an app to Intune:
 
 1. Sign in to [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), select **Apps** > **All apps** > **Add**. 
-2. In the **App type** drop-down box, select **Windows 10**.
+2. In the **App type** drop-down box, select **Windows 10 and later** from **Microsoft 365 Apps**.
 3. Click **Select**. The **Add app** steps are displayed.
 4. Confirm the default details in the **App suite information** step and click **Next**.
 5. Confirm the default settings in the **App settings** step and click **Next**.

memdocs/intune/protect/device-compliance-partners.md

@@ -126,7 +126,7 @@ To enable a device compliance partner to work with Intune, you must complete con
 
 - [Citrix Endpoint Management integration with Microsoft Endpoint Manager](https://docs.citrix.com/en-us/citrix-endpoint-management/integration-with-mem.html)
 
-- [VMware Workspace ONE UEM](https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/services/Directory_Service_Integration/GUID-800FB831-AA66-4094-8F5A-FA5899A3C70C.html)  
+- [VMware Workspace ONE UEM](https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/2102/Directory_Service_Integration/GUID-800FB831-AA66-4094-8F5A-FA5899A3C70C.html)  
 
 ## Enroll your devices to your device compliance partner
 
@@ -145,4 +145,4 @@ Use additional documentation from your third-party partner to create compliance
 - [Blackberry UEM](https://docs.blackberry.com/en/id-comm-collab/blackberry-workspaces/blackberry-workspaces-plug-in-for-blackberry-uem/4_9/compatibility-matrix/imm1460398825659/ioz1460399956336)
 - [Citrix Endpoint Management - Integrate with Azure AD Conditional Access](https://docs.citrix.com/en-us/citrix-endpoint-management/prepare-to-enroll-devices-and-deliver-resources.html#integrate-with-azure-ad-conditional-access)
 - [MobileIron Device Compliance Cloud](https://forums.ivanti.com/s/article/MobileIron-Cloud-Azure-Device-Compliance-for-iOS-and-Android)
-- [VMware Workspace ONE UEM](https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/services/Directory_Service_Integration/GUID-800FB831-AA66-4094-8F5A-FA5899A3C70C.html)
+- [VMware Workspace ONE UEM](https://docs.vmware.com/en/VMware-Workspace-ONE-UEM/2102/Directory_Service_Integration/GUID-800FB831-AA66-4094-8F5A-FA5899A3C70C.html)