Description: User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode This policy setting controls the behavior of the elevation prompt for administrators. The options are:

Why It's Important: This setting adds an extra layer of protection by making sure that when an admin tries to do something important, they must clearly approve it—and it happens in a secure environment that malware or other apps can’t mess with. It helps prevent accidental changes and stops malicious software from silently making system-level changes. Think of it like a locked door that only opens when the admin says “yes,” and no one else can sneak in while it’s happening.

Learn More

Description: This policy setting lets you control whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. This policy only affects Windows Store apps that support it. If you enable this policy setting, Windows Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead. If you disable or do not configure this policy setting, users will need to sign in with a Microsoft account.

Why It's Important: This setting gives organizations more control and flexibility by allowing users to use their enterprise credentials (like their work email) to access apps, instead of being forced to use a personal Microsoft account. It helps keep things professional, simplifies account management, and supports environments where personal accounts aren’t allowed. It’s like letting employees use their company badge instead of needing a separate membership card to enter a building.

Learn More

Description: This setting lets you decide whether employees can save their passwords locally, using Password Manager.

Why It's Important: This setting helps protect sensitive login information by stopping users from storing passwords on their devices, where they could be accessed by unauthorized users or malware. While password managers are convenient, they can also be a security risk if the device is compromised. Blocking this feature encourages safer practices, like using enterprise-managed password vaults or multi-factor authentication. It’s like saying, “Don’t leave your keys under the doormat—use a secure lockbox instead.”

Learn More

Description: This setting lets you decide whether to turn on Windows Defender SmartScreen.

Why It's Important: This setting helps keep users safe while browsing the internet or downloading files by checking them against Microsoft’s threat database. If something looks suspicious or is known to be dangerous, SmartScreen will warn the user or block it entirely. It’s like having a digital security guard that checks every link and file before you open it—helping prevent phishing, malware, and other online threats.

Learn More

Description: If set to 1 then any MDM policy that is set that has an equivalent GP policy will result in GP service blocking the setting of the policy by GP MMC. Setting the value to 0 (zero) or deleting the policy will remove the GP policy blocks restore the saved GP policies.

Why It's Important: This setting helps avoid conflicts between Intune and traditional Group Policy by making sure that Intune’s settings always win when both are trying to control the same thing. Without this, the system might get confused or behave unpredictably. It’s like having two managers giving different instructions—this policy makes sure the device listens to just one (Intune), keeping things consistent and easier to manage across modern environments.

Learn More

Description: Specifies the method that Delivery Optimization can use to download content on behalf of various Microsoft products.

Why It's Important: This setting helps speed up downloads and reduce internet usage by allowing devices in the same network (like within a company) to share updates with each other. Instead of every device downloading the same file from the internet, one device can download it and then share it locally. It’s like one person picking up a package for the whole office, saving time and bandwidth. This method improves efficiency while keeping sharing limited to trusted devices.

Learn More

Description: Specifies whether device lock is enabled.

Why It's Important: This setting helps protect the device from unauthorized access by making sure users must enter a password or PIN to use it. Without a lock, anyone could pick up the device and access sensitive information. Enabling this policy is like putting a lock on your phone or laptop—it’s a simple but essential step to keep personal and company data safe.

Learn More

Description: This security setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow changes immediately by setting the number of days to 0. The minimum password age must be less than the Maximum password age, unless the maximum password age is set to 0, indicating that passwords will never expire. If the maximum password age is set to 0, the minimum password age can be set to any value between 0 and 998. Configure the minimum password age to be more than 0 if you want Enforce password history to be effective. Without a minimum password age, users can cycle through passwords repeatedly until they get to an old favorite. The default setting does not follow this recommendation, so that an administrator can specify a password for a user and then require the user to change the administrator-defined password when the user logs on. If the password history is set to 0, the user does not have to choose a new password. For this reason, Enforce password history is set to 1 by default.

Why It's Important: This setting helps prevent users from quickly cycling through multiple passwords just to reuse an old one. By requiring a minimum age of 1 day, it enforces password history rules more effectively—making sure users actually stick with a new password for a while before changing it again. It’s like saying, “You can’t keep switching keys until you get back to your favorite one,” which helps maintain stronger password hygiene.

Learn More

Description: This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.

Why It's Important: This setting helps protect devices from malware and other harmful software by limiting where apps can be installed from. Instead of letting users download and run apps from anywhere on the internet, it encourages or enforces the use of trusted sources like the Microsoft Store. It’s like saying, “Only get your software from verified vendors,” which reduces the risk of downloading something dangerous by mistake.

Learn More

Description: Allows IT Admins to configure SmartScreen for Windows.

Why It's Important: This setting helps prevent users from accidentally opening harmful files by checking them against Microsoft’s threat database. If a file looks suspicious, SmartScreen will warn the user or block it. It’s like having a security guard that checks every package before you open it—especially useful when downloading apps or files from the web. Enabling this policy adds a layer of protection directly in the Windows interface, where users interact with files.

Learn More

Description: Show recommended app suggestions in the ink workspace.

Why It's Important: This setting helps keep the Windows Ink Workspace clean and focused by blocking app suggestions that come from Microsoft. It reduces distractions and avoids promoting apps that may not be approved or relevant in a managed environment. It’s like saying, “Don’t show ads or suggestions—just let users work with the tools they already have.” This is especially useful in enterprise or education settings where app recommendations aren’t needed or wanted.

Learn More

Description: Allows you to specify which extensions the users can NOT install. Extensions already installed will be disabled if blocked, without a way for the user to enable them. Once an extension disabled due to the blocklist is removed from it, it will automatically get re-enabled. A blocklist value of '*' means all extensions are blocked unless they are explicitly listed in the allowlist. If this policy is left not set the user can install any extension in Google Chrome. Example value: extension_id1 extension_id2.

Why It's Important: This setting helps keep users safe and productive by blocking risky or unnecessary browser extensions. It stops users from installing tools that could slow down their computer, show ads, or even steal data. SHIELD enables this policy to make sure only trusted extensions are used—like locking down which tools are allowed in a workspace. It’s a smart way to prevent problems before they happen.

Learn More

Description: Setting the policy specifies a list of apps and extensions that install silently, without user interaction, and which users can't uninstall or turn off. Permissions are granted implicitly, including for the enterprise.deviceAttributes and enterprise.platformKeys extension APIs. (These 2 APIs aren't available to apps and extensions that aren't force-installed.) Leaving the policy unset means no apps or extensions are autoinstalled, and users can uninstall any app or extension in Google Chrome. This policy superseeds ExtensionInstallBlocklist policy. If a previously force-installed app or extension is removed from this list, Google Chrome automatically uninstalls it. On Microsoft Windows instances, apps and extensions from outside the Chrome Web Store can only be forced installed if the instance is joined to a Microsoft Active Directory domain, running on Windows 10 Pro, or enrolled in Chrome Browser Cloud Management. On macOS instances, apps and extensions from outside the Chrome Web Store can only be force installed if the instance is managed via MDM, or joined to a domain via MCX. The source code of any extension may be altered by users through developer tools, potentially rendering the extension dysfunctional. If this is a concern, set the DeveloperToolsDisabled policy. Each list item of the policy is a string that contains an extension ID and, optionally, an "update" URL separated by a semicolon (;). The extension ID is the 32-letter string found, for example, on chrome://extensions when in Developer mode. If specified, the "update" URL should point to an Update Manifest XML document (https://developer.chrome.com/extensions/autoupdate). By default, the Chrome Web Store's update URL is used. The "update" URL set in this policy is only used for the initial installation; subsequent updates of the extension use the update URL in the extension's manifest. Note: This policy doesn't apply to Incognito mode.

Why It's Important: This setting ensures that important extensions—like security tools or productivity apps—are automatically installed and locked in place. Users don’t have to do anything, and they can’t remove or disable these tools. SHIELD enables this policy to guarantee that every device has the right extensions for security, compliance, and performance. It’s like preloading company laptops with essential software—so users are ready to work securely from the start.

Learn More

Description: Specifies whether user is allowed to add non-MSA email accounts. Most restricted value is 0. Note This policy will only block UI/UX-based methods for adding non-Microsoft accounts. Even if this policy is enforced, you can still provision non-MSA accounts using the EMAIL2 CSP.

Why It's Important: This policy controls whether users can manually add non-Microsoft email accounts (e.g., Gmail, Yahoo, or corporate IMAP/SMTP accounts) through the device’s UI. Setting this to "Block" (value 0) is considered the most secure and compliant configuration. Allowing unmanaged, non-Microsoft accounts on corporate devices introduces significant data exfiltration risks. Users could:

Learn More

Description: Specifies whether the user is allowed to use an MSA account for non-email related connection authentication and services. Most restricted value is 0.

Why It's Important: Microsoft accounts (MSAs) are typically used for personal services like OneDrive, Xbox, and Outlook.com. In enterprise environments, allowing users to connect personal accounts to work devices can introduce security and data leakage risks. It may also lead to unauthorized syncing of personal content or access to consumer services that aren't governed by corporate policies. SHIELD blocks this setting to enforce a clear separation between personal and work identities, reduce the attack surface, and maintain compliance with enterprise security standards. It’s like preventing personal keys from being used in a secure workplace—keeping access controlled and professional.

Learn More

Description: Disables the lock screen camera toggle switch in PC Settings and prevents a camera from being invoked on the lock screen. By default, users can enable invocation of an available camera on the lock screen. If you enable this setting, users will no longer be able to enable or disable lock screen camera access in PC Settings, and the camera cannot be invoked on the lock screen.

Why It's Important: This policy is like covering a camera lens when the device is locked. By preventing camera access from the lock screen, SHIELD helps reduce the risk of unauthorized image capture or surveillance. It protects user privacy and ensures that camera functionality is only available after proper authentication, which is especially important in secure or shared environments.

Learn More

Description: Disables the lock screen slide show settings in PC Settings and prevents a slide show from playing on the lock screen. By default, users can enable a slide show that will run after they lock the machine. If you enable this setting, users will no longer be able to modify slide show settings in PC Settings, and no slide show will ever start.

Why It's Important: This policy is like preventing a public display of personal photos on a locked device. By disabling the lock screen slide show, SHIELD helps protect user privacy and reduces the risk of sensitive or inappropriate content being shown while the device is unattended. It ensures a clean, professional lock screen experience and aligns with organizational standards for secure and distraction-free environments.

Learn More

Description: This policy setting specifies whether to allow this client to download print driver packages over HTTP. To set up HTTP printing, non-inbox drivers need to be downloaded over HTTP. Note: This policy setting does not prevent the client from printing to printers on the Intranet or the Internet over HTTP. It only prohibits downloading drivers that are not already installed locally. If you enable this policy setting, print drivers cannot be downloaded over HTTP. If you disable or do not configure this policy setting, users can download print drivers over HTTP.

Why It's Important: This policy is like requiring all tools to be pre-approved before they’re used in the office. By blocking driver downloads over HTTP, SHIELD helps prevent the installation of potentially unsafe or unauthorized software from the internet. It reduces exposure to supply chain attacks, ensures tighter control over device configurations, and supports compliance with secure provisioning practices.

Learn More

Description: This policy setting specifies whether Windows should download a list of providers for the web publishing and online ordering wizards. These wizards allow users to select from a list of companies that provide services such as online storage and photographic printing. By default, Windows displays providers downloaded from a Windows website in addition to providers specified in the registry. If you enable this policy setting, Windows does not download providers, and only the service providers that are cached in the local registry are displayed. If you disable or do not configure this policy setting, a list of providers are downloaded when the user uses the web publishing or online ordering wizards. See the documentation for the web publishing and online ordering wizards for more information, including details on specifying service providers in the registry.

Why It's Important: This policy setting specifies whether Windows should download a list of providers for the web publishing and online ordering wizards. These wizards allow users to select from a list of companies that provide services such as online storage and photographic printing. By default, Windows displays providers downloaded from a Windows website in addition to providers specified in the registry. If you enable this policy setting, Windows does not download providers, and only the service providers that are cached in the local registry are displayed. If you disable or do not configure this policy setting, a list of providers are downloaded when the user uses the web publishing or online ordering wizards. See the documentation for the web publishing and online ordering wizards for more information, including details on specifying service providers in the registry.

Learn More

Description: This security feature provides a global setting to prevent programs from loading untrusted fonts. Untrusted fonts are any font installed outside of the %windir%\Fonts directory. This feature can be configured to be in 3 modes: On, Off, and Audit. By default, it is Off and no fonts are blocked. If you aren't quite ready to deploy this feature into your organization, you can run it in Audit mode to see if blocking untrusted fonts causes any usability or compatibility issues.

Why It's Important: This policy is like refusing to use unknown handwriting in official documents. By blocking untrusted fonts, SHIELD helps prevent attackers from exploiting vulnerabilities in font parsing to execute malicious code. It protects against both remote and local elevation-of-privilege attacks and provides visibility into font usage through event logging. Running in audit mode also allows organizations to test compatibility before full enforcement.

Learn More

Description: Enable svchost.exe mitigation options: Enabled.

Why It's Important: This policy is like putting extra locks and surveillance on the rooms that run your building’s core systems. By enforcing strict security on svchost.exe, SHIELD ensures that essential Windows services are protected from malicious code and unauthorized modifications. It reduces the risk of attacks that target system-level processes and helps maintain the integrity of the operating system. These mitigations are especially important in environments where reliability and security are critical.

Learn More

Description: This policy setting lets you control whether Microsoft accounts are optional for Windows Store apps that require an account to sign in. This policy only affects Windows Store apps that support it. If you enable this policy setting, Windows Store apps that typically require a Microsoft account to sign in will allow users to sign in with an enterprise account instead. If you disable or do not configure this policy setting, users will need to sign in with a Microsoft account.

Why It's Important: This policy is like giving users the option to use their work badge instead of a personal ID to access a secure area. By allowing enterprise accounts in place of Microsoft accounts, SHIELD ensures that users stay within the organization’s identity system, improving security and simplifying account management. It reduces reliance on personal credentials, supports enterprise identity governance, and helps maintain a consistent sign-in experience across managed devices.

Learn More

Description: This policy setting specifies the maximum size of the log file in kilobytes. If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments. If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte.

Why It's Important: Enabling and configuring this policy helps keep important application logs available for review. It supports troubleshooting, performance analysis, and proactive monitoring by ensuring logs aren’t lost too quickly. SHIELD enforces this policy to maintain consistent log settings across systems and prevent unauthorized changes. It’s like using a bigger notebook so you don’t run out of space before you’ve written down everything important.

Learn More

Description: This policy sets the maximum size of the Security event log to 196,608 KB (192 MB). Increasing the log size allows the system to retain more security-related event data before older entries are overwritten. This is especially important in environments with high log generation due to auditing, access control, and monitoring activities.

Why It's Important: Setting a larger maximum log size helps keep important security events available for review. It supports investigations, compliance, and threat detection by making sure logs aren’t lost too quickly. SHIELD enables this policy to preserve critical data and improve visibility into system activity. It’s like using a bigger notebook to make sure you don’t run out of space before you’ve written down everything important.

Learn More

Description: Disabling data execution prevention can allow certain legacy plug-in applications to function without terminating Explorer.

Why It's Important: Keeping DEP enabled for Explorer helps prevent buffer overflows and code injection attacks. It ensures that Explorer and its extensions use memory safely and securely. SHIELD enforces this policy to maintain system integrity and reduce the risk of malware exploiting memory vulnerabilities. It’s like keeping safety rails in place—some old tools might not work with them, but they help prevent serious accidents.

Learn More

Description: This policy setting turns off scripting for the location feature. If you enable this policy setting, scripts for the location feature will not run. If you disable or do not configure this policy setting, all location scripts will run.

Why It's Important: Disabling location scripting helps protect user privacy and prevent unauthorized access to location data. It reduces the risk of data leakage and limits how scripts can use or transmit location information. SHIELD enables this policy to support compliance with privacy regulations and to minimize attack surfaces. It’s like turning off GPS tracking for apps that don’t need it—more privacy, less risk, and better control.

Learn More

Description: Denies or allows access to the Store application. If you enable this setting, access to the Store application is denied. Access to the Store is required for installing app updates. If you disable or don't configure this setting, access to the Store application is allowed.

Why It's Important: [coming soon]

Learn More

Description: This policy setting turns off Windows Error Reporting, so that reports are not collected or sent to either Microsoft or internal servers within your organization when software unexpectedly stops working or fails. If you enable this policy setting, Windows Error Reporting does not send any problem information to Microsoft. Additionally, solution information is not available in Security and Maintenance in Control Panel. If you disable or do not configure this policy setting, the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings takes precedence. If Turn off Windows Error Reporting is also either disabled or not configured, user settings in Control Panel for Windows Error Reporting are applied.

Why It's Important: Disabling Windows Error Reporting is important in environments where data privacy and confidentiality are critical. It prevents sensitive system information from being sent outside the organization and supports compliance with strict data governance policies. SHIELD enforces this policy to keep diagnostics internal, reduce unnecessary network traffic, and maintain control over how system failures are handled. It’s like choosing to keep your troubleshooting in-house instead of broadcasting it—more secure, more private, and better aligned with enterprise standards.

Learn More

Description: Specifies whether connected users on AADJ devices receive a Passwordless experience on Windows.

Why It's Important: This policy is like replacing physical keys with secure, personalized access methods like fingerprint scanners or smart cards. By enabling the Passwordless experience, SHIELD helps reduce reliance on passwords, which are often weak, reused, or vulnerable to phishing. It improves user convenience, strengthens authentication security, and aligns with modern identity protection strategies across the tenant.

Learn More

Description: If set to 1 then any MDM policy that is set that has an equivalent GP policy will result in GP service blocking the setting of the policy by GP MMC. Setting the value to 0 (zero) or deleting the policy will remove the GP policy blocks restore the saved GP policies.

Why It's Important: In hybrid environments where both MDM and Group Policy might be used, conflicting settings can lead to unpredictable behavior or security gaps. This policy ensures that MDM—specifically Intune, where SHIELD operates—is the authoritative source for configuration. By enforcing this, SHIELD guarantees that secure baselines are consistently applied and not overridden by legacy or unmanaged Group Policies. It’s like giving one captain control of the ship to avoid conflicting orders—clear authority, consistent direction, and fewer chances for misconfiguration.

Learn More

Description: Specifies the method that Delivery Optimization can use to download content on behalf of various Microsoft products.

Why It's Important: Peer-to-peer content sharing can be efficient, but it also introduces risks—especially in enterprise environments where data integrity and control are critical. By enforcing HTTP-only downloads, SHIELD ensures that devices retrieve updates and content directly from trusted sources, not from other potentially compromised or misconfigured endpoints. It’s like choosing to get your software directly from the manufacturer instead of borrowing a copy from a neighbor—more secure, more predictable, and easier to audit. This policy helps maintain a clean, controlled update path and reduces the chance of unauthorized data movement across the network.

Learn More

Description: Specifies whether device lock is enabled.

Why It's Important: Enabling device lock is one of the most basic yet critical steps in securing endpoints. Without a password or PIN, anyone who gains physical access to a device can freely browse sensitive data, install malicious software, or tamper with system settings. SHIELD enforces this policy to ensure that every device has a barrier against unauthorized access—like requiring a key to enter a secure building. It’s simple, effective, and foundational to protecting enterprise assets from both casual snooping and serious threats.

Learn More

Description: Specifies whether to allow the runtime configuration agent to install provisioning packages.

Why It's Important: This policy blocks the installation of new provisioning packages on the device. Disabling the ability to add provisioning packages prevents untrusted or malicious configuration files from altering system settings, adding accounts, or introducing security vulnerabilities. It ensures that only administrator-approved and securely distributed configurations are applied.

Learn More

Description: Specifies whether to allow the runtime configuration agent to remove provisioning packages.

Why It's Important: This policy blocks the ability to remove provisioning packages from a device. Preventing removal ensures that all provisioning configurations including security policies, certificates, and enterprise settings — remain enforced. This protects against accidental or intentional tampering that could weaken compliance, remove management controls, or disconnect the device from organizational oversight.

Learn More

Description: Specifies whether provisioning packages must have a certificate signed by a device trusted authority.

Why It's Important: This policy enforces that all provisioning packages must be signed with a trusted certificate before installation. Requiring a verified signature ensures that only authentic, organization-approved packages are applied, protecting devices from malicious or altered configurations that could compromise security or system stability.

Learn More

Description: Allows the user to change Data Sense settings.

Why It's Important: This policy blocks users from changing Data Sense settings, preventing them from modifying how data usage is tracked or managed. Restricting access ensures network data policies remain consistent, helping administrators maintain control over bandwidth monitoring and usage limits while preventing users from bypassing enterprise data restrictions.

Learn More

Description: Enables or disables the retrieval of online tips and help for the Settings app. If disabled, Settings will not contact Microsoft content services to retrieve tips and help content.

Why It's Important: This policy disables online tips and help content retrieval in the Windows Settings app. Blocking this feature prevents communication with Microsoft content services, reducing unnecessary internet connections, minimizing data exposure, and eliminating access to consumer-focused content that may not apply to enterprise devices.

Learn More

Description: [coming soon]

Why It's Important: This policy hides specific non-business-related pages in the Windows Settings app, such as Game Bar, Game DVR, Game Mode, and Family Group settings. Hiding these pages prevents users from accessing or modifying gaming and personal configuration options that are unnecessary in enterprise environments. This helps maintain system performance, reduces distractions, and enforces a standardized configuration aligned with organizational use.

Learn More

Description: This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.

Why It's Important: This policy enables App Install Control, which helps block or warn users when they attempt to install unverified or potentially malicious applications downloaded from the internet. Enforcing this protection reduces the risk of malware infections, unauthorized software installation, and other threats introduced by unsafe executables.

Learn More

Description: Allows IT Admins to configure SmartScreen for Windows.

Why It's Important: This policy enables Microsoft Defender SmartScreen in the Windows Shell (File Explorer) to analyze and block untrusted or malicious files before they can be opened or executed. Enabling SmartScreen at the OS level provides an additional layer of protection against phishing, malware, and file-based attacks by verifying file reputation in real time.

Learn More

Description: Allows IT Admins to control whether users can ignore SmartScreen warnings and run malicious files.

Why It's Important: This policy prevents users from bypassing Microsoft Defender SmartScreen warnings when attempting to open potentially unsafe or malicious files in File Explorer (the Windows shell). Enforcing this protection helps ensure that end users cannot ignore or override SmartScreen alerts, significantly reducing the risk of executing malware or unverified executables on managed devices.

Learn More

Description: This policy controls the visibility of the HomeGroup shortcut on the Start menu. The possible values are:

Why It's Important: This policy hides the HomeGroup shortcut from the Start menu and prevents users from enabling it in the Settings app. HomeGroup was deprecated in Windows 10, and hiding it prevents confusion and removes obsolete features that no longer serve a security or networking function in modern environments. This helps maintain a cleaner, more secure user interface aligned with supported configurations.

Learn More

Description: Enabling this policy hides "Switch account" from appearing in the user tile in the start menu.

Why It's Important: This policy hides the "Switch account" option from the Start menu user tile. Enforcing this setting prevents users from switching between different accounts on the same device without signing out, helping to maintain session integrity, reduce unauthorized account access, and ensure that only approved, managed identities are used in enterprise environments.

Learn More

Description: AllowCommercialDataPipeline controls whether Microsoft is a processor or controller for Windows diagnostic data collected from this device. If you enable this policy Microsoft will be the processor of Windows diagnostic data collected from the Windows device and the customer will be the controller. The device must be registered in Azure AD for this policy to succeed. If you disable or don't configure this policy setting, Microsoft will be the controller of Windows diagnostic data collected from this device. This policy only controls if Microsoft is a processor for Windows diagnostic data from this device. Configuring this setting does not change whether diagnostic data is collected or the ability of the user to change the level. To configure collection level please use the "Allow Diagnostic Data" policy, and to restrict users on this device from changing the diagnostic data level please use the "Configure diagnostic data opt-in settings user interface" policy.

Why It's Important: This policy disables the Commercial Data Pipeline, keeping Microsoft as the controller of diagnostic data instead of the processor. Disabling this feature ensures that Windows diagnostic data is handled exclusively under Microsoft’s privacy and security controls rather than being shared or processed within a customer-managed pipeline. This helps prevent unintended exposure of telemetry data and maintains consistent privacy governance.

Learn More

Description: Specifies whether set general purpose device to be in embedded mode. Most restricted value is 0.

Why It's Important: This policy disables embedded mode, ensuring the device operates as a standard managed Windows endpoint rather than as a specialized embedded system. Disallowing embedded mode prevents reduced feature sets, unsupported configurations, or security limitations associated with embedded devices, maintaining full enterprise-grade security and manageability.

Learn More

Description: Note this policy is not supported in Windows 10, version 1607. This policy setting determines the level that Microsoft can experiment with the product to study user preferences or device behavior. Most restricted value is 0.

Why It's Important: This policy disables Microsoft’s ability to run experimentation and data-driven feature tests (known as A/B or flighting experiments) on managed devices. Disabling experimentation ensures that only approved, stable configurations are applied, preventing untested or variable settings from affecting system reliability, user experience, or compliance within enterprise environments.

Learn More

Description: Boolean policy setting that determines whether Windows is allowed to download fonts and font catalog data from an online font provider. If you enable this setting, Windows periodically queries an online font provider to determine whether a new font catalog is available. Windows may also download font data if needed to format or render text. If you disable this policy setting, Windows does not connect to an online font provider and only enumerates locally-installed fonts. This MDM setting corresponds to the EnableFontProviders Group Policy setting. If both the Group Policy and the MDM settings are configured, the group policy setting takes precedence. If neither is configured, the behavior depends on a DisableFontProviders registry value. In server editions, this registry value is set to 1 by default, so the default behavior is false (disabled). In all other editions, the registry value is not set by default, so the default behavior is true (enabled). This setting is used by lower-level components for text display and fond handling and has not direct effect on web browsers, which may download web fonts used in web content. NoteReboot is required after setting the policy; alternatively you can stop and restart the FontCache service.

Why It's Important: This policy prevents Windows from connecting to online font providers or downloading font data from external sources like fs.microsoft.com. Disabling online font retrieval reduces external network dependencies, eliminates unnecessary outbound traffic, and helps protect against potential supply-chain or content-based injection risks by allowing only locally installed fonts.

Learn More

Description: Specifies whether to allow app access to the Location service. Most restricted value is 0. While the policy is set to 0 (Force Location Off) or 2 (Force Location On), any Location service call from an app would trigger the value set by this policy. When switching the policy back from 0 (Force Location Off) or 2 (Force Location On) to 1 (User Control), the app reverts to its original Location service setting. For example, an app's original Location setting is Off. The administrator then sets the AllowLocation policy to 2 (Force Location On. ) The Location service starts working for that app, overriding the original setting. Later, if the administrator switches the AllowLocation policy back to 1 (User Control), the app will revert to using its original setting of Off.

Why It's Important: This policy forces the device’s Location service to remain enabled at all times, overriding user preferences. Enabling and locking the Location service ensures that enterprise-managed security, compliance, and asset-tracking applications can reliably access device location data when needed for operational monitoring, recovery, or compliance reporting.

Learn More

Description: Allows diagnostic data from this device to be processed by Microsoft Managed Desktop. The following list shows the supported values: 0 (default)– Diagnostic data is not processed by Microsoft Managed Desktop. 32 – Diagnostic data is processed by Microsoft Managed Desktop. If this policy is disabled or not configured, diagnostic data from this device will not be processed by Microsoft Managed Desktop.

Why It's Important: This policy disables the processing of diagnostic data by Microsoft Managed Desktop (MMD). Disabling this ensures that device diagnostic information remains within the organization’s management boundaries, protecting privacy and maintaining full control over how operational data is analyzed and stored.

Learn More

Description: Specifies whether to allow the user to factory reset the device by using control panel and hardware key combination. Most restricted value is 0. Tip, This policy is also applicable to Windows 10 and not exclusive to phone.

Why It's Important: This policy blocks users from performing a factory reset through the Control Panel or hardware button combinations. Disabling manual resets helps prevent users from wiping device configurations, security controls, or enterprise management profiles, maintaining compliance and ensuring devices remain under organizational control.

Learn More

Description: [coming soon]

Why It's Important: This policy allows device deletion or unenrollment actions when performed through authorized management tools. Leaving this policy disabled ensures administrators can securely decommission or reassign devices when necessary, maintaining flexibility for legitimate lifecycle management while still controlling who can perform such actions.

Learn More

Description: This policy setting controls whether Windows attempts to connect with the OneSettings service. If you enable this policy, Windows will not attempt to connect with the OneSettings Service. If you disable or don't configure this policy setting, Windows will periodically attempt to connect with the OneSettings service to download configuration settings.

Why It's Important: This policy allows Windows to connect to Microsoft’s OneSettings service to periodically download configuration and diagnostic parameters. Keeping OneSettings downloads enabled ensures that Windows receives up-to-date service configurations, security improvements, and compatibility data essential for maintaining system reliability and stability in managed environments.

Learn More

Description: This policy setting allows you to turn off File History. If you enable this policy setting, File History cannot be activated to create regular, automatic backups. If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups.

Why It's Important: This policy disables the File History feature, preventing users from creating automatic local or network backups. Disabling File History helps ensure data remains stored only in approved enterprise-managed locations, reducing risks of unauthorized backups, data spillage, or recovery of sensitive information from uncontrolled sources.

Learn More

Description: Allow or disallow the device to automatically connect to Wi-Fi hotspots. Most restricted value is 0.

Why It's Important: [coming soon]

Learn More

Description: Allow or disallow internet sharing. Most restricted value is 0.

Why It's Important: This policy disables Internet Connection Sharing (ICS), preventing users from turning their device into a network access point. Blocking internet sharing helps maintain network security by ensuring users cannot bridge corporate and personal networks, which could expose internal resources or allow data to bypass enterprise firewalls and monitoring.

Learn More

Description: Allow WiFi Direct connection.

Why It's Important: This policy disables Wi-Fi Direct connections, preventing peer-to-peer wireless communication between unmanaged devices. Blocking Wi-Fi Direct reduces the risk of unauthorized data transfers, malware propagation, and device-to-device exploitation outside of monitored network controls.

Learn More

Description: Show recommended app suggestions in the ink workspace.

Why It's Important: This policy blocks the display of suggested or recommended apps within the Windows Ink Workspace. Blocking app suggestions prevents unapproved or non-business applications from being promoted to users, maintaining a clean and controlled user environment while supporting compliance with enterprise software restrictions.

Learn More

Description: Specifies whether to allow the user to access the ink workspace.

Why It's Important: This policy disables access to the Windows Ink Workspace to prevent users from creating or sharing handwritten notes, drawings, or sticky notes. Disabling Ink Workspace helps minimize data leakage, ensures compliance with device use policies, and reduces the attack surface by turning off a nonessential feature in managed environments.

Learn More

Description: Specifies the scan frequency from every 1 - 22 hours. Default is 22 hours.

Why It's Important: This policy configures Windows Update to check for new updates every hour instead of the 22-hour default. Increasing the detection frequency ensures faster identification of new security or quality updates, minimizing the time devices remain exposed to known vulnerabilities.

Learn More

Description: Ensure that defender is operating when the computer is running in OOBE mode.

Why It's Important: This policy ensures that Microsoft Defender remains active during the Windows Out-of-Box Experience (OOBE), providing protection before the device is fully configured or joined to management. Enforcing Defender during OOBE helps prevent early-stage malware infections and maintains continuous security coverage from the moment the device powers on.

Learn More

Description: Configure Intel Threat Detection Integration with Defender to be used at all times.

Why It's Important: This policy enables Intel Threat Detection Technology (TDT) integration with Microsoft Defender, ensuring that Defender continuously leverages hardware-based threat detection. Intel TDT offloads certain memory and CPU threat analysis tasks to the processor, improving detection of advanced threats such as ransomware and cryptojacking while minimizing performance impact.

Learn More

Description: Treat warnings as full threats and block them.

Why It's Important: [coming soon]

Learn More

Description: Prevent users from making changes to the exploit protection settings area in the Windows Defender Security Center. If you disable or do not configure this setting, local users can make changes in the exploit protection settings area. Value type is integer. Supported operations are Add, Get, Replace and Delete.

Why It's Important: This policy prevents local users from overriding exploit protection settings, ensuring consistent enforcement of security controls and reducing the risk of weakened protections.

Learn More

Description: Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see Enable Exploit Protection on Devices and Import, export, and deploy Exploit Protection configurations. The system settings require a reboot; the application settings do not require a reboot.

Why It's Important: This policy enforces system and application exploit protection settings through a centralized XML configuration, ensuring consistent mitigations against common attack techniques across all managed devices.

Learn More

Description: This policy setting determines whether to require domain users to elevate when setting a network's location. If you enable this policy setting, domain users must elevate when setting a network's location. If you disable or do not configure this policy setting, domain users can set a network's location without elevating.

Why It's Important: This policy requires administrative elevation when a user changes a network’s location type (e.g., Public, Private, or Domain). It prevents standard users from altering network trust levels, which could lower security configurations such as firewall rules or network discovery settings.

Learn More

Description: Specifies whether device lock is enabled.

Why It's Important: Enabling device lock is one of the most basic yet critical steps in securing endpoints. Without a password or PIN, anyone who gains physical access to a device can freely browse sensitive data, install malicious software, or tamper with system settings. SHIELD enforces this policy to ensure that every device has a barrier against unauthorized access—like requiring a key to enter a secure building. It’s simple, effective, and foundational to protecting enterprise assets from both casual snooping and serious threats.

Learn More

Description: [coming soon]

Why It's Important: This policy defines that LAPS-managed local administrator passwords expire and are automatically rotated every 30 days. Regular password rotation minimizes the window of opportunity for credential compromise and aligns with enterprise security best practices.

Learn More

Description: List of known bad drivers that can bypass WDAC.

Why It's Important: This policy deploys Microsoft’s official Kernel-Mode Blocklist (via WDAC) to prevent known vulnerable or malicious drivers from loading. These drivers could bypass or disable Windows Defender Application Control (WDAC), compromise kernel integrity, or escalate privileges. Enforcing this list ensures that only trusted, signed kernel drivers can execute, strengthening system-level protection.

Learn More

Description: List of known bad apps that can bypass WDAC.

./Vendor/MSFT/ApplicationControl/Policies/CCD59E19-1DDA-4C74-B357-323E82063AF9/Policy

Why It's Important: This policy applies Microsoft’s User-Mode Blocklist for WDAC, which prevents execution of known malicious or vulnerable applications capable of bypassing or weakening security controls. It helps protect against user-level threats that exploit known binaries to gain elevated privileges or disable protections, maintaining application trust across managed endpoints.

Learn More

Description: Locks down application execution to only an explicitly allowed set of apps and drivers.

Why It's Important: [coming soon]

Learn More