You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As an Intune admin, you can require that users accept your company's terms and conditions before using the Company Portal to:
37
-
- enroll devices
38
-
- access resources like company apps and email.
36
+
Use an Intune terms and conditions policy to present relevant disclaimers for legal or compliance requirements to device users. A terms and conditions policy requires targeted users to accept your terms in Company Portal before they can enroll devices or access protected resources.
39
37
40
-
Configuration of terms and conditions is optional.
38
+
This article describes how to get started with terms and conditions in Intune.
41
39
42
-
You can create multiple sets of terms and assign them to different groups, such as to support different languages.
40
+
## Create terms and conditions
41
+
Complete these steps to create an Intune terms and conditions policy.
43
42
44
-
There are two ways to create your company terms and conditions:
45
-
- by using Intune as described in this article.
46
-
- by using the [Azure Active Directory terms of use feature](/azure/active-directory/governance/active-directory-tou)
43
+
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431)and select **Tenant administration** > **Terms and conditions**.
44
+
2. Select **Create**.
45
+
3. On the **Basics** page, enter the following information:
47
46
48
-
To learn which method is best for you, check out the [Choosing the right Terms solution for your organization blog post](https://go.microsoft.com/fwlink/?linkid=2010506&clcid=0x409).
47
+
-**Name**: Give your policy a name so that you can recognize it in Intune later. Device users don't see this name.
48
+
-**Description**: Optionally, describe the purpose or intended use for this specific set of terms.
49
49
50
-
## Create terms and conditions
51
-
Complete these steps to create terms and conditions. The display name and description are for administrative use while terms properties are displayed to users in the Company Portal.
50
+
4. Select **Next**.
51
+
5. On the **Terms** page, enter the following information:
52
52
53
-
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Tenant administration** > **Terms and Conditions**.
54
-
2. Choose **Create**.
55
-
3. On the **Basics** page, specify the following information:
53
+
-**Title**: The display name for your terms. Users see the title in the Company Portal app.
54
+
-**Terms and conditions**: The terms and conditions that users see and must either accept or reject.
55
+
-**Summary of Terms**: Enter a brief, high-level explanation of what the user is agreeing to. This text is visible to device users.
56
+
57
+
Example message: *By enrolling your device, you're agreeing to the terms of use set out by Contoso. Read the terms carefully before proceeding.*
56
58
57
-
-**Name**: The name for the terms in the Azure portal. Users don't see this name.
58
-
-**Description**: Optional details that help you identify this set of terms in the Azure portal.
59
+
5. Select **Next**.
59
60
60
-
61
+
6. On the **Select scope tags**, select a scope tag from the list to add it to the terms and conditions, or select the default scope tag. Then select **Next**.
61
62
62
-
4. Choose **Next** to go to the **Terms** page and provide the following information:
63
+
7. On the **Assignments** page, choose who you want to assign the terms to. Your options:
64
+
-**Add all users**: Choose this option to assign these terms and conditions to all device users.
65
+
-**Add groups**: Choose this option to assign these terms and conditions to users in select groups.
63
66
64
-
-**Title**: The name for your terms that users see in the Company Portal above the **Summary**.
65
-
-**Terms and Conditions**: The terms and conditions that users see and must either accept or reject.
66
-
-**Summary of Terms**: Text that explains what it means when users accept the terms. For example, "By enrolling your device, you're agreeing to the terms of use set out by Contoso. Read the terms carefully before proceeding."
67
+
8. Select **Next**.
68
+
9. Review the summary of your new terms and conditions, and then select **Create**.
67
69
68
-
5. Choose **Next** to go to the **Scope tags** page.
70
+
## How it looks to users
71
+
Targeted users can see the terms and conditions in the Intune Company Portal app. The following image shows what the title and summary of terms look like in the app. Intune formats the title with bold font to make it stand out, with the summary of terms positioned directly under it.
69
72
70
-
6. Choose **Select scope tags**, select the scope tags that you want to assign to these terms and conditions, and then choose **Select**.
73
+
> [!div class="mx-imgBorder"]
74
+
> 
71
75
72
-
7. Choose **Next** to go to the **Assignments** page and choose one of the following options for **Assign to**:
73
-
-**All users**: Choose this option to assign these terms and conditions to all users.
74
-
-**Select groups**: Choose this option to assign these terms and conditions to everyone in the groups that you identify by choosing **Select groups to include**.
76
+
Device users tap **Read terms** to expand the terms and conditions to full-view. The following image shows what the terms and conditions look like when expanded.
75
77
76
-
8. Choose **Next** > **Create**.
78
+
> [!div class="mx-imgBorder"]
79
+
> 
77
80
78
-
## See how terms are displayed to your users
79
-
The following example shows the **Title** and **Summary of Terms** in the admin console and Company Portal.
81
+
## Monitor acceptance of terms
82
+
An acceptance report provides the details of an individual's agreement to your terms and conditions. Intune reports the following details:
80
83
81
-
84
+
* User name: The name of the user who accepted the terms.
85
+
* Accepted version: The version that was accepted.
86
+
* Accepted time: The date and time of acceptance.
87
+
* Accepted latest: Shows whether device user accepted the latest terms and conditions available.
88
+
* UPN: The user principal name assigned to the device user.
82
89
83
-
The following example shows the terms and conditions in the admin console and the Company Portal.
90
+
To view and export acceptance reports:
84
91
85
-
92
+
1. Go to **Tenant administration** > **Terms and conditions**.
93
+
2. Select your terms from the table.
94
+
3. Select **Acceptance Reporting** to view available reports.
95
+
4. Select **Export** to save the reports to your device.
86
96
97
+
> [!NOTE]
98
+
> Report data is updated every 24 hours and can take up to 12 hours to finish generating. Because of this, data in the report can have up to a 36 hour latency.
87
99
88
-
## Monitor terms and conditions
100
+
## Provide localized terms and conditions
101
+
You can create multiple policies using localized text, and then target each policy to the appropriate groups of users.
89
102
90
-
To add *terms of use* compliance requirements, use the following steps:
103
+
## Update terms and conditions
91
104
92
-
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Tenant administration** > **Terms and Conditions**.
93
-
2. In the **Terms and conditions** pane, select **Create** to add and assign *terms of use* compliance requirements to your end users.
105
+
Microsoft Intune provides a version control setting so that you can track versions and notify users of changes to your terms. As a best practice, every time you make a significant change to your terms and conditions, you should:
94
106
95
-
> [!NOTE]
96
-
> Acceptance reporting data is updated every 24 hours and can take up to 12 hours to run. As such, data in the report can have up to a 36 hour latency.
107
+
- Increase the version number in Intune.
108
+
- Require assigned users to review and reaccept the updated terms.
97
109
110
+
> [!TIP]
111
+
> Do not change the version number for changes like typo and formatting fixes.
98
112
99
-
## Work with multiple versions of terms and conditions
100
-
You can edit your terms and conditions and manage their versions. Each time you make a significant change to your terms and conditions, you should:
101
-
- increase the version number
102
-
- require users to accept the new terms and conditions
113
+
To edit terms and conditions:
103
114
104
-
Keep the current version number if, for example, you're fixing typos or changing formatting.
115
+
1. Select **Tenant administration** > **Terms and conditions**.
116
+
2. From the table, choose the terms and conditions you want to edit.
117
+
3. Select **Properties** and then next to **Terms**, select **Edit.**
118
+
4. Adjust the existing content as needed.
119
+
5. If you edit the meaning of the terms at all, select the checkbox next to **Require users to re-accept, and increment the version number to *next version*.** In place of *next step*, you'll see the actual version number.
120
+
3. Select **Review + save**.
121
+
4. Review the summary for your terms and conditions, and then select **Save**.
105
122
106
-
1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Tenant administration** > **Terms and Conditions** > choose the terms and conditions you want to modify > **Properties**.
123
+
Users only have to accept the updated terms and conditions once. This means that a user associated with multiple enrolled devices won't need to accept the terms and conditions on each device.
107
124
108
-
2. On the **Properties** pane, choose **Terms and Conditions** and then modify the **Title**, **Summary of Terms**, and **Terms and Conditions** as needed. If your changes make it necessary for users to reaccept the new terms, choose **Require users to re-accept, and increment the version number to**
125
+
## Use Azure AD Terms of use feature
126
+
You can use the [Azure Active Directory terms of use](/azure/active-directory/conditional-access/terms-of-use) feature to configure stricter compliance requirements. Capabilities include:
109
127
110
-
3. Choose **OK** > **Save**.
128
+
* Attach multiple localized versions to a single policy
129
+
* Render terms in PDF format for a richer experience that allows for branding, images, and hyperlinks
130
+
* Require users to expand the terms of use
131
+
* Require users to consent on every device
132
+
* Expire consents
133
+
* Require users to reaccept terms after a certain period of time
134
+
* Provide terms for non-enrollment scenarios
111
135
112
-
Users only have to accept updated terms and conditions once. Users with multiple devices don't have to accept terms and conditions on each device.
136
+
These terms are shown to users when they sign in to targeted apps and resources. If you configure both Azure AD terms of use and Intune terms and conditions, users will be required to accept both. For a comparison of both solutions, see [Choosing the right Terms solution for your organization](https://go.microsoft.com/fwlink/?linkid=2010506&clcid=0x409).
Copy file name to clipboardExpand all lines: memdocs/intune/protect/encrypt-devices.md
+39Lines changed: 39 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -146,6 +146,45 @@ Depending on the type of policy that you use to silently enable BitLocker, confi
146
146
> [!TIP]
147
147
> While the setting labels and options in the following two policy types are different from each other, they both apply the same configuration to Windows encryption CSPs that manage BitLocker on Windows devices.
148
148
149
+
### Full disk vs Used Space only encryption
150
+
151
+
Three settings determine whether an OS drive will be encrypted using used space only or full disk encryption:
152
+
- Whether the hardware of the device is [modern standby](/windows-hardware/design/device-experiences/modern-standby) capable
153
+
- Whether silent enablement has been configured for BitLocker
154
+
- ('Warning for other disk encryption' = Block or 'Hide prompt about third-party encryption' = Yes)
155
+
- Configuration of the [SystemDrivesEncryptionType](/windows/client-management/mdm/bitlocker-csp)
156
+
- (Enforce drive encryption type on operating system drives)
157
+
158
+
Assuming that SystemDrivesEncryptionType has not been configured, the following is the expected behaviour. When silent enablement is configured on a modern standby device, the OS drive will be encrypted using used space only encryption. When silent enablement is configured on a device which is not capable of modern standby, the OS drive will be encrypted using full disk encryption. The result is the same whether you are using an [Endpoint Security disk encryption policy for BitLocker](/mem/intune/protect/encrypt-devices#create-an-endpoint-security-policy-for-bitlocker) or a [Device Configuration profile for endpoint protection for BitLocker](/mem/intune/protect/encrypt-devices#create-an-endpoint-security-policy-for-bitlocker). If a different end state is required, the encryption type can be controlled by configuring the SystemDrivesEncryptionType using settings catalog as shown below.
159
+
160
+
To verify whether the hardware is modern standby capable, run the following command from a command prompt:
161
+
162
+
```console
163
+
powercfg /a
164
+
```
165
+
If the device supports modern standby, it will show that Standby (S0 Low Power Idle) Network Connected is available
166
+
167
+
:::image type="content" source="./media/encrypt-devices/docs_bl_powercfg_surface_s0_possible.png" alt-text="Screenshot of command prompt displaying output of powercfg command with Standby state S0 available.":::
168
+
169
+
If the device does not support modern standby, such as a virtual machine, it will show that Standby (S0 Low Power Idle) Network Connected is not supported
170
+
171
+
:::image type="content" source="./media/encrypt-devices/docs_bl_powercfg_surface_nos0possible.png" alt-text="Screenshot of command prompt displaying output of powercfg command with Standby state S0 un-available.":::
172
+
173
+
To verify the encryption type, run the following command from an elevated (admin) command prompt:
174
+
175
+
```console
176
+
manage-bde -status c:
177
+
```
178
+
The 'Conversion Status' field will reflect the encryption type as either Used Space Only encrypted or Fully Encrypted.
179
+
180
+
:::image type="content" source="./media/encrypt-devices/docs_bl_usedspaceonly.png" alt-text="Screenshot of administrative command prompt showing output of manage-bde with conversion status reflecting fully encrypted.":::
181
+
182
+
:::image type="content" source="./media/encrypt-devices/docs_bl_fullyencrypted.png" alt-text="Screenshot of administrative command prompt showing output of manage-bde with conversion status reflecting used space only encryption.":::
183
+
184
+
To change the disk encryption type between full disk encryption and used space only encryption, leverage the'Enforce drive encryption type on operating system drives' setting within settings catalog.
185
+
186
+
:::image type="content" source="./media/encrypt-devices/docs_bl_settingscatalog_control_encryption.png" alt-text="Screenshot of Intune settings catalog displaying Enforce drive encryption type on operating system drives setting and drop-down list to select from full or used space only encryption types.":::
187
+
149
188
#### TPM startup PIN or key
150
189
151
190
A device **must not require** use of a startup PIN or startup key.
Copy file name to clipboardExpand all lines: windows-365/enterprise/create-on-premises-network-connection.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -45,7 +45,8 @@ As part of the connection process, the Windows 365 service is granted the follow
45
45
To create an OPNC, you must:
46
46
47
47
- Be an [Intune Administrator in Azure AD](/azure/active-directory/roles/permissions-reference).
48
-
- Have [Owner permissions on the Azure subscription](/azure/cost-management-billing/manage/add-change-subscription-administrator) that contains the virtual network.
48
+
- Have [Owner permissions on the Azure subscription](/azure/cost-management-billing/manage/add-change-subscription-administrator) that contains the virtual network with connectivity to your on-premises domain controller and network.
49
+
- Make sure that your PowerShell execution policy is configured to allow RemoteSigned scripts. If you use Group Policy to set execution policy, make sure that the Group Policy Object (GPO) targeted at the Organizational Unit (OU) defined in the OPNC is configured to allow RemoteSigned scripts. For more information, see [Set-ExecutionPolicy](/powershell/module/microsoft.powershell.security/set-executionpolicy).
0 commit comments