Merge pull request #6379 from MicrosoftDocs/main

12/14/2021 PM Publish

Author: Taojunshen

memdocs/intune/enrollment/device-enrollment-program-enroll-ios.md

@@ -207,7 +207,7 @@ Now that you've installed your token, you can create an enrollment profile for A
     - **Setup Assistant with modern authentication**: Devices running iOS/iPadOS 13.0 and later can use this method. Older iOS/iPadOS devices in this profile will fall back to using the **Setup Assistant (legacy)** process.  
 
         > [!NOTE]
-        > MFA won't work for Setup Assistant with modern authentication if you're using a 3rd party MFA provider to present the MFA screen during enrollment. Only the Azure AD MFA screen works during enrollment.  
+        > MFA won't work for Setup Assistant with modern authentication if you're using a 3rd party MFA provider to present the MFA screen during enrollment. Only the Azure AD MFA screen works during enrollment. For the latest support updates about custom controls for MFA, see [Upcoming changes to Custom Controls](https://techcommunity.microsoft.com/t5/azure-active-directory-identity/upcoming-changes-to-custom-controls/ba-p/1144696).  
 
         This method provides the same security as Company Portal authentication but avoids the issue of leaving end users with a device they can't use until the Company Portal installs.  
 

memdocs/intune/enrollment/enrollment-restrictions-set.md

@@ -198,20 +198,22 @@ The following filter properties are always available to use with enrollment poli
 
 **Windows** 
 
-* osVersion 
-* operatingSystemSKU 
-* deviceOwnership 
-* enrollmentProfileName 
+* OS version 
+* Operating System SKU 
+* Ownership
+* Enrollment profile name
 
 **iOS/iPadOS and macOS**  
 * Manufacturer 
 * Model 
-* OS Version 
-* Device ownership 
+* OS version 
+* Ownership 
 * Enrollment profile name 
 
 For more information about these properties, see [device properties](../fundamentals/filters-device-properties.md#device-properties). Filters cannot be used with Android enrollment restrictions.   
 
+>[!NOTE]
+>To use filters on enrollment restriction and enrollment status assignments, you must [enable the filters public preview in your tenant](../fundamentals/filters.md#enable-filters-public-preview).  
 
 ## Blocking personal Android devices
 - If you block personally owned Android device administrator devices from enrollment, personally-owned Android Enterprise work profile devices can still enroll.