Merge branch 'main' of https://github.com/MicrosoftDocs/memdocs-pr into ado36009095

Author: Mandi Ohlinger

.openpublishing.redirection.intune.json

@@ -1,5 +1,120 @@
 {
   "redirections": [
+    {
+      "source_path": "intune/analytics/adoption-score.md",
+      "redirect_url": "/intune/endpoint-analytics/adoption-score",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/app-reliability.md",
+      "redirect_url": "/intune/endpoint-analytics/app-reliability",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/configure.md",
+      "redirect_url": "/intune/endpoint-analytics/configure",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/data-collection.md",
+      "redirect_url": "/intune/endpoint-analytics/data-collection",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/get-support.md",
+      "redirect_url": "/intune/endpoint-analytics/get-support",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/index.md",
+      "redirect_url": "/intune/endpoint-analytics",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/restart-frequency.md",
+      "redirect_url": "/intune/endpoint-analytics/startup-perfomance#restart-frequency",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/scores.md",
+      "redirect_url": "/intune/endpoint-analytics/scores",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/startup-performance.md",
+      "redirect_url": "/intune/endpoint-analytics/startup-performance",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/troubleshoot.md",
+      "redirect_url": "/intune/endpoint-analytics/faq",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/work-from-anywhere.md",
+      "redirect_url": "/intune/endpoint-analytics/work-from-anywhere",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/advanced-analytics.md",
+      "redirect_url": "/intune/advanced-analytics",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/data-platform-schema.md",
+      "redirect_url": "/intune/advanced-analytics/data-platform-schema",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/anomaly-detection.md",
+      "redirect_url": "/intune/advanced-analytics/anomalies",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/battery-health.md",
+      "redirect_url": "/intune/advanced-analytics/battery-health",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/advanced-analytics-deploy.md",
+      "redirect_url": "/intune/advanced-analytics/deploy",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/device-query-multiple-devices.md",
+      "redirect_url": "/intune/advanced-analytics/device-query-multiple-devices",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/device-query.md",
+      "redirect_url": "/intune/advanced-analytics/device-query",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/device-scopes.md",
+      "redirect_url": "/intune/advanced-analytics/device-scopes",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/enhanced-device-timeline.md",
+      "redirect_url": "/intune/advanced-analytics/device-timeline",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/advanced-analytics-plan.md",
+      "redirect_url": "/intune/advanced-analytics/plan",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/resource-performance-report.md",
+      "redirect_url": "/intune/advanced-analytics/resource-performance-report",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/analytics/advanced-analytics-troubleshooting-faqs.md",
+      "redirect_url": "/intune/advanced-analytics/troubleshoot",
+      "redirect_document_id": false
+    },
     {
       "source_path": "intune/intune-service/protect/vulnerability-remediation-agent.md",
       "redirect_url": "/intune/agents/vulnerability-remediation-agent",
@@ -17,17 +132,17 @@
     },
     {
       "source_path": "intune/analytics/enroll-configmgr.md",
-      "redirect_url": "/intune/intune-service/analytics/set-up?pivots=cm#enroll-devices",
+      "redirect_url": "/intune/endpoint-analytics/configure?pivots=cm",
       "redirect_document_id": false
     },
     {
       "source_path": "intune/analytics/enroll-intune.md",
-      "redirect_url": "/intune/intune-service/analytics/set-up?pivots=intune#enroll-devices",
+      "redirect_url": "/intune/endpoint-analytics/configure?pivots=intune",
       "redirect_document_id": false
     },
     {
       "source_path": "intune/analytics/settings.md",
-      "redirect_url": "/intune/intune-service/analytics/set-up",
+      "redirect_url": "/intune/endpoint-analytics/configure",
       "redirect_document_id": false
     },
     {
@@ -37,7 +152,7 @@
     },
     {
       "source_path": "intune/analytics/overview.md",
-      "redirect_url": "/intune/analytics",
+      "redirect_url": "/intune/endpoint-analytics",
       "redirect_document_id": false
     },
     {
@@ -432,12 +547,42 @@
     },
     {
       "source_path": "intune/intune/apps/mamedge-5-end-user-experience.md",
-      "redirect_url": "/intune/intune-service/apps/mamedge-5-end-user-experience",
+      "redirect_url": "/intune/intune-service/apps/mamedge-7-end-user-experience",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/intune/apps/mamedge-5-settings-catalog.md",
+      "redirect_url": "/intune/intune-service/apps/mamedge-5-settings-catalog",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/intune/apps/mamedge-6-security-baseline.md",
+      "redirect_url": "/intune/intune-service/apps/mamedge-6-security-baseline",
       "redirect_document_id": false
     },
     {
       "source_path": "intune/intune/apps/mamedge-6-troubleshoot.md",
-      "redirect_url": "/intune/intune-service/apps/mamedge-6-troubleshoot",
+      "redirect_url": "/intune/intune-service/apps/mamedge-8-troubleshoot",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/intune-service/apps/mamedge-5-end-user-experience.md",
+      "redirect_url": "/intune/intune-service/apps/mamedge-7-end-user-experience",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/intune-service/apps/mamedge-6-troubleshoot.md",
+      "redirect_url": "/intune/intune-service/apps/mamedge-8-troubleshoot",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/intune/apps/mamedge-7-end-user-experience.md",
+      "redirect_url": "/intune/intune-service/apps/mamedge-7-end-user-experience",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/intune/apps/mamedge-8-troubleshoot.md",
+      "redirect_url": "/intune/intune-service/apps/mamedge-8-troubleshoot",
       "redirect_document_id": false
     },
     {
@@ -2662,7 +2807,12 @@
     },
     {
       "source_path": "intune/intune/protect/data-leak-prevention.md",
-      "redirect_url": "/intune/intune-service/protect/data-leak-prevention",
+      "redirect_url": "/intune/intune-service/fundamentals/deployment-guide-enrollment-mamwe",
+      "redirect_document_id": false
+    },
+    {
+      "source_path": "intune/intune-service/protect/data-leak-prevention.md",
+      "redirect_url": "/intune/intune-service/fundamentals/deployment-guide-enrollment-mamwe",
       "redirect_document_id": false
     },
     {

.openpublishing.redirection.json

@@ -1276,7 +1276,7 @@
     },
     {
       "source_path": "intune/analytics/whats-new.md",
-      "redirect_url": "/intune/analytics/overview",
+      "redirect_url": "/intune/endpoint-analytics",
       "redirect_document_id": false
     },
     {
@@ -1526,7 +1526,7 @@
     },
     {
       "source_path": "intune/analytics/recommended-software.md",
-      "redirect_url": "/intune/analytics/work-from-anywhere",
+      "redirect_url": "/intune/endpoint-analytics/work-from-anywhere",
       "redirect_document_id": true
     },
     {
@@ -1561,7 +1561,7 @@
     },
     {
       "source_path": "intune/analytics/productivity-score.md",
-      "redirect_url": "/intune/analytics/adoption-score",
+      "redirect_url": "/intune/endpoint-analytics/adoption-score",
       "redirect_document_id": false
     },
     {
@@ -1631,7 +1631,7 @@
     },
     {
       "source_path": "intune/analytics/proactive-remediations.md",
-      "redirect_url": "/intune/analytics/remediations",
+      "redirect_url": "/intune/intune-service/fundamentals/remediations",
       "redirect_document_id": false
     },
     {
@@ -2650,7 +2650,7 @@
     },
     {
       "source_path": "intune/analytics/advanced-endpoint-analytics.md",
-      "redirect_url": "/intune/analytics/advanced-analytics",
+      "redirect_url": "/intune/advanced-analytics",
       "redirect_document_id": false
     },
     {

autopilot/device-preparation/includes/reporting-monitoring.md

@@ -57,3 +57,6 @@ Headings are driven by article context. -->
       - **In progress** - The PowerShell script is currently running.
       - **Skipped** - Usually indicates that the PowerShell script was selected in the Windows Autopilot device preparation policy, but wasn't assigned to the device group specified in the Windows Autopilot device preparation policy.
       - **Failed** - The PowerShell script failed to run. Check logs for further details.
+
+> [!Important]
+> Windows 365 devices that are reprovisioned after a failed deployment will not be deleted from Intune and will remain in the Autopilot device preparation report to allow for you to download the diagnostic logs when an error occurs. To clean up the stale records, use [Intune cleanup rules](/intune/intune-service/fundamentals/device-cleanup-rules) or delete manually.

autopilot/device-preparation/requirements.md

@@ -92,12 +92,10 @@ Additional configuration might be required to grant access to required services
 
 Windows Autopilot device preparation relies on several different type of services to function properly. In order for these services to function properly, certain network configurations might need to be performed. These services and their required network configurations are as follows:
 
-#### Windows Autopilot device preparation deployment service
+#### Windows Autopilot deployment service
 
-After a network connection is in place, each Windows device will contact the Windows Autopilot device preparation deployment service. The following URLs are used:
+After a network connection is in place, each Windows device will contact the Windows Autopilot deployment service. The following URLs are used:
 
-- `https://ztd.dds.microsoft.com`
-- `https://cs.dds.microsoft.com`
 - `https://login.live.com`
 
 #### Windows activation

intune/advanced-analytics/anomalies.md

@@ -0,0 +1,68 @@
+---
+title: Anomalies Report in Advanced Analytics
+description: Discover how anomalies report in Microsoft Intune Advanced Analytics helps IT admins monitor device health, detect issues, and get actionable insights to improve endpoint reliability.
+ms.date: 12/01/2025
+ms.topic: concept-article
+---
+
+# Anomalies report
+
+[!INCLUDE [intune-add-on-note](../intune-service/includes/intune-add-on-note.md)]
+
+The anomalies report in Advanced Analytics helps IT admins proactively identify device health issues before they affect users. It monitors for application hangs, crashes, and Stop Error Restarts, providing visibility into problems before they reach support channels.
+
+The feature correlates deployment objects and configuration changes to speed troubleshooting and suggest root causes. Device correlation groups reveal patterns among affected devices and flag others that are at risk.
+
+## Before you begin
+
+> [!div class="checklist"]
+> - Review [Scores, baselines, and insights in endpoint analytics](../endpoint-analytics/scores.md) to understand these concepts.
+> - Confirm that your environment meets all [prerequisites](index.md#prerequisites).
+
+## Review the report
+
+1. In the [Microsoft Intune admin center][INT-AC], select **Reports** > **Endpoint analytics** > **Overview**.
+1. Select the **Anomalies** tab, which provides an overview of the anomalies detected in your organization.
+
+:::image type="content" source="images/anomaly-detection/anomalies-tab.png" lightbox="images/anomaly-detection/anomalies-tab.png" alt-text="Screenshot of the Anomaly tab in Overview section of endpoint analytics.":::
+
+- Use sorting and filtering capabilities to refine the list of anomalies.
+- To view more information about a specific anomaly, select it from the list. Review details such as the app name, affected devices, when the issue was first detected and last occurred, and any device groups that might be contributing to the problem.
+    :::image type="content" source="images/anomaly-detection/details-of-anomaly.png" lightbox="images/anomaly-detection/details-of-anomaly.png" alt-text="Screenshot of details displayed when you select an anomaly displayed in the Anomaly tab.":::
+- Select a device correlation group from the list to see common factors among devices. Devices are correlated by shared attributes such as app version, driver update, OS version, or device model. You can view the number of devices currently affected and those at risk. The **prevalence rate** shows the percentage of affected devices in a correlation group.
+    :::image type="content" source="images/anomaly-detection/select-corelation-group.png" lightbox="images/anomaly-detection/select-corelation-group.png" alt-text="Screenshot showing Device correlation groups.":::
+- Select **View Affected Devices** to display a list of devices with key attributes. Filter to view devices in specific correlation groups or show all devices affected by the anomaly. The device timeline also shows additional anomalous events.
+    :::image type="content" source="images/anomaly-detection/affected-devices.png" lightbox="images/anomaly-detection/affected-devices.png" alt-text="Screenshot showing a list of affected devices.":::
+
+## Review anomaly detection data
+
+Investigate flagged device correlation groups using the device timeline and resource reports to determine root causes. Device correlation groups help identify root causes for high and medium severity anomalies, as well as at-risk devices that may be impacted in the future.
+
+**Best practices:**
+- Periodically review the anomalies dashboard to understand the current baseline and prioritize investigations and resolutions for new issues.
+- Investigate new reported issues to identify common factors, such as device hardware, as shown in advanced analytics.
+- Prioritize anomalies to investigate based on severity and internal knowledge, such as application criticality.
+- Use the [device timeline](device-timeline.md) report to check for patterns, such as device restarts or updates tied to anomalies.
+- Work with IT teams to identify other factors, such as recent application updates, that could impact anomalies.
+- Review possible remediation actions noted in the anomaly report (for example, driver or application updates).
+- Integrate resolutions into L1/L2 support to keep teams aware of current known issues. Consider working with your ITSM team to record known anomalies under investigation.
+- Test remediation actions on a subset of devices and monitor results before rolling out to more devices. After remediation, proactively roll out to at-risk devices.
+- Review anomalies reports after major updates or incidents to check for new issues that need investigation and resolution.
+- To better understand detection methods, review the [statistical models](#statistical-models-for-determining-anomalies) used by anomaly detection.
+
+
+## Statistical models for determining anomalies
+
+The analytical model detects device cohorts facing anomalous sets of Stop Error Restarts and application hangs or crashes that need admin attention. Patterns identified from sensor telemetry and diagnostics logs determine these device cohorts.
+
+- **Threshold-based heuristic model**: This model sets one or more threshold values for application hangs, crashes, or Stop Error Restarts. Devices are flagged as anomalous if they breach the set threshold. The model is simple and effective for surfacing prominent or static issues. Thresholds are currently predetermined and not customizable.
+- **Paired t-tests model**: Paired t-tests compare pairs of observations in a dataset, looking for statistically significant differences between their means. For example, comparing Stop Error Restarts on the same device before and after a policy change, or app crashes after an OS update.
+- **Population Z-score model**: This model calculates the standard deviation and mean of a dataset, then uses those values to determine which data points are anomalous. The Z-score for each data point represents the number of standard deviations from the mean. Data points outside a certain range are considered anomalous. This model is well suited for highlighting outlier devices or apps but requires large datasets to be accurate.
+- **Time series Z-score model**: This variation of the Z-score model is designed for detecting anomalies in time series data—sequences of data points collected at regular intervals, such as Stop Error Restarts over time. Standard deviation and mean are calculated for a sliding window, allowing the model to adapt to temporal patterns and changes in data distribution.
+
+> [!NOTE]
+> Device cohorts are only identified for medium and high-severity anomalies.
+
+<!--links-->
+
+[INT-AC]: https://go.microsoft.com/fwlink/?linkid=2109431