Merge pull request #8098 from MicrosoftDocs/release-intune-2207

Release intune 2207

Author: Erikre

memdocs/configmgr/develop/reference/core/clients/sdk/ccm_requestedapppolicyactivation-client-wmi-class.md

@@ -48,7 +48,7 @@ Class CCM_RequestedAppPolicyActivation :
 
  Qualifiers: [values]  
 
- Activation action. Possible value are:  
+ Activation action. Possible values are:  
 
 |Value|Activation action|  
 |-|-|  

memdocs/intune/apps/apps-deploy.md

@@ -139,7 +139,7 @@ For unenrolled Android devices, you can use Managed Google Play to deploy store
 
 Steps to assign a Managed Google Play app to unmanaged devices:
 
-1. Connect your Intune tenant to managed Google Play. If you have already done this in order to manage Android Enterprise personally-owned, dedicated, fully managed, or corporate-owned work profile devices, you do not need to do it again.
+1. Connect your Intune tenant to managed Google Play. If you have already done this in order to manage Android Enterprise personally owned, dedicated, fully managed, or corporate-owned work profile devices, you do not need to do it again.
 2. Add apps from managed Google Play to your Intune console.
 3. Target managed Google Play apps as **Available with or without enrollment** to the desired user group. **Required** and **Uninstall** app targeting are not supported for non-enrolled devices.
 4. Assign an App Protection Policy to the user group.

memdocs/intune/apps/apps-supported-intune-apps.md

@@ -173,7 +173,7 @@ The following apps support the core Intune App Protection Policy settings. Apps
 | **iAnnotate for Intune/O365**<p><img alt="Partner app - iAnnotate for Intune/O365 icon" src="./media/apps-supported-intune-apps/icon-p-iannotate-for-intune.png" width="100">| Designed for Microsoft Intune enterprise users, iAnnotate for Intune/O365 allows you to read, annotate, and share PDFs, Microsoft Office files, images and web pages. Seamlessly integrate with OneDrive and Outlook, while easily converting all MS documents to PDFs for quick markup. IT administrators must visit https://enterprise.iannotate.com/ to activate a 30-day free trial and to view the iAnnotate for Intune deployment guide. | [App Store link (iOS)](https://apps.apple.com/app/iannotate-for-intune-o365/id1567388828) |
 | **iBabs for Intune**<p><img alt="Partner app - iBabs for Intune icon" src="./media/apps-supported-intune-apps/icon-p-ibabs.png" width="100">| ISEC7 Mobile Exchange Delegate allows authorized representatives via iPhone and iPad to agree to appointments for their colleagues, to manage their contacts, and to answer emails on behalf of other users. | [App Store link (iOS)](https://apps.apple.com/us/app/ibabs-for-intune/id1130847428?mt=8) |
 | **iManage Work 10 For Intune**<p><img alt="Partner app - iManage Work 10 For Intune icon" src="./media/apps-supported-intune-apps/icon-p-imanage.png" width="100">| Confidently and securely access content from iManage Work with Work Mobility for Intune. Empower users to find, edit, collaborate, and share documents and emails from their iOS device. iManage Mobility enables users to be productive from anywhere, with a consistent user experience and the same security protections as iManage Work 10. | [App Store link (iOS)](https://apps.apple.com/app/imanage-work-10-for-intune/id1337285529?ls=1) |
-| **ISEC7 MED for Intune**<p><img alt="Partner app - ISEC7 MED for Intune icon" src="./media/apps-supported-intune-apps/icon-p-isec7-med.png" width="100">| ISEC7 Mobile Exchange Delegate provides mobile access to authorised Microsoft® Exchange Mailboxes and Public Folders. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.isec7.android.med.intune),<br>[App Store link (iOS)](https://apps.apple.com/app/isec7-med-for-intune/id1491037389?ls=1) |
+| **ISEC7 MED for Intune**<p><img alt="Partner app - ISEC7 MED for Intune icon" src="./media/apps-supported-intune-apps/icon-p-isec7-med.png" width="100">| ISEC7 Mobile Exchange Delegate provides mobile access to authorized Microsoft® Exchange Mailboxes and Public Folders. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.isec7.android.med.intune),<br>[App Store link (iOS)](https://apps.apple.com/app/isec7-med-for-intune/id1491037389?ls=1) |
 | **Leap Work for Intune**<p><img alt="Partner app - Leap Work for Intune icon" src="./media/apps-supported-intune-apps/icon-p-leapwork.png" width="100">| Leap Work is a B2C communication app. Employees can call or send text, voice, and file messages to client's messengers of their choice: WhatsApp&trade;, WeChat&trade;, Telegram&trade;, Line&trade;, SMS and others. Leap Work is a part of LeapXpert's Federated Messaging Orchestration Platform (FMOP). FMOP concept allows the promotion of messaging to a formal business communication channel, similar to calling or emailing. <br>Use Leap Work to:<br><ul><li>Reach clients on their messengers</li><li>Own and control all company's communication data</li><li>Gather employees and clients communication on one platform</li><li>Allow group chats between employees and clients</li><li>Keep company communication history always available for monitoring and compliance purposes</li></ul> | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.leapxpert.leap.work.intune),<br>[App Store link (iOS)](https://apps.apple.com/sg/app/leap-work-for-intune/id1536700401) |
 | **Lexmark Mobile Print Intune**<p><img alt="Partner app - Lexmark Mobile Print Intune icon" src="./media/apps-supported-intune-apps/icon-p-lexmark-mobile-print.png" width="100">| Mobile computing has become pervasive—it's simply a state of always on, barrier-free connectedness that entertains, enlightens and helps you get more work done. <br><br>While business users expect desktop and mobile printing to be equally convenient, IT managers know how complicated it can be to provide seamless output due to mobile's unique characteristics. With connectivity, security and network challenges to solve across multiple operating systems, providing your users with the flexible printing they expect can be complex. <br><br>Lexmark offers the experience and innovation to help you meet the printing needs of your users in a way that's easy and hassle-free for IT. By addressing your challenges with a comprehensive set of tools and options, we can help you achieve a mobile printing experience that is more transparent, simple and secure.  | [App Store link (iOS)](https://apps.apple.com/sg/app/lexmark-mobile-print/id469415392) |
 | **LumApps for Intune**<p><img alt="Partner app - LumApps for Intune icon" src="./media/apps-supported-intune-apps/icon-p-lumapps-for-intune.png" width="100">| LumApps for Intune allows Intune admins to organize and protect Bring Your Own Device (BYOD) environments. From Microsoft Endpoint Manager admin center, admins can create policies to protect corporate data while keeping employees connected. The LumApps platform provides corporate news, business tools, essential documents, and social communities.<p><p>LumApps for Intune includes several features:<br><ul><li>Browse listed content, including company news and targeted information streams</li><li>View detailed content and comments with attached files</li><li>React to content in real-time</li><li>Like and respond to posts and comments</li><li>View all communities at a glance and follow your favorites</li><li>Check your preferred communities’ activity</li><li>Create your own community post with attached files, links, and tags</li><li>Quick access to LumApps Help page</li></ul><p><p>To use LumApps for Intune, your company’s active subscription plan to LumApps must include the mobile option, with valid login credentials. Additionally, LumApps for Intune requires a Microsoft managed environment. Please contact your company’s IT administrator if you have issues or questions about using LumApps for Intune.  | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.lumapps.android.intune),<br>[App Store link (iOS)](https://apps.apple.com/gb/app/lumapps-for-intune/id1542216268) |
@@ -195,7 +195,7 @@ The following apps support the core Intune App Protection Policy settings. Apps
 | **ServiceNow<sup>&#174;</sup> Agent - Intune**<p><img alt="Partner app - ServiceNow Agent icon" src="./media/apps-supported-intune-apps/icon-p-servicenow-agent.png" width="100"> | ServiceNow Mobile Agent app delivers out-of-the-box, mobile-first experiences for the most common service desk agent workflows, making it easy for agents to triage, act on and resolve requests on the go. The app enables service desk agents to promptly manage and resolve end user issues from their mobile devices. Agents use the app’s intuitive interface to accept and update work even without Internet connectivity. The app greatly simplifies work by leveraging native device capabilities for tasks like navigation, barcode scanning, or collecting a signature.<br><br>The app comes with out-of-the-box workflows for service desk agents in IT, Customer Service, HR, Field Services, Security Ops and IT Asset Management. Organizations can easily configure and extend the workflows to meet their own unique needs.<p>With Mobile Agent you can:<ul><li>Manage the work assigned to your teams.</li><li>Triage incidents and cases.</li><li>Act on approvals with swipe gestures and quick actions.</li><li>Complete work while offline.</li><li>Access the full issue details, activity stream, and related lists of records.</li><li>Optimize workflows with location, camera, and touchscreen hardware</li></ul> | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.servicenow.fulfiller.mam.intune),<br>[App Store link (iOS)](https://apps.apple.com/app/servicenow-agent-intune/id1494183149) |  
 | **ServiceNow<sup>&#174;</sup> Onboarding - Intune**<p><img alt="Partner app - ServiceNow Onboarding icon" src="./media/apps-supported-intune-apps/icon-p-servicenow-onboarding.png" width="100"> | ServiceNow<sup>&#174;</sup> Mobile Onboarding empowers new hires to complete tasks, view content, and get help across departments—including IT, HR, Facilities, Finance, and Legal—all from a single native mobile app.<br><br>Streamline the onboarding experience by allowing new hires to:<ul><li>Order a laptop and phone from IT.</li><li>Set up a workspace with Facilities.</li><li>Sign a non-disclosure agreement (NDA) from Legal.</li><li>Submit a photo and update their profile with HR.</li><li>Review an expense policy from Finance and get help if they have questions.</li></ul>Powered by the Now Platform<sup>&#174;</sup>, Mobile Onboarding manages workflows across multiple departments and systems, hiding the complexity of backend processes. New hires don't even have to know which departments are involved in any given process. They receive a simple and easy onboarding experience and can complete tasks before they even start, ensuring they are day-one ready. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.servicenow.onboarding.mam.intune),<br>[App Store link (iOS)](https://apps.apple.com/app/servicenow-onboarding-intune/id1494184220) |  
 | **Slack for Intune**<p><img alt="Partner app - Slack for Intune icon" src="./media/apps-supported-intune-apps/icon-p-slack.png" width="100"> | Slack for Intune is for Slack customers that have enabled Microsoft Intune Mobile Application Management (MAM). | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.Slack.intune), [App Store link (iOS)](https://apps.apple.com/app/slack-for-intune/id1558736484) |  
-| **PK Protect for Intune**<p><img alt="Partner app - PK Protect for Intune icon" src="./media/apps-supported-intune-apps/icon-p-smartcrypt.png" width="100"> | PK Protect for Intune is specifically designed for existing PKWARE customers operating in an Intune environment. PK Protect lets you get your work done on the go. It's fast, secure and simple to use so you can be productive from anywhere. If you are unsure if you have PK Protect, contact your company's IT administrator. With PK Protect, you can: Encrypt and decrypt files using Smartkeys, Decrypt archives with X.509 Digital Certificates, Create and manage Smartkeys, Perform digital signing and authentication of data with X.509 Digital Certificates, Encrypt and decrypt files with Strong Passphrase encryption, including AE2, Login with existing Active Directory credentials, Create and view unencrypted zip archives. PK Protect armors data at its core, eliminating vulnerabilities everywhere data is used, shared or stored. For nearly three decades, PKWARE has provided encryption and compression software to more than 30,000 enterprise customers and over 200 government agencies. Available for iOS/iPadOS and Android. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.pkware.smartcrypt.intune), [App Store link (iOS)](https://apps.apple.com/app/smartcrypt-for-intune/id1489232256) |
+| **PK Protect for Intune**<p><img alt="Partner app - PK Protect for Intune icon" src="./media/apps-supported-intune-apps/icon-p-smartcrypt.png" width="100"> | PK Protect for Intune is specifically designed for existing PKWARE customers operating in an Intune environment. PK Protect lets you get your work done on the go. It's fast, secure and simple to use so you can be productive from anywhere. If you are unsure if you have PK Protect, contact your company's IT administrator. With PK Protect, you can: Encrypt and decrypt files using Smartkeys, Decrypt archives with X.509 Digital Certificates, Create and manage Smartkeys, Perform digital signing and authentication of data with X.509 Digital Certificates, Encrypt and decrypt files with Strong Passphrase encryption, including AE2, Log in with existing Active Directory credentials, Create and view unencrypted zip archives. PK Protect armors data at its core, eliminating vulnerabilities everywhere data is used, shared or stored. For nearly three decades, PKWARE has provided encryption and compression software to more than 30,000 enterprise customers and over 200 government agencies. Available for iOS/iPadOS and Android. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.pkware.smartcrypt.intune), [App Store link (iOS)](https://apps.apple.com/app/smartcrypt-for-intune/id1489232256) |
 | **Space Connect**<p><img alt="Partner app - Space Connect icon" src="./media/apps-supported-intune-apps/icon-p-space-connect.png" width="100"> | Space Connect brings together people and office space to enable businesses to manage office space more effectively & automatically. Book desks, book rooms, check your calendar, find your colleagues, and more with our mobile workspace management solution. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.bluechilli.spaceconnectapp), [App Store link (iOS)](https://apps.apple.com/app/space-connect/id1023361383) |  
 | **Speaking Email**<p><img alt="Partner app - Speaking Email icon" src="./media/apps-supported-intune-apps/icon-p-speaking-email-icon.png" width="100">   | Get more time in your day by having your email read to you on the move. Voice commands and simple gestures designed to be safe to use while driving give you the ability to archive, flag or even reply on the move.<p>Smart content detection skips over disclaimers, reply headers, and email signatures to speak only the content without the clutter.<p>Employees can sign in via Intune to access Microsoft 365 Exchange email. | [App Store link (iOS)](https://apps.apple.com/app/apple-store/id991406423?ct=intune) | 
 | **Synergi Life**<p><img alt="Partner app - Synergi Life icon" src="./media/apps-supported-intune-apps/icon-p-synergi-life.png" width="100"> | Synergi Life Mobile App, an extension of Synergi Life, lets users easily create observations and incident reports anytime and from anywhere, using their phones to take a snapshot and make a voice recording.<p>Synergi Life (previously named Synergi) is a complete business solution for risk and QHSE management, managing all non-conformances, incidents, risk, risk analyses, audits, assessments and improvement suggestions.<p>The Synergi Life Mobile App requires you to be a licensed user of the Synergi Life risk and QHSE management system, and have the necessary back-end licensed software and services. | [Google Play link (Android)](https://play.google.com/store/apps/details?id=com.dnv.mobilesolutions.synergimobile.uibase), [App Store link (iOS)](https://apps.apple.com/us/app/synergi-life/id641181737)  |  

memdocs/intune/configuration/device-restrictions-android-for-work.md

@@ -7,7 +7,7 @@ keywords:
 author: MandiOhlinger
 ms.author: mandia
 manager: dougeby
-ms.date: 07/18/2022
+ms.date: 07/26/2022
 ms.topic: conceptual
 ms.service: microsoft-intune
 ms.subservice: configuration
@@ -200,6 +200,22 @@ For corporate-owned devices with a work profile, some settings only apply in the
 
 - **Threat scan on apps**: **Require** (default) enables Google Play Protect to scan apps before and after they're installed. If it detects a threat, it may warn users to remove the app from the device. When set to **Not configured**, Intune doesn't change or update this setting. By default, the OS might not enable or run Google Play Protect to scan apps.
 
+- **Common Criteria mode**: **Require** enables an elevated set of security standards that are most often used in highly sensitive organizations, such as government establishments. Those settings include but are not limited to:
+
+  - AES-GCM encryption of Bluetooth Long Term Keys
+  - Wi-Fi configuration stores
+  - Blocks bootloader download mode, the manual method for software updates
+  - Mandates additional key zeroization on key deletion
+  - Prevents non-authenticated Bluetooth connections
+  - Requires that FOTA updates have 2048-bit RSA-PSS signature
+
+  When set to **Not configured** (default), Intune doesn't change or update this setting.
+
+  Learn more about Common Criteria:  
+  - [Common Criteria for Information Technology Security Evaluation](https://www.commoncriteriaportal.org) at commoncriteriaportal.org  
+  - [CommonCriteriaMode](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies#commoncriteriamode) in the Android Management API documentation.  
+  - [Knox Deep Dive: Common Criteria Mode](https://www.samsungknox.com/blog/knox-deep-dive-common-criteria-mode) at samsungknox.com
+
 ### Device experience
 
 Use these settings to configure a kiosk-style experience on your dedicated devices, or to customize the home screen experiences on your fully managed devices. You can configure devices to run one app, or run many apps. When a device is set with kiosk mode, only the apps you add are available.
@@ -693,7 +709,7 @@ You can configure the following settings:
 
 These settings apply to Android Enterprise personally owned devices with a work profile (BYOD).
 
-### Personally owned devices with a work profile settings
+### Personally owned devices with a work profile - settings
 
 - **Copy and paste between work and personal profiles**: **Block** prevents copy-and-paste between work and personal apps. When set to **Not configured** (default), Intune doesn't change or update this setting. By default, the OS might allow users to share data using copy-and-paste with apps in the personal profile.
 - **Data sharing between work and personal profiles**: Choose if apps in the work profile can share with apps in the personal profile. For example, you can control sharing actions within applications, such as the **Share…** option in the Chrome browser app. This setting doesn't apply to copy/paste clipboard behavior. Your options: