Windows 11: 22H2 · 3.0 to 24H2 · 1.0

[added: ]This setting enables and configures the device-based tenant restrictions feature for Azure Active Directory.[removed: ][added: ]When you enable this setting, compliant applications will be prevented from accessing disallowed tenants, according to a policy set in your Azure AD tenant.[removed: ][added: ]Note: Creation of a policy in your home tenant is required, and additional security measures for managed devices are recommended for best protection. Refer to Azure AD Tenant Restrictions for more details.[removed: ][added: ]https://go.microsoft.com/fwlink/?linkid=2148762[removed: ][added: ]Before enabling firewall protection, ensure that [removed: a Windows Defender Application Control (WDAC) ][added: an App Control for Business ]policy that correctly tags applications has been applied to the target devices. Enabling firewall protection without a corresponding [removed: WDAC][added: App Control for Business] policy will prevent all applications from reaching Microsoft endpoints. This firewall setting is not supported on all versions of Windows - see the following link for more information.[removed: ][added: ]For details about setting up WDAC with tenant restrictions, see https://go.microsoft.com/fwlink/?linkid=2155230

This policy setting allows you to configure how File Explorer displays thumbnail images or icons on network folders. File Explorer displays [added: only icons and never displays ]thumbnail images on network folders by default. If you [removed: en][added: dis]able this policy setting, File Explorer displays [removed: only icons and never displays ]thumbnail images on network folders. If you [removed: dis][added: en]able or do not configure this policy setting, File Explorer displays only [added: icons and never displays ]thumbnail images on network folders.[added: Note: Allowing the use of thumbnail images from network folders can expose the users' computers to security risks.]

Define evidence file remote location, where Device Control service will move evidence data captured.[added: When configuring this setting, ensure that Device Control is Enabled and that the provided path is a remote path the user can access.]

This policy setting allows you to configure the [added: randomization of the ]scheduled [removed: scan,][added: scan start time] and the scheduled [removed: security intelligence update, ][added: definition update ]start [removed: time window in hours. ][added: time. ]If you [removed: dis][added: en]able or do not configure this [added: policy ]setting, [removed: scheduled tasks will begin at a random][added: and did not set a randomization window in the Configure scheduled task] time [removed: within 4 hours after the time specified in Task Scheduler. ][added: randomization window setting , then randomization will be added between 0-4 hours. ]If you enable [added: or do not configure ]this [added: policy ]setting, [removed: you can widen, or narrow, this][added: and set a randomization window in the Configure scheduled task time] randomization [removed: period. Specify a][added: window setting, the configured] randomization window [removed: of between 1 and 23 hours.][added: will be used. If you disable this policy setting, but configured the scheduled task time randomization window, randomization will not be done. ]

This policy setting allows you to configure scheduled [added: task ]scan start time and the scheduled security intelligence update start time window in hours.[removed: ][added: This setting affects the Randomize scheduled task times configuration. ]If you [removed: disable or do not configure this setting, scheduled tasks will begin at a random time within an][added: enable this setting, you must pick a randomization window in hours. The possible randomization window interval is between 1 and 23 hours. The randomization] interval [removed: of 4 hours after][added: implemented is between 0 and] the [removed: specified start time. If ][added: configured value. When ]you enable this setting, [removed: you must pick a][added: Randomize scheduled task times settings uses the] randomization window [added: specified ]in [removed: hours. The possible randomization window interval is between 1 and 23][added: this configuration setting. If you disable or do not configure this policy setting, Randomize scheduled task times settings will randomize scheduled task times between 0-4] hours.

This policy specifies the path to a file [removed: (e.g. either stored ][added: (stored ]locally or on a network location) that contains file type and protocol default application associations. This file can be created using the DISM tool.[removed: ][added: ]For example: Dism.exe /Online /Export-DefaultAppAssociations:C:\AppAssoc.txt For more information, refer to the DISM [removed: documentation on TechNet. If this group policy][added: documentation. The file can be further edited after it] is [removed: enabled and][added: created to change how often] the [removed: client machine is domain-joined,][added: policy associations are applied. A "Version" attribute can be added to] the [removed: file will][added: "DefaultAssociations" element. The value should be an integer. A "Suggested" attribute can be added to any "Association" element. The value should] be [removed: processed][added: a bool] and [added: the ]default [removed: associations][added: value is "false". When the policy is applied to a user, any Association that has Suggested="true"] will [removed: be][added: only get] applied [removed: at logon time.][added: once. If the Version value is ever incremented, Associations with Suggested="true" will get reapplied.] If [removed: the][added: this] group policy is [removed: not configured, disabled, or ][added: enabled and ]the client machine is [removed: not domain-joined, no][added: domain-joined, the file will be processed and] default associations will be applied at logon time. If the policy is enabled, [removed: disabled, or not configured, ]users will still be able to override default file type and protocol [removed: associations.][added: associations, but on next logon the file will be reapplied.]