[
  {
    "Id": "diagnostics",
    "Title": "Minimum supported Windows diagnostic data",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection",
    "Name": "AllowTelemetry",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": 0,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#allowtelemetry",
    "Impact": "Pro retains required diagnostics. Enterprise/Education use 0. Required service data is separate; this does not silence Microsoft connections.",
    "Exceptions": []
  },
  {
    "Id": "advertising-id",
    "Title": "Disable Windows advertising ID",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo",
    "Name": "DisabledByGroupPolicy",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#disableadvertisingid",
    "Impact": "Affects the Windows advertising ID only, not GDID, browser fingerprints or account identifiers.",
    "Exceptions": []
  },
  {
    "Id": "location",
    "Title": "Turn off Windows location feature",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\LocationAndSensors",
    "Name": "DisableLocation",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-sensors#disablelocation_2",
    "Impact": "Location-dependent features stop working. IP-based and other independent location inference remain possible.",
    "Exceptions": []
  },
  {
    "Id": "camera",
    "Title": "Disallow camera devices by policy",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Camera",
    "Name": "AllowCamera",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-camera#allowcamera",
    "Impact": "Can break camera-dependent workflows. Not a physical disconnection; test Windows Hello and desktop applications after reboot.",
    "Exceptions": []
  },
  {
    "Id": "microphone-apps",
    "Title": "Deny Windows app microphone access by default",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessMicrophone",
    "Standard": 2,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmicrophone",
    "Impact": "Does not guarantee blocking all desktop applications. Existing per-app exceptions cause a conflict; use the device-wide Settings toggle or hardware disconnect for stronger restriction.",
    "Exceptions": [
      "LetAppsAccessMicrophone_ForceAllowTheseApps",
      "LetAppsAccessMicrophone_UserInControlOfTheseApps"
    ]
  },
  {
    "Id": "cloud-speech",
    "Title": "Disallow online speech recognition",
    "Path": "SOFTWARE\\Policies\\Microsoft\\InputPersonalization",
    "Name": "AllowInputPersonalization",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#allowinputpersonalization",
    "Impact": "Cloud speech functionality is unavailable. Does not govern every application's speech service.",
    "Exceptions": []
  },
  {
    "Id": "clipboard-sync",
    "Title": "Disallow cross-device clipboard synchronization",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
    "Name": "AllowCrossDeviceClipboard",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#allowcrossdeviceclipboard",
    "Impact": "Stops Windows clipboard synchronization. Does not delete clipboard contents or copies already sent elsewhere.",
    "Exceptions": []
  },
  {
    "Id": "clipboard-history",
    "Title": "Disallow Windows clipboard history",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
    "Name": "AllowClipboardHistory",
    "Standard": 1,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowclipboardhistory",
    "Impact": "Standard permits clipboard history; Strict disables it. Switching profiles does not recover previously cleared contents.",
    "Exceptions": []
  },
  {
    "Id": "find-my-device",
    "Title": "Disable Find My Device",
    "Path": "SOFTWARE\\Policies\\Microsoft\\FindMyDevice",
    "Name": "AllowFindMyDevice",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowfindmydevice",
    "Impact": "Loses Microsoft's device-location recovery feature. Does not erase cloud records already collected.",
    "Exceptions": []
  },
  {
    "Id": "cloud-search",
    "Title": "Disable cloud sources in Windows Search",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search",
    "Name": "AllowCloudSearch",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#allowcloudsearch",
    "Impact": "Stops searching cloud sources such as OneDrive and SharePoint. Does not establish that all Start web queries are disabled.",
    "Exceptions": []
  },
  {
    "Id": "delivery-optimization",
    "Title": "Restrict Delivery Optimization",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization",
    "Name": "DODownloadMode",
    "Standard": 0,
    "Strict": 99,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deliveryoptimization#dodownloadmode",
    "Impact": "Standard: HTTP without peering. Strict: HTTP without peering or DO cloud service. Neither blocks all update traffic or guarantees suppression of GDID reporting.",
    "Exceptions": []
  },
  {
    "Id": "updates-auto",
    "Title": "Automatic Windows Update choice",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU",
    "Name": "NoAutoUpdate",
    "Standard": null,
    "Strict": null,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings",
    "Impact": "Manual requires the user to install security updates. Preserves update components; other update policies and products remain separate.",
    "Exceptions": []
  },
  {
    "Id": "updates-options",
    "Title": "Windows Update download/install behavior",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU",
    "Name": "AUOptions",
    "Standard": null,
    "Strict": null,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings",
    "Impact": "Notify requests download/install notification; Automatic requests scheduled automatic installation. Effective behavior needs Windows validation.",
    "Exceptions": []
  }
]