[
  {
    "Id": "diagnostics",
    "Title": "Minimum supported Windows diagnostic data",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection",
    "Name": "AllowTelemetry",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": 0,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#allowtelemetry",
    "Impact": "Pro retains required diagnostics. Enterprise/Education use 0. Required service data is separate; this does not silence Microsoft connections.",
    "Exceptions": []
  },
  {
    "Id": "advertising-id",
    "Title": "Disable Windows advertising ID",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AdvertisingInfo",
    "Name": "DisabledByGroupPolicy",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#disableadvertisingid",
    "Impact": "Affects the Windows advertising ID only, not GDID, browser fingerprints or account identifiers.",
    "Exceptions": []
  },
  {
    "Id": "location",
    "Title": "Turn off Windows location feature",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\LocationAndSensors",
    "Name": "DisableLocation",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-sensors#disablelocation_2",
    "Impact": "Location-dependent features stop working. IP-based and other independent location inference remain possible.",
    "Exceptions": []
  },
  {
    "Id": "camera",
    "Title": "Disallow camera devices by policy",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Camera",
    "Name": "AllowCamera",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-camera#allowcamera",
    "Impact": "Can break camera-dependent workflows. Not a physical disconnection; test Windows Hello and desktop applications after reboot.",
    "Exceptions": []
  },
  {
    "Id": "microphone-apps",
    "Title": "Deny Windows app microphone access by default",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessMicrophone",
    "Standard": 2,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmicrophone",
    "Impact": "Does not guarantee blocking all desktop applications. Existing per-app exceptions cause a conflict; use the device-wide Settings toggle or hardware disconnect for stronger restriction.",
    "Exceptions": [
      "LetAppsAccessMicrophone_ForceAllowTheseApps",
      "LetAppsAccessMicrophone_UserInControlOfTheseApps"
    ]
  },
  {
    "Id": "cloud-speech",
    "Title": "Disallow online speech recognition",
    "Path": "SOFTWARE\\Policies\\Microsoft\\InputPersonalization",
    "Name": "AllowInputPersonalization",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#allowinputpersonalization",
    "Impact": "Cloud speech functionality is unavailable. Does not govern every application's speech service.",
    "Exceptions": []
  },
  {
    "Id": "activity-feed",
    "Title": "Disable Windows Activity Feed and cloud roaming",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
    "Name": "EnableActivityFeed",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#enableactivityfeed",
    "Impact": "Prevents Windows activities from being published and disables Activity Feed cloud sync.",
    "Exceptions": []
  },
  {
    "Id": "publish-user-activities",
    "Title": "Disallow publishing user activities",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
    "Name": "PublishUserActivities",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#publishuseractivities",
    "Impact": "Stops applications and Windows from publishing supported User Activity records.",
    "Exceptions": []
  },
  {
    "Id": "upload-user-activities",
    "Title": "Disallow uploading user activities",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
    "Name": "UploadUserActivities",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#uploaduseractivities",
    "Impact": "Prevents supported published User Activity records from being uploaded.",
    "Exceptions": []
  },
  {
    "Id": "app-account-info",
    "Title": "Deny Windows apps account-information access",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessAccountInfo",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessaccountinfo",
    "Impact": "Strict denies Windows apps access to account name, picture and related account information. Desktop applications are separate.",
    "Exceptions": ["LetAppsAccessAccountInfo_ForceAllowTheseApps", "LetAppsAccessAccountInfo_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-calendar",
    "Title": "Deny Windows apps calendar access",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessCalendar",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesscalendar",
    "Impact": "Strict blocks Windows apps from reading calendars; calendar-dependent apps can fail.",
    "Exceptions": ["LetAppsAccessCalendar_ForceAllowTheseApps", "LetAppsAccessCalendar_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-contacts",
    "Title": "Deny Windows apps contacts access",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessContacts",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesscontacts",
    "Impact": "Strict blocks Windows apps from reading contacts; contacts-dependent apps can fail.",
    "Exceptions": ["LetAppsAccessContacts_ForceAllowTheseApps", "LetAppsAccessContacts_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-call-history",
    "Title": "Deny Windows apps call-history access",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessCallHistory",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesscallhistory",
    "Impact": "Strict blocks Windows apps from reading call history.",
    "Exceptions": ["LetAppsAccessCallHistory_ForceAllowTheseApps", "LetAppsAccessCallHistory_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-email",
    "Title": "Deny Windows apps email access",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessEmail",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessemail",
    "Impact": "Strict blocks Windows apps from reading or sending email through the Windows capability.",
    "Exceptions": ["LetAppsAccessEmail_ForceAllowTheseApps", "LetAppsAccessEmail_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-messaging",
    "Title": "Deny Windows apps messaging access",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessMessaging",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmessaging",
    "Impact": "Strict blocks Windows apps from reading or sending messages through the Windows capability.",
    "Exceptions": ["LetAppsAccessMessaging_ForceAllowTheseApps", "LetAppsAccessMessaging_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-diagnostics",
    "Title": "Deny Windows apps diagnostic information",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsGetDiagnosticInfo",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsgetdiagnosticinfo",
    "Impact": "Strict blocks Windows apps from getting diagnostic information about other apps, including user name.",
    "Exceptions": ["LetAppsGetDiagnosticInfo_ForceAllowTheseApps", "LetAppsGetDiagnosticInfo_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-trusted-devices",
    "Title": "Deny Windows apps trusted-device access",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessTrustedDevices",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesstrusteddevices",
    "Impact": "Strict blocks Windows apps from accessing trusted devices; device companion features can fail.",
    "Exceptions": ["LetAppsAccessTrustedDevices_ForceAllowTheseApps", "LetAppsAccessTrustedDevices_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-unpaired-devices",
    "Title": "Deny Windows apps communication with unpaired devices",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsSyncWithDevices",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappssyncwithdevices",
    "Impact": "Strict blocks Windows apps from communicating with unpaired wireless devices.",
    "Exceptions": ["LetAppsSyncWithDevices_ForceAllowTheseApps", "LetAppsSyncWithDevices_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-voice-activation",
    "Title": "Deny Windows app voice activation",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsActivateWithVoice",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsactivatewithvoice",
    "Impact": "Strict blocks Windows apps from activation by voice.",
    "Exceptions": ["LetAppsActivateWithVoice_ForceAllowTheseApps", "LetAppsActivateWithVoice_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-voice-above-lock",
    "Title": "Deny Windows app voice activation while locked",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsActivateWithVoiceAboveLock",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsactivatewithvoiceabovelock",
    "Impact": "Strict blocks Windows apps from voice activation while the session is locked.",
    "Exceptions": ["LetAppsActivateWithVoiceAboveLock_ForceAllowTheseApps", "LetAppsActivateWithVoiceAboveLock_UserInControlOfTheseApps"]
  },
  {
    "Id": "feedback-prompts",
    "Title": "Disable Microsoft feedback prompts",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\DataCollection",
    "Name": "DoNotShowFeedbackNotifications",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#donotshowfeedbacknotifications",
    "Impact": "Stops Windows Feedback prompts. This setting does not by itself change diagnostic-data transmission.",
    "Exceptions": []
  },
  {
    "Id": "windows-error-reporting",
    "Title": "Disable Windows Error Reporting transmission",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting",
    "Name": "Disabled",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": null,
    "HomeSupported": true,
    "Source": "https://learn.microsoft.com/en-us/windows/win32/wer/wer-settings",
    "Impact": "Stops Windows Error Reporting. Automatic crash analysis and solution lookup are unavailable; local security event channels are unaffected.",
    "Exceptions": []
  },
  {
    "Id": "wer-additional-data",
    "Title": "Prevent Windows Error Reporting second-level data",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Error Reporting",
    "Name": "DontSendAdditionalData",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": null,
    "HomeSupported": true,
    "Source": "https://learn.microsoft.com/en-us/windows/win32/wer/wer-settings",
    "Impact": "Adds a defense-in-depth restriction on second-level WER data if another component re-enables reporting.",
    "Exceptions": []
  },
  {
    "Id": "clipboard-sync",
    "Title": "Disallow cross-device clipboard synchronization",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
    "Name": "AllowCrossDeviceClipboard",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#allowcrossdeviceclipboard",
    "Impact": "Stops Windows clipboard synchronization. Does not delete clipboard contents or copies already sent elsewhere.",
    "Exceptions": []
  },
  {
    "Id": "clipboard-history",
    "Title": "Disallow Windows clipboard history",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
    "Name": "AllowClipboardHistory",
    "Standard": 1,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowclipboardhistory",
    "Impact": "Standard permits clipboard history; Strict disables it. Switching profiles does not recover previously cleared contents.",
    "Exceptions": []
  },
  {
    "Id": "find-my-device",
    "Title": "Disable Find My Device",
    "Path": "SOFTWARE\\Policies\\Microsoft\\FindMyDevice",
    "Name": "AllowFindMyDevice",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowfindmydevice",
    "Impact": "Loses Microsoft's device-location recovery feature. Does not erase cloud records already collected.",
    "Exceptions": []
  },
  {
    "Id": "cloud-search",
    "Title": "Disable cloud sources in Windows Search",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search",
    "Name": "AllowCloudSearch",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#allowcloudsearch",
    "Impact": "Stops searching cloud sources such as OneDrive and SharePoint. Does not establish that all Start web queries are disabled.",
    "Exceptions": []
  },
  {
    "Id": "tailored-experiences",
    "Title": "Disable tailored experiences from diagnostic data",
    "Hive": "CurrentUser",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent",
    "Name": "DisableTailoredExperiencesWithDiagnosticData",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowtailoredexperienceswithdiagnosticdata",
    "Impact": "Stops Windows from using diagnostic data to personalize tips, advertisements and recommendations for the current user.",
    "Exceptions": []
  },
  {
    "Id": "implicit-text-collection",
    "Title": "Restrict implicit typing collection",
    "Hive": "CurrentUser",
    "Path": "SOFTWARE\\Microsoft\\InputPersonalization",
    "Name": "RestrictImplicitTextCollection",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": null,
    "HomeSupported": true,
    "Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
    "Impact": "Restricts typing personalization collection for the current user. It does not block input observed by applications receiving keystrokes.",
    "Exceptions": []
  },
  {
    "Id": "implicit-ink-collection",
    "Title": "Restrict implicit inking collection",
    "Hive": "CurrentUser",
    "Path": "SOFTWARE\\Microsoft\\InputPersonalization",
    "Name": "RestrictImplicitInkCollection",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": null,
    "HomeSupported": true,
    "Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
    "Impact": "Restricts handwriting personalization collection for the current user; recognition and personalization quality can be reduced.",
    "Exceptions": []
  },
  {
    "Id": "search-location",
    "Title": "Prevent Windows Search from using location",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search",
    "Name": "AllowSearchToUseLocation",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#allowsearchtouselocation",
    "Impact": "Search results will not use device location for local relevance.",
    "Exceptions": []
  },
  {
    "Id": "search-highlights",
    "Title": "Disable dynamic search highlights",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search",
    "Name": "EnableDynamicContentInWSB",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-search#enabledynamiccontentinwsb",
    "Impact": "Removes rotating web content and highlights from the Windows search box.",
    "Exceptions": []
  },
  {
    "Id": "widgets",
    "Title": "Disable Windows Widgets",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Dsh",
    "Name": "AllowNewsAndInterests",
    "Standard": 0,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-newsandinterests#allownewsandinterests",
    "Impact": "Disables the Widgets experience and its news, weather and personalized-content requests.",
    "Exceptions": []
  },
  {
    "Id": "device-metadata",
    "Title": "Disable device metadata downloads",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata",
    "Name": "PreventDeviceMetadataFromNetwork",
    "Standard": 0,
    "Strict": 1,
    "EnterpriseValue": null,
    "HomeSupported": true,
    "Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
    "Impact": "Strict stops device metadata downloads; device icons, names or companion information can be less complete.",
    "Exceptions": []
  },
  {
    "Id": "font-streaming",
    "Title": "Disable downloadable fonts",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\System",
    "Name": "EnableFontProviders",
    "Standard": 1,
    "Strict": 0,
    "EnterpriseValue": null,
    "HomeSupported": true,
    "Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
    "Impact": "Strict prevents Windows from downloading missing fonts; documents or sites can render with fallback fonts.",
    "Exceptions": []
  },
  {
    "Id": "msrt-reporting",
    "Title": "Disable Malicious Software Removal Tool infection reports",
    "Path": "SOFTWARE\\Policies\\Microsoft\\MRT",
    "Name": "DontReportInfectionInformation",
    "Standard": 1,
    "Strict": 1,
    "EnterpriseValue": null,
    "HomeSupported": true,
    "Source": "https://learn.microsoft.com/en-gb/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services",
    "Impact": "Stops MSRT infection reports while preserving the tool and its delivery through Windows Update.",
    "Exceptions": []
  },
  {
    "Id": "llmnr",
    "Title": "Disable multicast name resolution",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient",
    "Name": "EnableMulticast",
    "Standard": 1,
    "Strict": 0,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-dnsclient#pol-llmnr",
    "Impact": "Strict disables LLMNR and reduces local-network name-resolution spoofing exposure. Legacy printers or peer discovery that depend on LLMNR can stop resolving by name.",
    "Exceptions": []
  },
  {
    "Id": "app-location",
    "Title": "Deny Windows apps location access",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessLocation",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesslocation",
    "Impact": "Strict denies covered Windows apps access to Windows location; IP and network-based inference remain possible.",
    "Exceptions": ["LetAppsAccessLocation_ForceAllowTheseApps", "LetAppsAccessLocation_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-foreground-text",
    "Title": "Deny Windows apps foreground-window text access",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessForegroundText",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessforegroundtext",
    "Impact": "Strict denies covered apps access to text in the active window; accessibility and assistive workflows can be affected.",
    "Exceptions": ["LetAppsAccessForegroundText_ForceAllowTheseApps", "LetAppsAccessForegroundText_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-gaze-input",
    "Title": "Deny Windows apps gaze input",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessGazeInput",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessgazeinput",
    "Impact": "Strict denies covered apps access to eye-tracking input; gaze-based accessibility can stop working.",
    "Exceptions": ["LetAppsAccessGazeInput_ForceAllowTheseApps", "LetAppsAccessGazeInput_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-screen-capture",
    "Title": "Deny programmatic screen capture by Windows apps",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessGraphicsCaptureProgrammatic",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessgraphicscaptureprogrammatic",
    "Impact": "Strict denies covered apps programmatic screen capture; conferencing, recording and support tools can fail.",
    "Exceptions": ["LetAppsAccessGraphicsCaptureProgrammatic_ForceAllowTheseApps", "LetAppsAccessGraphicsCaptureProgrammatic_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-borderless-capture",
    "Title": "Deny borderless screen capture by Windows apps",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessGraphicsCaptureWithoutBorder",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessgraphicscapturewithoutborder",
    "Impact": "Strict denies covered apps capture without the Windows capture border; recording workflows can change.",
    "Exceptions": ["LetAppsAccessGraphicsCaptureWithoutBorder_ForceAllowTheseApps", "LetAppsAccessGraphicsCaptureWithoutBorder_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-human-presence",
    "Title": "Deny Windows apps human-presence sensing",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessHumanPresence",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccesshumanpresence",
    "Impact": "Strict denies covered apps presence-sensor access; presence-aware lock, wake and attention features can be affected.",
    "Exceptions": ["LetAppsAccessHumanPresence_ForceAllowTheseApps", "LetAppsAccessHumanPresence_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-motion",
    "Title": "Deny Windows apps motion data",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessMotion",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessmotion",
    "Impact": "Strict denies covered apps accelerometer and motion data.",
    "Exceptions": ["LetAppsAccessMotion_ForceAllowTheseApps", "LetAppsAccessMotion_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-notifications",
    "Title": "Deny Windows apps notification access",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessNotifications",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessnotifications",
    "Impact": "Strict denies covered apps access to other apps' notifications; automation and notification aggregation can fail.",
    "Exceptions": ["LetAppsAccessNotifications_ForceAllowTheseApps", "LetAppsAccessNotifications_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-phone",
    "Title": "Deny Windows apps phone access",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessPhone",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessphone",
    "Impact": "Strict denies covered apps access to telephony state and functions.",
    "Exceptions": ["LetAppsAccessPhone_ForceAllowTheseApps", "LetAppsAccessPhone_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-radios",
    "Title": "Deny Windows apps radio control",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsAccessRadios",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsaccessradios",
    "Impact": "Strict denies covered apps control of radios such as Bluetooth; it does not power off radio hardware.",
    "Exceptions": ["LetAppsAccessRadios_ForceAllowTheseApps", "LetAppsAccessRadios_UserInControlOfTheseApps"]
  },
  {
    "Id": "app-background",
    "Title": "Deny Windows apps background execution",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy",
    "Name": "LetAppsRunInBackground",
    "Standard": 0,
    "Strict": 2,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy#letappsruninbackground",
    "Impact": "Strict prevents covered Windows apps from running in the background; notifications and synchronization can be delayed or stop.",
    "Exceptions": ["LetAppsRunInBackground_ForceAllowTheseApps", "LetAppsRunInBackground_UserInControlOfTheseApps"]
  },
  {
    "Id": "consumer-experiences",
    "Title": "Disable Microsoft consumer experiences where supported",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent",
    "Name": "DisableWindowsConsumerFeatures",
    "Standard": null,
    "Strict": null,
    "EnterpriseValue": 1,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowwindowsconsumerfeatures",
    "Impact": "Enterprise and Education only: prevents Microsoft consumer experiences and suggested app promotion. Pro and Home are not claimed as supported.",
    "Exceptions": []
  },
  {
    "Id": "windows-spotlight",
    "Title": "Disable Windows Spotlight where supported",
    "Hive": "CurrentUser",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent",
    "Name": "DisableWindowsSpotlightFeatures",
    "Standard": null,
    "Strict": null,
    "EnterpriseValue": 1,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#allowwindowsspotlight",
    "Impact": "Enterprise and Education only: disables Windows Spotlight for the current user, including rotating cloud content and suggestions.",
    "Exceptions": []
  },
  {
    "Id": "delivery-optimization",
    "Title": "Restrict Delivery Optimization",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization",
    "Name": "DODownloadMode",
    "Standard": 0,
    "Strict": 99,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deliveryoptimization#dodownloadmode",
    "Impact": "Standard: HTTP without peering. Strict: HTTP without peering or DO cloud service. Neither blocks all update traffic or guarantees suppression of GDID reporting.",
    "Exceptions": []
  },
  {
    "Id": "block-consumer-microsoft-auth",
    "Title": "Block consumer Microsoft-account authentication in apps and services",
    "Path": "SOFTWARE\\Policies\\Microsoft\\MicrosoftAccount",
    "Name": "DisableUserAuth",
    "Standard": 0,
    "Strict": 1,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-msapolicy#microsoftaccount_disableuserauth",
    "Impact": "Strict prevents applications and services from authenticating with consumer Microsoft accounts after cached tokens expire. It does not change the Windows logon account or browser-based authentication.",
    "Exceptions": []
  },
  {
    "Id": "block-adding-microsoft-accounts",
    "Title": "Block adding Microsoft accounts to Windows",
    "Path": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System",
    "Name": "NoConnectedUser",
    "Standard": 0,
    "Strict": 1,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/accounts-block-microsoft-accounts",
    "Impact": "Strict blocks adding new Microsoft accounts while preserving existing Windows logon accounts. Value 3 is deliberately not used because it can prevent an existing Microsoft-account user from signing in to Windows.",
    "Exceptions": []
  },
  {
    "Id": "block-workplace-registration",
    "Title": "Block adding work or school accounts to the device",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\WorkplaceJoin",
    "Name": "BlockAADWorkplaceJoin",
    "Standard": 0,
    "Strict": 1,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/entra/identity/devices/howto-device-identity-virtual-desktop-infrastructure",
    "Impact": "Strict blocks new Microsoft Entra workplace registration. Existing organizational enrollment is not removed; ms-private refuses mutation on domain-joined or MDM-enrolled devices.",
    "Exceptions": []
  },
  {
    "Id": "updates-auto",
    "Title": "Automatic Windows Update choice",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU",
    "Name": "NoAutoUpdate",
    "Standard": null,
    "Strict": null,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings",
    "Impact": "Manual requires the user to install security updates. Preserves update components; other update policies and products remain separate.",
    "Exceptions": []
  },
  {
    "Id": "updates-options",
    "Title": "Windows Update download/install behavior",
    "Path": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU",
    "Name": "AUOptions",
    "Standard": null,
    "Strict": null,
    "EnterpriseValue": null,
    "Source": "https://learn.microsoft.com/en-us/windows/deployment/update/waas-wu-settings",
    "Impact": "Notify requests download/install notification; Automatic requests scheduled automatic installation. Effective behavior needs Windows validation.",
    "Exceptions": []
  }
]