diff --git a/exchange/exchange-ps/exchange/Get-DeviceConditionalAccessPolicy.md b/exchange/exchange-ps/exchange/Get-DeviceConditionalAccessPolicy.md
index a79926c166..08864cd534 100644
--- a/exchange/exchange-ps/exchange/Get-DeviceConditionalAccessPolicy.md
+++ b/exchange/exchange-ps/exchange/Get-DeviceConditionalAccessPolicy.md
@@ -14,7 +14,10 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is functional only in Security & Compliance PowerShell. For more information, see [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell).
 
-Use the Get-DeviceConditionalAccessPolicy cmdlet to view mobile device conditional access policies in Basic Mobility and Security in Microsoft 365.
+Use the Get-DeviceConditionalAccessPolicy cmdlet to view device conditional access policies in Basic Mobility and Security. These policies were created by using the New-DeviceConditionalAccessPolicy cmdlet or on the **Basic Mobility and Security** page with option **If a device doesn't meet the requirements above, then...** \> **Block access** selected.
+
+> [!TIP]
+> The Get-DevicePolicy cmdlet returns results for device conditional access policies and device configuration policies.
 
 For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
 
@@ -26,14 +29,17 @@ Get-DeviceConditionalAccessPolicy [[-Identity] <PolicyIdParameter>]
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+
+In device conditional access policies, devices that don't meet the access requirement settings in the policy are prevented from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device conditional access rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
+The interesting properties in a device policy are:
 
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+- Name (you can't change the name after you create the policy)
+- Comment
+- Enabled (you can only disable and enable policies in PowerShell)
+- Mode
+- Priority (corresponds to the order that policies are shown on the **Basic Mobility and Security** page)
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -41,22 +47,22 @@ To use this cmdlet in Security & Compliance PowerShell, you need to be assigned
 
 ### Example 1
 ```powershell
-Get-DeviceConditionalAccessPolicy | Format-Table Name,Enabled,Priority
+Get-DeviceConditionalAccessPolicy | Format-Table Name,Enabled,Mode,Priority
 ```
 
-This example shows summary information for all mobile device conditional access policies.
+This example shows summary information for all device conditional access policies.
 
 ### Example 2
 ```powershell
 Get-DeviceConditionalAccessPolicy -Identity "Human Resources"
 ```
 
-This example shows details about the mobile device conditional access policy named Human Resources.
+This example shows detailed information about the device conditional access policy named Human Resources.
 
 ## PARAMETERS
 
 ### -Identity
-The Identity parameter specifies the mobile device conditional access policy that you want to view. You can use any value that uniquely identifies the policy. For example:
+The Identity parameter specifies the device conditional access policy that you want to view. You can use any value that uniquely identifies the policy. For example:
 
 - Name
 - Distinguished name (DN)
diff --git a/exchange/exchange-ps/exchange/Get-DeviceConditionalAccessRule.md b/exchange/exchange-ps/exchange/Get-DeviceConditionalAccessRule.md
index 65fe845674..59f43dd37f 100644
--- a/exchange/exchange-ps/exchange/Get-DeviceConditionalAccessRule.md
+++ b/exchange/exchange-ps/exchange/Get-DeviceConditionalAccessRule.md
@@ -14,7 +14,7 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is functional only in Security & Compliance PowerShell. For more information, see [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell).
 
-Use the Get-DeviceConditionalAccessRule cmdlet to view mobile device conditional access rules in Basic Mobility and Security in Microsoft 365.
+Use the Get-DeviceConditionalAccessRule cmdlet to view device conditional access rules in Basic Mobility and Security. These rules were created by using the New-DeviceConditionalAccessRule cmdlet or on the **Basic Mobility and Security** page with option **If a device doesn't meet the requirements above, then...** \> **Block access** selected.
 
 For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
 
@@ -28,14 +28,9 @@ Get-DeviceConditionalAccessRule [[-Identity] <ComplianceRuleIdParameter>]
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
 
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
-
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+In device conditional access policies, devices that don't meet the access requirement settings in the policy are prevented from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device conditional access rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -43,22 +38,22 @@ To use this cmdlet in Security & Compliance PowerShell, you need to be assigned
 
 ### Example 1
 ```powershell
-Get-DeviceConditionalAccessRule | Format-List Name,Disabled,Priority
+Get-DeviceConditionalAccessRule | Format-List Name,TargetGroups,Mode
 ```
 
-This example shows a summary list of all mobile device conditional access rules.
+This example shows a summary list of all device conditional access rules.
 
 ### Example 2
 ```powershell
-Get-DeviceConditionalAccessRule -Identity "Secure Email{914f151c-394b-4da9-9422-f5a2f65dec30}"
+Get-DeviceConditionalAccessRule -Identity "Management Group {394b}"
 ```
 
-This example shows details for the mobile device conditional access rule named Secure Email{914f151c-394b-4da9-9422-f5a2f65dec30}.
+This example shows detailed information for the device conditional access rule named Management Group{394b} that's associated with the device conditional access policy named Management Group.
 
 ## PARAMETERS
 
 ### -Identity
-The Identity parameter specifies the mobile device conditional access rule that you want to view. The name of the rule uses the syntax `<Mobile device conditional access policy name>{<GUID value>}`. For example, `Secure Email{914f151c-394b-4da9-9422-f5a2f65dec30}`.
+The Identity parameter specifies the device conditional access rule that you want to view. The name of the rule uses the syntax `<AssociatedDeviceConditionalAccessPolicyName>{<xxx>}`. For example, `Management Group{394b}`.
 
 ```yaml
 Type: ComplianceRuleIdParameter
@@ -74,7 +69,7 @@ Accept wildcard characters: False
 ```
 
 ### -CompareToWorkload
-The CompareToWorkload switch specifies whether to compare the mobile device conditional access rule to Intune rules. You don't need to specify a value with this switch.
+The CompareToWorkload switch specifies whether to compare the device conditional access rule to Intune rules. You don't need to specify a value with this switch.
 
 ```yaml
 Type: SwitchParameter
diff --git a/exchange/exchange-ps/exchange/Get-DeviceConfigurationPolicy.md b/exchange/exchange-ps/exchange/Get-DeviceConfigurationPolicy.md
index 34e6dc1ae0..f85e8eba82 100644
--- a/exchange/exchange-ps/exchange/Get-DeviceConfigurationPolicy.md
+++ b/exchange/exchange-ps/exchange/Get-DeviceConfigurationPolicy.md
@@ -14,7 +14,10 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is functional only in Security & Compliance PowerShell. For more information, see [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell).
 
-Use the Get-DeviceConfigurationPolicy cmdlet to view mobile device configuration policies in Basic Mobility and Security in Microsoft 365.
+Use the Get-DeviceConfigurationPolicy cmdlet to view device configuration policies in Basic Mobility and Security. These policies were created by using the New-DeviceConfigurationPolicy cmdlet or on the **Basic Mobility and Security** page with option **If a device doesn't meet the requirements above, then...** \> **Allow access (device enrollment is required)** selected.
+
+> [!TIP]
+> The Get-DevicePolicy cmdlet returns results for device conditional access policies and device configuration policies.
 
 For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
 
@@ -26,14 +29,17 @@ Get-DeviceConfigurationPolicy [[-Identity] <PolicyIdParameter>]
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+
+In device configuration policies, devices that don't meet the access requirement settings in the policy are prompted to enroll in Basic Mobility and Security from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device configuration rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
+The interesting properties in a device policy are:
 
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+- Name (you can't change the name after you create the policy)
+- Comment
+- Enabled (you can only disable and enable policies in PowerShell)
+- Mode
+- Priority (corresponds to the order that policies are shown on the **Basic Mobility and Security** page)
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -41,22 +47,22 @@ To use this cmdlet in Security & Compliance PowerShell, you need to be assigned
 
 ### Example 1
 ```powershell
-Get-DeviceConfigurationPolicy | Format-Table Name,Enabled,Priority
+Get-DeviceConfigurationPolicy | Format-Table Name,Enabled,Mode,Priority
 ```
 
-This example shows summary information for all mobile device configuration policies.
+This example shows summary information for all device configuration policies.
 
 ### Example 2
 ```powershell
 Get-DeviceConfigurationPolicy -Identity "Engineering Group"
 ```
 
-This example shows details about the mobile device configuration policy named Engineering Group.
+This example shows details about the device configuration policy named Engineering Group.
 
 ## PARAMETERS
 
 ### -Identity
-The Identity parameter specifies the mobile device configuration policy that you want to view. You can use any value that uniquely identifies the policy. For example:
+The Identity parameter specifies the device configuration policy that you want to view. You can use any value that uniquely identifies the policy. For example:
 
 - Name
 - Distinguished name (DN)
diff --git a/exchange/exchange-ps/exchange/New-DeviceConditionalAccessPolicy.md b/exchange/exchange-ps/exchange/New-DeviceConditionalAccessPolicy.md
index b8386092bb..7b9022578d 100644
--- a/exchange/exchange-ps/exchange/New-DeviceConditionalAccessPolicy.md
+++ b/exchange/exchange-ps/exchange/New-DeviceConditionalAccessPolicy.md
@@ -14,7 +14,7 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is available only in Security & Compliance PowerShell. For more information, see [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell).
 
-Use the New-DeviceConditionalAccessPolicy cmdlet to create mobile device conditional access policies in Basic Mobility and Security in Microsoft 365.
+Use the New-DeviceConditionalAccessPolicy cmdlet to create device conditional access policies in Basic Mobility and Security. These policies also result from creating policies on the **Basic Mobility and Security** page with option **If a device doesn't meet the requirements above, then...** \> **Block access** selected.
 
 For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
 
@@ -31,14 +31,9 @@ New-DeviceConditionalAccessPolicy [-Name] <String>
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
 
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
-
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+In device conditional access policies, devices that don't meet the access requirement settings in the policy are prevented from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device conditional access rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -49,13 +44,17 @@ To use this cmdlet in Security & Compliance PowerShell, you need to be assigned
 New-DeviceConditionalAccessPolicy -Identity "Human Resources"
 ```
 
-This example creates a new mobile device conditional access policy named Human Resources
+This example creates a new device conditional access policy named Human Resources. After you create the policy, use the New-DeviceConditionalAccessRule cmdlet to create the associated device conditional access rule.
 
 ## PARAMETERS
 
 ### -Name
 The Name parameter specifies a unique name for the policy. If the value contains spaces, enclose the value in double quotation marks.
 
+You can't change the name of the policy after you create it.
+
+The policy name (for example, Human Resources) is used in the name value of the associated rule when you create it (for example, Human Resources{xxx}).
+
 ```yaml
 Type: String
 Parameter Sets: (All)
@@ -110,6 +109,8 @@ The Enabled parameter specifies whether the policy is enabled. Valid values are:
 - $true: The policy is enabled. This is the default value.
 - $false: The policy is disabled.
 
+You can only disable and re-enable policies in PowerShell.
+
 ```yaml
 Type: Boolean
 Parameter Sets: (All)
diff --git a/exchange/exchange-ps/exchange/New-DeviceConditionalAccessRule.md b/exchange/exchange-ps/exchange/New-DeviceConditionalAccessRule.md
index 102c007035..5ebd689adc 100644
--- a/exchange/exchange-ps/exchange/New-DeviceConditionalAccessRule.md
+++ b/exchange/exchange-ps/exchange/New-DeviceConditionalAccessRule.md
@@ -14,7 +14,7 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is available only in Security & Compliance PowerShell. For more information, see [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell).
 
-Use the New-DeviceConditionalAccessRule cmdlet to create mobile device conditional access rules in Basic Mobility and Security in Microsoft 365.
+Use the New-DeviceConditionalAccessRule cmdlet to create device conditional access rules in Basic Mobility and Security in Microsoft 365.
 
 For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
 
@@ -77,14 +77,9 @@ New-DeviceConditionalAccessRule -Policy <PolicyIdParameter> -TargetGroups <Multi
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
 
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
-
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+In device conditional access policies, devices that don't meet the access requirement settings in the policy are prevented from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device conditional access rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -92,18 +87,18 @@ To use this cmdlet in Security & Compliance PowerShell, you need to be assigned
 
 ### Example 1
 ```powershell
-New-DeviceConditionalAccessRule -Policy "Secure Email" -TargetGroups 5bff73eb-0ba7-461b-b7c9-9b4c173cc266
+New-DeviceConditionalAccessRule -Policy "Secure Email" -TargetGroups 00000000-0000-0000-0000-000000000000
 ```
 
-This example creates a new mobile device conditional access rule with the following settings:
+This example creates a new device conditional access rule with the following settings:
 
-- Policy: Secure Email
-- TargetGroups:5bff73eb-0ba7-461b-b7c9-9b4c173cc266
+- Associated device conditional access policy: Secure Email
+- TargetGroups: 00000000-0000-0000-0000-000000000000 (not assigned to any security groups)
 
 ## PARAMETERS
 
 ### -Policy
-The Policy parameter specifies the mobile device conditional access policy that this rule is associated with. You can use any value that uniquely identifies the policy. For example:
+The Policy parameter specifies the device conditional access policy that this rule is associated with. You can use any value that uniquely identifies the policy. For example:
 
 - Name
 - Distinguished name (DN)
@@ -123,9 +118,12 @@ Accept wildcard characters: False
 ```
 
 ### -TargetGroups
-The TargetGroups parameter specifies the security groups that this rule applies to. This parameter uses the GUID value of the group. To find this GUID value, run the command Get-Group | Format-Table Name,GUID.
+The TargetGroups parameter specifies the security groups that this rule applies to. This parameter uses one or more GUID values to identify the groups:
+
+- The value `00000000-0000-0000-0000-000000000000` means the rule isn't assigned to any security groups.
+- Use the output of the **Get-MgGroup** cmdlet in Microsoft Graph PowerShell to find the display name and the associated GUID values of available security groups (Microsoft 365 Groups with the _GroupTypes_ value `Unified` aren't allowed).
 
-You can specify multiple groups separated by commas.
+You can specify multiple security group GUID values separated by commas.
 
 ```yaml
 Type: MultiValuedProperty
@@ -141,10 +139,7 @@ Accept wildcard characters: False
 ```
 
 ### -AccountName
-The AccountName parameter specifies the account name. Valid values for this parameter are:
-
-- A text value.
-- $null (blank): The setting isn't configured. This is the default value.
+This parameter is reserved for internal Microsoft use.
 
 ```yaml
 Type: String
@@ -160,10 +155,7 @@ Accept wildcard characters: False
 ```
 
 ### -AccountUserName
-The AccountUserName parameter specifies the account user name. Valid values for this parameter are:
-
-- A text value.
-- $null (blank): The setting isn't configured. This is the default value.
+This parameter is reserved for internal Microsoft use.
 
 ```yaml
 Type: String
@@ -179,16 +171,16 @@ Accept wildcard characters: False
 ```
 
 ### -AllowAppStore
-The AllowAppStore parameter specifies whether to allow access to the app store on devices. Valid values for this parameter are:
+This setting is supported on the following types of devices:
 
-- $true: Access to the app store is allowed.
-- $false: Access to the app store isn't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+- iOS/iPadOS
+- Samsung Knox
+<!---Windows Arm64? Windows Phone 8.1--->
 
-This setting is available on the following types of devices:
+The AllowAppStore parameter specifies whether to allow access to the app store on supported devices. Valid values are:
 
-- Windows Phone 8.1
-- Apple iOS 6+
+- $true: Access to the app store is allowed. This is the default value.
+- $false: Access to the app store isn't allowed.
 
 ```yaml
 Type: Boolean
@@ -204,13 +196,16 @@ Accept wildcard characters: False
 ```
 
 ### -AllowAssistantWhileLocked
-The AllowAssistantWhileLocked parameter specifies whether to allow the use of the voice assistant while devices are locked. Valid values for this parameter are:
+This setting is available only in PowerShell.
 
-- $true: The voice assistant can be used while devices are locked.
-- $false: The voice assistant can't be used while devices are locked.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+
+The AllowAssistantWhileLocked parameter specifies whether to allow the use of Siri while devices are locked. Valid values are:
 
-This setting is available only on Apple iOS 6+ devices.
+- $true: Siri can be used while devices are locked. This is the default value.
+- $false: Siri can't be used while devices are locked.
 
 ```yaml
 Type: Boolean
@@ -226,13 +221,16 @@ Accept wildcard characters: False
 ```
 
 ### -AllowConvenienceLogon
-The AllowConvenienceLogon parameter specifies whether to allow convenience logons on devices. Valid values for this parameter are:
+This setting is available only in PowerShell.
 
-- $true: Convenience logons are allowed.
-- $false: Convenience logons aren't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
 
-This setting is available only on Windows 8.1 RT devices.
+- Windows Arm64
+
+The AllowConvenienceLogon parameter specifies whether to allow signing in on supported devices using non-password methods (for example, fingerprints or facial recognition). Valid values are:
+
+- $true: Convenience logons are allowed. This is the default value.
+- $false: Convenience logons aren't allowed.
 
 ```yaml
 Type: Boolean
@@ -248,17 +246,16 @@ Accept wildcard characters: False
 ```
 
 ### -AllowDiagnosticSubmission
-The AllowDiagnosticSubmission parameter specifies whether to allow diagnostic submissions from devices. Valid values for this parameter are:
+This setting is supported on the following types of devices:
 
-- $true: Diagnostic submissions are allowed.
-- $false: Diagnostic submissions aren't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+- iOS/iPadOS
+- Samsung Knox
+- Windows Arm64 <!---Windows Phone 8.1, Windows 8.1 RT--->
 
-This setting is available on the following types of devices:
+The AllowDiagnosticSubmission parameter specifies whether to allow sending diagnostic and usage data from supported devices. Valid values are:
 
-- Windows Phone 8.1
-- Windows 8.1 RT
-- Apple iOS 6+
+- $true: Diagnostic submissions are allowed. This is the default value.
+- $false: Diagnostic submissions aren't allowed.
 
 ```yaml
 Type: Boolean
@@ -274,16 +271,14 @@ Accept wildcard characters: False
 ```
 
 ### -AllowiCloudBackup
-The AllowiCloudBackup parameter specifies whether to allow Apple iCloud Backup from devices. Valid values for this parameter are:
+This setting is supported on the following types of devices:
 
-- $true: iCloud Backup is allowed.
-- $false: iCloud Backup isn't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+- Supervised iOS/iPadOS devices
 
-This setting is available on the following types of devices:
+The AllowiCloudBackup parameter specifies whether to allow iCloud Backup from supervised iOS/iPadOS devices. Valid values are:
 
-- Apple iOS 6+
-- Android 4+
+- $true: iCloud Backup is allowed. This is the default value.
+- $false: iCloud Backup isn't allowed.
 
 ```yaml
 Type: Boolean
@@ -299,16 +294,14 @@ Accept wildcard characters: False
 ```
 
 ### -AllowiCloudDocSync
-The AllowiCloudDocSync parameter specifies whether to allow Apple iCloud Documents & Data sync on devices. Valid values for this parameter are:
+This setting is supported on the following types of devices:
 
-- $true: iCloud Documents & Data sync is allowed.
-- $false: iCloud Documents & Data sync isn't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+- Supervised iOS/iPadOS devices
 
-This setting is available on the following types of devices:
+The AllowiCloudDocSync parameter specifies whether to allow iCloud Drive synchronization on supervised iOS/iPadOS devices. Valid values are:
 
-- Apple iOS 6+
-- Android 4+
+- $true: iCloud Documents & Data sync is allowed. This is the default value.
+- $false: iCloud Documents & Data sync isn't allowed.
 
 ```yaml
 Type: Boolean
@@ -324,16 +317,14 @@ Accept wildcard characters: False
 ```
 
 ### -AllowiCloudPhotoSync
-The AllowiCloudPhotoSync parameter specifies whether to allow Apple iCloud Photos sync on devices. Valid values for this parameter are:
+This setting is supported on the following types of devices:
 
-- $true: iCloud Photos sync is allowed.
-- $false: iCloud Photo sync isn't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+- iOS/iPadOS
 
-This setting is available on the following types of devices:
+The AllowiCloudPhotoSync parameter specifies whether to allow iCloud Photos synchronization on supported devices. Valid values are:
 
-- Apple iOS 6+
-- Android 4+
+- $true: iCloud Photos sync is allowed. This is the default value.
+- $false: iCloud Photo sync isn't allowed.
 
 ```yaml
 Type: Boolean
@@ -349,16 +340,20 @@ Accept wildcard characters: False
 ```
 
 ### -AllowJailbroken
-The AllowJailbroken parameter specifies whether to allow access to your organization by jailbroken or rooted devices.
+This is an access requirement setting that blocks access to Microsoft 365 resources from supported apps on non-compliant devices.
 
-- $true: Jailbroken devices are allowed.
-- $false: Jailbroken devices aren't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is available only in PowerShell.
+
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+- Android
+- Samsung Knox
 
-This setting is available on the following types of devices:
+The AllowJailbroken parameter specifies whether to allow access to company resources by supported devices that are jailbroken or rooted.
 
-- Apple iOS 6+
-- Android 4+
+- $true: Jailbroken devices are allowed. This is the default value for rules created in PowerShell.
+- $false: Jailbroken devices aren't allowed.
 
 ```yaml
 Type: Boolean
@@ -374,13 +369,16 @@ Accept wildcard characters: False
 ```
 
 ### -AllowPassbookWhileLocked
-The AllowPassbookWhileLocked parameter specifies whether to allow the use of Apple Passbook while devices are locked. Valid values for this parameter are:
+This setting is available only in PowerShell.
 
-- $true: Passbook is available while devices are locked.
-- $false: Passbook isn't available while devices are locked.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+
+The AllowPassbookWhileLocked parameter specifies whether to allow the use of Apple Wallet while iOS/iPadOS devices are locked. Valid values are:
 
-This setting is available only on Apple iOS 6+ devices.
+- $true: Apple Wallet is available while devices are locked. This is the default value.
+- $false: Apple Wallet isn't available while devices are locked.
 
 ```yaml
 Type: Boolean
@@ -396,16 +394,16 @@ Accept wildcard characters: False
 ```
 
 ### -AllowScreenshot
-The AllowScreenshot parameter specifies whether to allow screenshots on devices. Valid values for this parameter are:
+This setting is supported on the following types of devices:
 
-- $true: Screenshots are allowed.
-- $false: Screenshots aren't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+- iOS/iPadOS
+- Samsung Knox
+<!--Windows Arm64? Windows Phone 8.1--->
 
-This setting is available on the following types of devices:
+The AllowScreenshot parameter specifies whether to allow screenshots on supported devices. Valid values are:
 
-- Windows Phone 8.1
-- Apple iOS 6+
+- $true: Screenshots are allowed. This is the default value.
+- $false: Screenshots aren't allowed.
 
 ```yaml
 Type: Boolean
@@ -421,17 +419,19 @@ Accept wildcard characters: False
 ```
 
 ### -AllowSimplePassword
-The AllowSimplePassword parameter specifies whether to allow simple or non-complex passwords on devices. Valid values for this parameter are:
+This is an access requirement setting that blocks access to Microsoft 365 resources from supported apps on non-compliant devices.
 
-- $true: Simple passwords are allowed.
-- $false: Simple passwords aren't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
 
-This setting is available on the following types of devices:
+- iOS/iPadOS
+<!---Windows Arm64 (applies to local accounts only)? Windows Phone 8.1, Windows 8.1 RT--->
 
-- Windows Phone 8.1
-- Windows 8.1 RT
-- Apple iOS 6+
+The AllowSimplePassword parameter specifies whether to allow non-complex passwords on supported devices. Valid values are:
+
+- $true: Simple passwords are allowed. This is the default value in PowerShell.
+- $false: Simple passwords aren't allowed.
+
+The value of this parameter is meaningful only if the value of the PasswordRequired parameter is $true (the default value is $false in PowerShell).
 
 ```yaml
 Type: Boolean
@@ -447,13 +447,14 @@ Accept wildcard characters: False
 ```
 
 ### -AllowVideoConferencing
-The AllowVideoConferencing parameter specifies whether to allow video conferencing on devices. Valid values for this parameter are:
+This setting is supported on the following types of devices:
 
-- $true: Video conferencing is allowed.
-- $false: Video conferencing isn't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+- Supervised iOS/iPadOS devices
+
+The AllowVideoConferencing parameter specifies whether to allow access to FaceTime on supervised iOS/iPadOS devices. Valid values are:
 
-This setting is available only on Apple iOS 6+ devices.
+- $true: FaceTime is allowed. This is the default value.
+- $false: FaceTime isn't allowed.
 
 ```yaml
 Type: Boolean
@@ -469,13 +470,16 @@ Accept wildcard characters: False
 ```
 
 ### -AllowVoiceAssistant
-The AllowVoiceAssistant parameter specifies whether to allow using the voice assistant on devices. Valid values for this parameter are:
+This setting is available only in PowerShell.
 
-- $true: The voice assistant is allowed.
-- $false: The voice assistant isn't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+
+The AllowVoiceAssistant parameter specifies whether to allow access to Siri on supported devices. Valid values are:
 
-This setting is available only on Apple iOS 6+ devices.
+- $true: Siri is allowed. This is the default value.
+- $false: Siri isn't allowed.
 
 ```yaml
 Type: Boolean
@@ -491,13 +495,18 @@ Accept wildcard characters: False
 ```
 
 ### -AllowVoiceDialing
-The AllowVoiceDialing parameter specifies whether to allow voice-activated telephone dialing. Valid values for this parameter are:
+This setting is available only in PowerShell.
 
-- $true: Voice dialing is allowed.
-- $false: Voice dialing isn't allowed.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+
+The AllowVoiceDialing parameter specifies whether to allow telephone dialing by Siri on supported devices. Valid values are:
 
-This setting is available only on Apple iOS 6+ devices.
+- $true: Voice dialing by Siri is allowed. This is the default value.
+- $false: Voice dialing by Siri isn't allowed.
+
+The value of this parameter is meaningful only if the value of the AllowVoiceAssistant parameter is $true (default).
 
 ```yaml
 Type: Boolean
@@ -513,13 +522,17 @@ Accept wildcard characters: False
 ```
 
 ### -AntiVirusSignatureStatus
-The AntiVirusSignatureStatus parameter specifies the antivirus signature status. Valid values for this parameter are:
+This setting is available only in PowerShell.
+
+This setting is supported on the following types of devices:
+
+- Windows Arm64 <!---Windows 8.1 RT--->
+
+The AntiVirusSignatureStatus parameter specifies the required anti-virus signature status on supported devices. Valid values are:
 
 - An integer.
 - $null (blank): The setting isn't configured. This is the default value.
 
-This setting is available only on Windows 8.1 RT devices.
-
 ```yaml
 Type: Int64
 Parameter Sets: (All)
@@ -534,13 +547,17 @@ Accept wildcard characters: False
 ```
 
 ### -AntiVirusStatus
-The AntiVirusStatus parameter specifies the antivirus status. Valid values for this parameter are:
+This setting is available only in PowerShell.
+
+This setting is supported on the following types of devices:
+
+- Windows Arm64 <!---Windows 8.1 RT--->
+
+The AntiVirusStatus parameter specifies the required anti-virus status on supported devices. Valid values are:
 
 - An integer.
 - $null (blank): The setting isn't configured. This is the default value.
 
-This setting is available only on Windows 8.1 RT devices.
-
 ```yaml
 Type: Int64
 Parameter Sets: (All)
@@ -555,17 +572,22 @@ Accept wildcard characters: False
 ```
 
 ### -AppsRating
-The AppsRating parameter species the maximum or most restrictive rating of apps that are allowed on devices. Valid values for this parameter are:
+This setting is available only in PowerShell.
+
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+
+The AppsRating parameter species the maximum or most restrictive rating of apps that are allowed on supported devices. Valid values are:
 
-- AllowAll
 - DontAllow
+- Rating4plus
 - Rating9plus
 - Rating12plus
 - Rating17plus
+- AllowAll
 - $null (blank): The setting isn't configured. This is the default value.
 
-This setting is available only on Apple iOS 6+ devices.
-
 ```yaml
 Type: CARatingAppsEntry
 Parameter Sets: (All)
@@ -580,7 +602,13 @@ Accept wildcard characters: False
 ```
 
 ### -AutoUpdateStatus
-The AutoUpdateStatus parameter specifies the update settings for devices. Valid values for this parameter are:
+This setting is available only in PowerShell.
+
+This setting is supported on the following types of devices:
+
+- Windows Arm64 <!---Windows 8.1 RT--->
+
+The AutoUpdateStatus parameter specifies the required update settings on supported devices. Valid values are:
 
 - AutomaticCheckForUpdates
 - AutomaticDownloadUpdates
@@ -589,8 +617,6 @@ The AutoUpdateStatus parameter specifies the update settings for devices. Valid
 - NeverCheckUpdates
 - $null (blank): The setting isn't configured. This is the default value.
 
-This setting is available only on Windows 8.1 RT devices.
-
 ```yaml
 Type: CAAutoUpdateStatusEntry
 Parameter Sets: (All)
@@ -605,13 +631,24 @@ Accept wildcard characters: False
 ```
 
 ### -BluetoothEnabled
-The BluetoothEnabled parameter specifies whether to enable or disable Bluetooth on devices. Valid values for this parameter are:
+This setting is supported on the following types of devices:
+
+- Samsung Knox
+<!---Windows Arm64? Windows Phone 8.1--->
+
+The BluetoothEnabled parameter specifies whether to enable or disable Bluetooth on supported devices. Valid values are:
 
-- $true: Bluetooth is enabled.
+- $true: Bluetooth is enabled. This is the default value.
 - $false: Bluetooth is disabled.
-- $null (blank): The setting isn't configured. This is the default value.
 
-This setting is available only on Windows Phone 8.1 devices.
+Technically, wWe can't disable BlueTooth as a setting in Android. Instead, we disable all the transactions that require BlueTooth:
+
+- Advanced Audio Distribution
+- Audio/Video Remote Control
+- Hands-free devices<
+- Headsets
+- Phone Book Access
+- Serial Port
 
 ```yaml
 Type: Boolean
@@ -627,17 +664,19 @@ Accept wildcard characters: False
 ```
 
 ### -CameraEnabled
-The CameraEnabled parameter specifies whether to enable or disable cameras on devices. Valid values for this parameter are:
+This setting is available only in PowerShell.
 
-- $true: Cameras are enabled.
-- $false: Cameras are disabled.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
 
-This setting is available on the following types of devices:
+- iOS/iPadOS
+- Android
+- Samsung Knox
+<!---Windows Arm64? Windows Phone 8.1--->
 
-- Windows Phone 8.1
-- Apple iOS 6+
-- Android 4+
+The CameraEnabled parameter specifies whether to enable or disable the built-in camera on supported devices. Valid values are:
+
+- $true: The camera is enabled. This is the default value.
+- $false: The camera is disabled.
 
 ```yaml
 Type: Boolean
@@ -688,10 +727,7 @@ Accept wildcard characters: False
 ```
 
 ### -EmailAddress
-The EmailAddress parameter specifies the email address. Valid values are:
-
-- An email address: For example, julia@contoso.com.
-- $null (blank): The setting isn't configured. This is the default value.
+This parameter is reserved for internal Microsoft use.
 
 ```yaml
 Type: String
@@ -707,13 +743,15 @@ Accept wildcard characters: False
 ```
 
 ### -EnableRemovableStorage
-The EnableRemovableStorage parameter specifies whether removable storage can be used by devices. Valid values for this parameter are:
+This setting is supported on the following types of devices:
 
-- $true: Removable storage can be used.
-- $false: Removable storage can't be used.
-- $null (blank): The setting isn't configured. This is the default value.
+- Samsung Knox
+<!---Windows Arm64? Windows Phone 8.1--->
 
-This setting is available only on Windows Phone 8.1 devices.
+The EnableRemovableStorage parameter specifies whether removable storage can be used by supported devices. Valid values are:
+
+- $true: Removable storage can be used. This is the default value.
+- $false: Removable storage can't be used.
 
 ```yaml
 Type: Boolean
@@ -729,10 +767,7 @@ Accept wildcard characters: False
 ```
 
 ### -ExchangeActiveSyncHost
-The ExchangeActiveSyncHost parameter specifies the Exchange ActiveSync host. Valid values for this parameter are:
-
-- A text value.
-- $null (blank): The setting isn't configured. This is the default value.
+This parameter is reserved for internal Microsoft use.
 
 ```yaml
 Type: String
@@ -748,13 +783,17 @@ Accept wildcard characters: False
 ```
 
 ### -FirewallStatus
-The FirewallStatus parameter specifies the acceptable firewall status values on devices. Valid values for this parameter are:
+This setting is available only in PowerShell.
+
+This setting is supported on the following types of devices:
+
+- Windows Arm64 <!---Windows 8.1 RT--->
+
+The FirewallStatus parameter specifies the acceptable firewall status values on supported devices. Valid values are:
 
 - Required
 - $null (blank): The setting isn't configured. This is the default value.
 
-This setting is available only on Windows 8.1 RT devices.
-
 ```yaml
 Type: Required
 Parameter Sets: (All)
@@ -769,13 +808,16 @@ Accept wildcard characters: False
 ```
 
 ### -ForceAppStorePassword
-The ForceAppStorePassword parameter specifies whether to require a password to use the app store on devices. Valid values for this parameter are:
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+
+The ForceAppStorePassword parameter specifies whether to require a password to use the app store on supported devices. Valid values are:
 
-- $true: App store passwords are required.
-- $false: App store passwords aren't required.
-- $null (blank): The feature isn't allowed or blocked by the rule. This is the default value.
+- $true: A password is required to use the app store.
+- $false: A password isn't required to use the app store. This is the default value.
 
-This setting is available only on Apple iOS 6+ devices.
+This setting is meaningful only if the value of the AllowAppStore parameter is $true (default).
 
 ```yaml
 Type: Boolean
@@ -791,16 +833,14 @@ Accept wildcard characters: False
 ```
 
 ### -ForceEncryptedBackup
-The ForceEncryptedBackup parameter specifies whether to force encrypted backups for devices. Valid values for this parameter are:
+This setting is supported on the following types of devices:
 
-- $true: Encrypted backups are required.
-- $false: Encrypted backups aren't required.
-- $null (blank): The setting isn't configured. This is the default value.
+- iOS/iPadOS
 
-This setting is available on the following types of devices:
+The ForceEncryptedBackup parameter specifies whether to force encrypted backups for supported devices. Valid values are:
 
-- Apple iOS 6+
-- Android 4+
+- $true: Encrypted backups are required.
+- $false: Encrypted backups aren't required. This is the default value.
 
 ```yaml
 Type: Boolean
@@ -816,17 +856,21 @@ Accept wildcard characters: False
 ```
 
 ### -MaxPasswordAttemptsBeforeWipe
-The MaxPasswordAttemptsBeforeWipe parameter specifies the number of incorrect password attempts that cause devices to be automatically wiped. Valid values for this parameter are:
+This is an access requirement setting that blocks access to Microsoft 365 resources from supported apps on non-compliant devices.
 
-- An integer.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+- Android
+- Samsung Knox
+- Windows Arm64 <!---Windows Phone 8.1, Windows 8.1 RT--->
 
-This setting is available on the following types of devices:
+The MaxPasswordAttemptsBeforeWipe parameter specifies the number of incorrect password attempts that cause supported devices to be automatically wiped. Valid values are:
 
-- Windows Phone 8.1
-- Windows 8.1 RT
-- Apple iOS 6+
-- Android 4+
+- An integer. Reasonable values are from 4 to 11.
+- $null (blank): The setting isn't configured. This is the default value.
+
+The value of this parameter is meaningful only if the value of the PasswordRequired parameter is $true (the default value is $false in PowerShell).
 
 ```yaml
 Type: Int32
@@ -842,12 +886,18 @@ Accept wildcard characters: False
 ```
 
 ### -MaxPasswordGracePeriod
-The MaxPasswordGracePeriod parameter specifies the length of time users are allowed to reset expired passwords on devices.
+This setting is available only in PowerShell.
+
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
 
-This setting is available only on Apple iOS 6+ devices.
+The MaxPasswordGracePeriod parameter specifies the length of time that users are allowed to reset expired passwords on supported devices.
 
 To specify a value, enter it as a time span: dd.hh:mm:ss where dd = days, hh = hours, mm = minutes, and ss = seconds.
 
+The default value is blank ($null).
+
 ```yaml
 Type: TimeSpan
 Parameter Sets: (All)
@@ -862,7 +912,13 @@ Accept wildcard characters: False
 ```
 
 ### -MoviesRating
-The MoviesRating parameter species the maximum or most restrictive rating of movies that are allowed on devices. You specify the country/region rating system to use with the RegionRatings parameter.
+This setting is available only in PowerShell.
+
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+
+The MoviesRating parameter species the maximum or most restrictive rating of movies that are allowed on supported devices. You specify the country/region rating system to use with the RegionRatings parameter.
 
 Valid values for the MoviesRating parameter are:
 
@@ -870,83 +926,58 @@ Valid values for the MoviesRating parameter are:
 - DontAllow: No movies are allowed, regardless of their rating.
 - $null (blank): The setting isn't configured. This is the default value.
 
-Australia
-
-- AURatingG
-- AURatingPG
-- AURatingM
-- AURatingMA15plus
-- AURatingR18plus
-
-Canada
-
-- CARatingG
-- CARatingPG
-- CARating14A
-- CARating18A
-- CARatingR
-
-Germany
-
-- DERatingab0Jahren
-- DERatingab6Jahren
-- DERatingab12Jahren
-- DERatingab16Jahren
-- DERatingab18Jahren
-
-France
-
-- FRRating10minus
-- FRRating12minus
-- FRRating16minus
-- FRRating18minus
-
-United Kingdom
-
-- GBRatingU
-- GBRatingUc
-- GBRatingPG
-- GBRating12
-- GBRating12A
-- GBRating15
-- GBRating18
-
-Ireland
-
-- IERatingG
-- IERatingPG
-- IERating12
-- IERating15
-- IERating16
-- IERating18
-
-Japan
-
-- JPRatingG
-- JPRatingPG12
-- JPRatingRdash15
-- JPRatingRdash18
-
-New Zealand
-
-- NZRatingG
-- NZRatingPG
-- NZRatingM
-- NZRatingR13
-- NZRatingR15
-- NZRatingR16
-- NZRatingR18
-- NZRatingR
-
-United States
-
-- USRatingG
-- USRatingPG
-- USRatingPG13
-- USRatingR
-- USRatingNC17
-
-This setting is available only on Apple iOS 6+ devices.
+Valid country/region specific ratings values:
+
+- AURatingG (Australia)
+- AURatingPG (Australia)
+- AURatingM (Australia)
+- AURatingMA15plus (Australia)
+- AURatingR18plus (Australia)
+- CARatingG (Canada)
+- CARatingPG (Canada)
+- CARating14A (Canada)
+- CARating18A (Canada)
+- CARatingR (Canada)
+- DERatingab0Jahren (Germany)
+- DERatingab6Jahren (Germany)
+- DERatingab12Jahren (Germany)
+- DERatingab16Jahren (Germany)
+- DERatingab18Jahren (Germany)
+- FRRating10minus (France)
+- FRRating12minus (France)
+- FRRating16minus (France)
+- FRRating18minus (France)
+- GBRatingU (United Kingdom)
+- GBRatingUc (United Kingdom)
+- GBRatingPG (United Kingdom)
+- GBRating12 (United Kingdom)
+- GBRating12A (United Kingdom)
+- GBRating15 (United Kingdom)
+- GBRating18 (United Kingdom)
+- IERatingG (Ireland)
+- IERatingPG (Ireland)
+- IERating12 (Ireland)
+- IERating15 (Ireland)
+- IERating16 (Ireland)
+- IERating18 (Ireland)
+- JPRatingG (Japan)
+- JPRatingPG12 (Japan)
+- JPRatingRdash15 (Japan)
+- JPRatingRdash18 (Japan)
+- NZRatingG (New Zealand)
+- NZRatingPG (New Zealand)
+- NZRatingM (New Zealand)
+- NZRatingR13 (New Zealand)
+- NZRatingR15 (New Zealand)
+- NZRatingR16 (New Zealand)
+- NZRatingR18 (New Zealand)
+- NZRatingR (New Zealand)
+- NZRatingRP16 (New Zealand)
+- USRatingG (United States)
+- USRatingPG (United States)
+- USRatingPG13 (United States)
+- USRatingR (United States)
+- USRatingNC17 (United States)
 
 ```yaml
 Type: CARatingMovieEntry
@@ -962,7 +993,9 @@ Accept wildcard characters: False
 ```
 
 ### -PasswordComplexity
-The PasswordComplexity parameter specifies the password complexity. Valid values for this parameter are:
+<!--- Not described in article or correlated to UI setting --->
+
+The PasswordComplexity parameter specifies the required password complexity on supported devices. Valid values are:
 
 - An integer.
 - $null (blank): The setting isn't configured. This is the default value.
@@ -981,17 +1014,21 @@ Accept wildcard characters: False
 ```
 
 ### -PasswordExpirationDays
-The PasswordExpirationDays parameter specifies the number of days that the same password can be used on devices before users are required to change their passwords . Valid values for this parameter are:
+This is an access requirement setting that blocks access to Microsoft 365 resources from supported apps on non-compliant devices.
 
-- An integer.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+- Android
+- Samsung Knox
+- Windows Arm64 (applies to local accounts only) <!---Windows Phone 8.1, Windows 8.1 RT--->
+
+The PasswordExpirationDays parameter specifies the number of days that the same password can be used on supported devices before users are required to change their passwords. Valid values are:
 
-This setting is available on the following types of devices:
+- An integer. Reasonable values are from 1 to 255.
+- $null (blank): The setting isn't configured. This is the default value.
 
-- Windows Phone 8.1
-- Windows 8.1 RT
-- Apple iOS 6+
-- Android 4+
+The value of this parameter is meaningful only if the value of the PasswordRequired parameter is $true (the default value is $false in PowerShell).
 
 ```yaml
 Type: Int32
@@ -1007,17 +1044,21 @@ Accept wildcard characters: False
 ```
 
 ### -PasswordHistoryCount
-The PasswordHistoryCount parameter specifies the minimum number of unique new passwords that are required on devices before an old password can be reused. Valid values for this parameter are:
+This is an access requirement setting that blocks access to Microsoft 365 resources from supported apps on non-compliant devices.
 
-- An integer.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
 
-This setting is available on the following types of devices:
+- iOS/iPadOS
+- Android
+- Samsung Knox
+- Windows Arm64 (applies to local accounts only) <!---Windows Phone 8.1, Windows 8.1 RT--->
 
-- Windows Phone 8.1
-- Windows 8.1 RT
-- Apple iOS 6+
-- Android 4+
+The PasswordHistoryCount parameter specifies the minimum number of unique new passwords that are required on supported devices before an old password can be reused. Valid values are:
+
+- An integer. Reasonable values are from 1 to 24.
+- $null (blank): The setting isn't configured. This is the default value.
+
+The value of this parameter is meaningful only if the value of the PasswordRequired parameter is $true (the default value is $false in PowerShell).
 
 ```yaml
 Type: Int32
@@ -1033,11 +1074,20 @@ Accept wildcard characters: False
 ```
 
 ### -PasswordMinComplexChars
-The PasswordMinComplexChars parameter specifies the minimum number of complex characters that are required for device passwords. A complex character isn't a letter. Valid values for this parameter are:
+This is an access requirement setting that blocks access to Microsoft 365 resources from supported apps on non-compliant devices.
 
-- An integer.
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+- Windows Arm64 (applies to local accounts only)
+
+The PasswordMinComplexChars parameter specifies the minimum number of characters set that are required for device passwords on supported devices. Valid values are:
+
+- An integer. Reasonable values are are 1 to 4.
 - $null (blank): The setting isn't configured. This is the default value.
 
+The value of this parameter is meaningful only if the value of the PasswordRequired parameter is $true (the default value is $false in PowerShell).
+
 ```yaml
 Type: Int32
 Parameter Sets: (All)
@@ -1052,17 +1102,21 @@ Accept wildcard characters: False
 ```
 
 ### -PasswordMinimumLength
-The PasswordMinimumLength parameter specifies the minimum number of characters that are required for device passwords. Valid values for this parameter are:
+This is an access requirement setting that blocks access to Microsoft 365 resources from supported apps on non-compliant devices.
 
-- An integer.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
 
-This setting is available on the following types of devices:
+- iOS/iPadOS
+- Android
+- Samsung Knox
+- Windows Arm64 (applies to local accounts only) <!---Windows Phone 8.1, Windows 8.1 RT--->
 
-- Windows Phone 8.1
-- Windows 8.1 RT
-- Apple iOS 6+
-- Android 4+
+The PasswordMinimumLength parameter specifies the minimum number of characters that are required for device passwords on supported devices. Valid values are:
+
+- An integer. Reasonable values are from 4 to 14.
+- $null (blank): The setting isn't configured. This is the default value.
+
+The value of this parameter is meaningful only if the value of the PasswordRequired parameter is $true (the default value is $false in PowerShell).
 
 ```yaml
 Type: Int32
@@ -1078,15 +1132,20 @@ Accept wildcard characters: False
 ```
 
 ### -PasswordQuality
-The PasswordQuality parameter specifies the minimum password quality rating that's required for device passwords. Password quality is a numeric scale that indicates the security and complexity of the password. A higher quality value indicates a more secure password.
+This setting is available only in PowerShell.
+
+This setting is supported on the following types of devices:
 
-Valid values for this parameter are:
+- Android
+- Samsung Knox
+
+The PasswordQuality parameter specifies the minimum password quality rating that's required for device passwords on supported devices. Password quality is a numeric scale that indicates the security and complexity of the password. A higher quality value indicates a more secure password.
+
+Valid values are:
 
 - An integer.
 - $null (blank): The setting isn't configured. This is the default value.
 
-This setting is available only on Android 4+ devices.
-
 ```yaml
 Type: Int32
 Parameter Sets: (All)
@@ -1101,17 +1160,17 @@ Accept wildcard characters: False
 ```
 
 ### -PasswordRequired
-The PasswordRequired parameter specifies whether a password is required to access devices. Valid values for this parameter are:
+This is an access requirement setting that blocks access to Microsoft 365 resources from supported apps on non-compliant devices.
 
-- $true: Device passwords are required.
-- $false: Device passwords aren't required.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+- Windows Arm64 <!---Windows Phone 8.1--->
 
-This setting is available on the following types of devices:
+The PasswordRequired parameter specifies whether a password is required to access supported devices. Valid values are:
 
-- Windows Phone 8.1
-- Apple iOS 6+
-- Android 4+
+- $true: Device passwords are required.
+- $false: Device passwords aren't required. This is the default value in PowerShell.
 
 ```yaml
 Type: Boolean
@@ -1127,16 +1186,20 @@ Accept wildcard characters: False
 ```
 
 ### -PasswordTimeout
-The PasswordTimeout parameter specifies the length of time that devices can be inactive before a password is required to reactivate them.
+This is an access requirement setting that blocks access to Microsoft 365 resources from supported apps on non-compliant devices.
 
-This setting is available on the following types of devices:
+This setting is supported on the following types of devices:
 
-- Windows Phone 8.1
-- Windows 8.1 RT
-- Apple iOS 6+
-- Android 4+
+- iOS/iPadOS
+- Windows Arm64 <!---Windows Phone 8.1, Windows 8.1 RT--->
 
-To specify a value, enter it as a time span: dd.hh:mm:ss where dd = days, hh = hours, mm = minutes, and ss = seconds.
+The PasswordTimeout parameter specifies the length of time that supported devices can be inactive before a password is required to reactivate them.
+
+To specify a value, enter it as a time span: dd.hh:mm:ss where dd = days, hh = hours, mm = minutes, and ss = seconds. Reasonable values are 00:01:00 (one minute) to 01:00:00 (one hour).
+
+The default value is $null (blank).
+
+The value of this parameter is meaningful only if the value of the PasswordRequired parameter is $true (the default value is $false in PowerShell).
 
 ```yaml
 Type: TimeSpan
@@ -1152,16 +1215,18 @@ Accept wildcard characters: False
 ```
 
 ### -PhoneMemoryEncrypted
-The PhoneMemoryEncrypted parameter specifies whether to encrypt the memory on devices. Valid values for this parameter are:
+This is an access requirement setting that blocks access to Microsoft 365 resources from supported apps on non-compliant devices.
 
-- $true: Memory is encrypted.
-- $false: Memory isn't encrypted.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
 
-This setting is available on the following types of devices:
+- Android
+- Samsung Knox
+<!---Windows Phone 8.1 (already encrypted and can't be unencrypted)--->
 
-- Windows Phone 8.1 (already encrypted and can't be unencrypted)
-- Android 4+
+The PhoneMemoryEncrypted parameter specifies whether to encrypt the memory on supported devices. Valid values are:
+
+- $true: Memory is encrypted.
+- $false: Memory isn't encrypted. This is the default value.
 
 ```yaml
 Type: Boolean
@@ -1177,11 +1242,14 @@ Accept wildcard characters: False
 ```
 
 ### -RegionRatings
-The RegionRatings parameter specifies the rating system (country/region) to use for movie and television ratings with the MoviesRating and TVShowsRating parameters.
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+
+The RegionRatings parameter specifies the rating system (country/region) to use for movie and television ratings on supported devices with the MoviesRating and TVShowsRating parameters.
 
 Valid values for the RegionRating parameter are:
 
-- $null (blank): The setting isn't configured. This is the default value.
 - au: Australia
 - ca: Canada
 - de: Germany
@@ -1191,8 +1259,7 @@ Valid values for the RegionRating parameter are:
 - jp: Japan
 - nz: New Zealand
 - us: United States
-
-This setting is available only on Apple iOS 6+ devices.
+- $null (blank): The setting isn't configured. This is the default value.
 
 ```yaml
 Type: CARatingRegionEntry
@@ -1208,11 +1275,16 @@ Accept wildcard characters: False
 ```
 
 ### -RequireEmailProfile
-The RequireEmailProfile parameter specifies whether an email profile is required on devices. Valid values for this parameter are:
+This is an access requirement setting that blocks access to Microsoft 365 resources from supported apps on non-compliant devices.
 
-- $true: An email profile is required. This value is required for selective wipe on iOS devices.
-- $false: An email profile isn't required.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+
+The RequireEmailProfile parameter specifies whether an email profile is required on supported devices. Valid values are:
+
+- $true: An email profile is required. This value is required for selective wipe.
+- $false: An email profile isn't required. This is the default value.
 
 ```yaml
 Type: Boolean
@@ -1228,13 +1300,16 @@ Accept wildcard characters: False
 ```
 
 ### -SmartScreenEnabled
-The SmartScreenEnabled parameter specifies whether to requireWindows SmartScreen on devices. Valid values for this parameter are:
+This setting is available only in PowerShell.
 
-- $true: SmartScreen is enabled.
-- $false: SmartScreen is disabled.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
+
+- Windows Arm64 <!---Windows 8.1 RT--->
 
-This setting is available only on Windows 8.1 RT devices.
+The SmartScreenEnabled parameter specifies whether to requireWindows SmartScreen on supported devices. Valid values are:
+
+- $true: SmartScreen is enabled.
+- $false: SmartScreen is disabled. This is the default value.
 
 ```yaml
 Type: Boolean
@@ -1250,13 +1325,16 @@ Accept wildcard characters: False
 ```
 
 ### -SystemSecurityTLS
-The SystemSecurityTLS parameter specifies whether TLS encryption is used on devices. Valid values for this parameter are:
+This setting is available only in PowerShell.
 
-- $true: TLS encryption is used.
-- $false: TLS encryption isn't used.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
 
-This setting is available only on Apple iOS 6+ devices.
+The SystemSecurityTLS parameter specifies whether TLS encryption is required on supported devices. Valid values are:
+
+- $true: TLS encryption is required.
+- $false: TLS encryption isn't required. This is the default value.
 
 ```yaml
 Type: Boolean
@@ -1272,7 +1350,13 @@ Accept wildcard characters: False
 ```
 
 ### -TVShowsRating
-The TVShowsRating parameter species the maximum or most restrictive rating of television shows that are allowed on devices. You specify the country/region rating system to use with the RegionRatings parameter.
+This setting is available only in PowerShell.
+
+This setting is supported on the following types of devices:
+
+- iOS/iPadOS
+
+The TVShowsRating parameter species the maximum or most restrictive rating of television shows that are allowed on supported devices. You specify the country/region rating system to use with the RegionRatings parameter.
 
 Valid values for the TVShowsRating parameter are:
 
@@ -1280,72 +1364,46 @@ Valid values for the TVShowsRating parameter are:
 - DontAllow: No televisions shows are allowed, regardless of their rating.
 - $null (blank): The setting isn't configured. This is the default value.
 
-Australia
-
-- AURatingP
-- AURatingC
-- AURatingG
-- AURatingPG
-- AURatingM
-- AURatingMA15plus
-- AURatingAv15plus
-
-Canada
-
-- CARatingC
-- CARatingC8
-- CARatingG
-- CARatingPG
-- CARating14plus
-- CARating18plus
-
-Germany
-
-- DERatingab0Jahren
-- DERatingab6Jahren
-- DERatingab12Jahren
-- DERatingab16Jahren
-- DERatingab18Jahren
-
-France
-
-- FRRating10minus
-- FRRating12minus
-- FRRating16minus
-- FRRating18minus
-
-United Kingdom
-
-- GBRatingCaution
-
-Ireland
-
-- IERatingGA
-- IERatingCh
-- IERatingYA
-- IERatingPS
-- IERatingMA
-
-Japan
-
-- JPRatingExplicitAllowed
-
-New Zealand
-
-- NZRatingG
-- NZRatingPGR
-- NZRatingAO
-
-United States
-
-- USRatingTVY
-- USRatingTVY7
-- USRatingTVG
-- USRatingTVPG
-- USRatingTV14
-- USRatingTVMA
-
-This setting is available only on Apple iOS 6+ devices.
+Valid country/region specific ratings values:
+
+- AURatingP (Australia)
+- AURatingC (Australia)
+- AURatingG (Australia)
+- AURatingPG (Australia)
+- AURatingM (Australia)
+- AURatingMA15plus (Australia)
+- AURatingAv15plus (Australia)
+- CARatingC (Canada)
+- CARatingC8 (Canada)
+- CARatingG (Canada)
+- CARatingPG (Canada)
+- CARating14plus (Canada)
+- CARating18plus (Canada)
+- DERatingab0Jahren (Germany)
+- DERatingab6Jahren (Germany)
+- DERatingab12Jahren (Germany)
+- DERatingab16Jahren (Germany)
+- DERatingab18Jahren (Germany)
+- FRRating10minus (France)
+- FRRating12minus (France)
+- FRRating16minus (France)
+- FRRating18minus (France)
+- GBRatingCaution (United Kingdom)
+- IERatingGA (Ireland)
+- IERatingCh (Ireland)
+- IERatingYA (Ireland)
+- IERatingPS (Ireland)
+- IERatingMA (Ireland)
+- JPRatingExplicitAllowed (Japan)
+- NZRatingG (New Zealand)
+- NZRatingPGR (New Zealand)
+- NZRatingAO (New Zealand)
+- USRatingTVG (United States)
+- USRatingTVY (United States)
+- USRatingTVY7 (United States)
+- USRatingTVPG (United States)
+- USRatingTV14 (United States)
+- USRatingTVMA (United States)
 
 ```yaml
 Type: CARatingTvShowEntry
@@ -1361,15 +1419,19 @@ Accept wildcard characters: False
 ```
 
 ### -UserAccountControlStatus
-The UserAccountControlStatus parameter specifies how User Account Control messages are presented on devices. Valid values for this parameter are:
+This setting is available only in PowerShell.
+
+This setting is supported on the following types of devices:
+
+- Windows Arm64 <!---Windows 8.1 RT--->
+
+The UserAccountControlStatus parameter specifies how User Account Control messages are presented on supported devices. Valid values are:
 
-- $null (blank): The setting isn't configured. This is the default value.
 - AlwaysNotify
 - NeverNotify
 - NotifyAppChanges
-- NotifyAppChangesDoNotDimdesktop
-
-This setting is available only on Windows 8.1 RT devices.
+- NotifyAppChangesDoNotDimDesktop
+- $null (blank): The setting isn't configured. This is the default value.
 
 ```yaml
 Type: CAUserAccountControlStatusEntry
@@ -1401,13 +1463,16 @@ Accept wildcard characters: False
 ```
 
 ### -WLANEnabled
-The WLANEnabled parameter specifies whether Wi-Fi is enabled devices. Valid values for this parameter are:
+This setting is available only in PowerShell.
 
-- $true: Wi-Fi is enabled.
-- $false: Wi-Fi is disabled.
-- $null (blank): The setting isn't configured. This is the default value.
+This setting is supported on the following types of devices:
 
-This setting is available only on Microsoft Windows Phone 8.1 devices.
+- Windows Arm64 <!---Windows Phone 8.1--->
+
+The WLANEnabled parameter specifies whether Wi-Fi is enabled on supported devices. Valid values are:
+
+- $true: Wi-Fi is enabled. This is the default value.
+- $false: Wi-Fi is disabled.
 
 ```yaml
 Type: Boolean
@@ -1423,11 +1488,16 @@ Accept wildcard characters: False
 ```
 
 ### -WorkFoldersSyncUrl
-The WorkFoldersSyncUrl parameter specifies the URL that's used to synchronize company data on devices.
+This setting is available only in PowerShell.
 
-Valid input for this parameter a URL. For example, `https://workfolders.contoso.com`.
+This setting is supported on the following types of devices:
 
-This setting is available only on Windows 8.1 RT devices.
+- Windows Arm64 <!---Windows 8.1 RT--->
+
+The WorkFoldersSyncUrl parameter specifies the Work Folders URL on a Windows Server that's used to synchronize company data on supported devices. Valid values are:
+
+- A URL. For example, `https://workfolders.contoso.com`.
+- $null (blank): The setting isn't configured. This is the default value.
 
 ```yaml
 Type: String
diff --git a/exchange/exchange-ps/exchange/New-DeviceConfigurationPolicy.md b/exchange/exchange-ps/exchange/New-DeviceConfigurationPolicy.md
index 67e19df788..8d75345366 100644
--- a/exchange/exchange-ps/exchange/New-DeviceConfigurationPolicy.md
+++ b/exchange/exchange-ps/exchange/New-DeviceConfigurationPolicy.md
@@ -14,7 +14,7 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is available only in Security & Compliance PowerShell. For more information, see [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell).
 
-Use the New-DeviceConfigurationPolicy cmdlet to create mobile device configuration policies in Basic Mobility and Security in Microsoft 365.
+Use the New-DeviceConfigurationPolicy cmdlet to create device configuration policies in Basic Mobility and Security. These policies also result from creating policies on the **Basic Mobility and Security** page with option **If a device doesn't meet the requirements above, then...** \> **Block access** selected.
 
 For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
 
@@ -31,14 +31,9 @@ New-DeviceConfigurationPolicy [-Name] <String>
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
 
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
-
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+In device configuration policies, devices that don't meet the access requirement settings in the policy are prompted to enroll in Basic Mobility and Security from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device configuration rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -49,13 +44,17 @@ To use this cmdlet in Security & Compliance PowerShell, you need to be assigned
 New-DeviceConfigurationPolicy -Name "Engineering Group"
 ```
 
-This example creates a new mobile device configuration policy named Engineering Group.
+This example creates a new device configuration policy named Engineering Group. After you create the policy, use the New-DeviceConfigurationRule cmdlet to create the associated device configuration rule.
 
 ## PARAMETERS
 
 ### -Name
 The Name parameter specifies a unique name for the policy. If the value contains spaces, enclose the value in double quotation marks.
 
+You can't change the name of the policy after you create it.
+
+The policy name (for example, Engineering Group) is used in the name value of the associated rule when you create it (for example, Engineering Group{xxx}).
+
 ```yaml
 Type: String
 Parameter Sets: (All)
@@ -110,6 +109,8 @@ The Enabled parameter specifies whether the policy is enabled. Valid values are:
 - $true: The policy is enabled. This is the default value.
 - $false: The policy is disabled.
 
+You can only disable and re-enable policies in PowerShell.
+
 ```yaml
 Type: Boolean
 Parameter Sets: (All)
diff --git a/exchange/exchange-ps/exchange/New-DeviceConfigurationRule.md b/exchange/exchange-ps/exchange/New-DeviceConfigurationRule.md
index e4505ceb8f..a69f030665 100644
--- a/exchange/exchange-ps/exchange/New-DeviceConfigurationRule.md
+++ b/exchange/exchange-ps/exchange/New-DeviceConfigurationRule.md
@@ -102,7 +102,7 @@ This example creates a new mobile device configuration rule with the following s
 ## PARAMETERS
 
 ### -Policy
-The Policy parameter specifies the mobile device configuration policy that this rule is associated with. You can use any value that uniquely identifies the policy. For example:
+The Policy parameter specifies the device configuration policy that this rule is associated with. You can use any value that uniquely identifies the policy. For example:
 
 - Name
 - Distinguished name (DN)
@@ -122,9 +122,12 @@ Accept wildcard characters: False
 ```
 
 ### -TargetGroups
-The TargetGroups parameter specifies the security groups that this rule applies to. This parameter uses the GUID value of the group. To find this GUID value, run the command Get-Group | Format-Table Name,GUID.
+The TargetGroups parameter specifies the security groups that this rule applies to. This parameter uses one or more GUID values to identify the groups:
 
-You can specify multiple groups separated by commas.
+- The value `00000000-0000-0000-0000-000000000000` means the rule isn't assigned to any security groups.
+- Use the output of the **Get-MgGroup** cmdlet in Microsoft Graph PowerShell to find the display name and the associated GUID values of available security groups (Microsoft 365 Groups with the _GroupTypes_ value `Unified` aren't allowed).
+
+You can specify multiple security group GUID values separated by commas.
 
 ```yaml
 Type: MultiValuedProperty
diff --git a/exchange/exchange-ps/exchange/Remove-DeviceConditionalAccessPolicy.md b/exchange/exchange-ps/exchange/Remove-DeviceConditionalAccessPolicy.md
index 12423d67fd..5d4cdc6472 100644
--- a/exchange/exchange-ps/exchange/Remove-DeviceConditionalAccessPolicy.md
+++ b/exchange/exchange-ps/exchange/Remove-DeviceConditionalAccessPolicy.md
@@ -14,7 +14,7 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is available only in Security & Compliance PowerShell. For more information, see [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell).
 
-Use the Remove-DeviceConditionalAccessPolicy cmdlet to remove mobile device conditional access policies from Basic Mobility and Security in Microsoft 365.
+Use the Remove-DeviceConditionalAccessPolicy cmdlets to remove device conditional access policies in Basic Mobility and Security. These policies were created by using the New-DeviceConditionalAccessPolicy cmdlet or on the **Basic Mobility and Security** page with option **If a device doesn't meet the requirements above, then...** \> **Block access** selected.
 
 For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
 
@@ -28,14 +28,14 @@ Remove-DeviceConditionalAccessPolicy [-Identity] <PolicyIdParameter>
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
 
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
+In device conditional access policies, devices that don't meet the access requirement settings in the policy are prevented from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device conditional access rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+> [!TIP]
+> When you use this cmdlet to remove a device policy, the corresponding device rule is also marked for deletion and removed after a few minutes.
+>
+> You can remove the last remaining device policy in your organization, but the associated device rule isn't removed nor is it removable. For more information, see [Remove-DeviceConditionalAccessRule](https://learn.microsoft.com/powershell/module/exchange/remove-deviceconditionalaccessrule).
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -46,12 +46,12 @@ To use this cmdlet in Security & Compliance PowerShell, you need to be assigned
 Remove-DeviceConditionalAccessPolicy -Identity "Human Resources"
 ```
 
-This example removes the mobile device conditional access policy named Human Resources.
+This example removes the device conditional access policy named Human Resources.
 
 ## PARAMETERS
 
 ### -Identity
-The Identity parameter specifies the mobile device conditional access policy that you want to remove. You can use any value that uniquely identifies the policy. For example:
+The Identity parameter specifies the device conditional access policy that you want to remove. You can use any value that uniquely identifies the policy. For example:
 
 - Name
 - Distinguished name (DN)
diff --git a/exchange/exchange-ps/exchange/Remove-DeviceConditionalAccessRule.md b/exchange/exchange-ps/exchange/Remove-DeviceConditionalAccessRule.md
index 08e72f3b32..69eb720066 100644
--- a/exchange/exchange-ps/exchange/Remove-DeviceConditionalAccessRule.md
+++ b/exchange/exchange-ps/exchange/Remove-DeviceConditionalAccessRule.md
@@ -14,7 +14,7 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is available only in Security & Compliance PowerShell. For more information, see [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell).
 
-Use the Remove-DeviceConditionalAccessRule cmdlet to remove mobile device conditional access rules from Basic Mobility and Security in Microsoft 365.
+Use the Remove-DeviceConditionalAccessRule cmdlet to remove device conditional access rules from Basic Mobility and Security in Microsoft 365.
 
 For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
 
@@ -28,14 +28,12 @@ Remove-DeviceConditionalAccessRule [-Identity] <PolicyIdParameter>
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
 
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
+In device conditional access policies, devices that don't meet the access requirement settings in the policy are prevented from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device conditional access rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+> [!TIP]
+> You can't remove the last remaining device rule in your organization. Regardless of how you tried to remove it (on the **Basic Mobility and Security** page, by removing the associated device policy first, or by removing the device rule directly), the _Mode_ value of the last device rule remains in the `PendingDeletion` state. To complete the deletion of the rule, create one or more policies (device policies and associated device rules) on the **Basic Mobility and Security** page or in PowerShell.
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -43,15 +41,17 @@ To use this cmdlet in Security & Compliance PowerShell, you need to be assigned
 
 ### Example 1
 ```powershell
-Remove-DeviceConditionalAccessRule "Secure Email{914f151c-394b-4da9-9422-f5a2f65dec30}"
+Remove-DeviceConditionalAccessRule "Management Group{394b}"
 ```
 
-This example removes the mobile device conditional access rule named Secure Email{914f151c-394b-4da9-9422-f5a2f65dec30}.
+This example removes the device conditional access rule named Management Group{394b} without removing the associated device conditional access policy named Management Group (you need to manually remove the policy).
 
 ## PARAMETERS
 
 ### -Identity
-The Identity parameter specifies the mobile device conditional access rule that you want to view. The name of the rule uses the syntax `<Mobile device conditional access policy name>{<GUID value>}`. For example, `Secure Email{914f151c-394b-4da9-9422-f5a2f65dec30}`. You can find the name value by running the command: Get-DeviceConditionalAccessRule | Format-List Name.
+The Identity parameter specifies the device conditional access rule that you want to remove. The name of the rule uses the syntax `<AssociatedDeviceConditionalAccessPolicyName>{<xxx>}`. For example, `Management Group{394b}`.
+
+You can find the name value by running the command: `Get-DeviceConditionalAccessRule | Format-List Name`.
 
 ```yaml
 Type: PolicyIdParameter
diff --git a/exchange/exchange-ps/exchange/Remove-DeviceConfigurationPolicy.md b/exchange/exchange-ps/exchange/Remove-DeviceConfigurationPolicy.md
index 913547d5a2..a5e7f3c662 100644
--- a/exchange/exchange-ps/exchange/Remove-DeviceConfigurationPolicy.md
+++ b/exchange/exchange-ps/exchange/Remove-DeviceConfigurationPolicy.md
@@ -14,7 +14,7 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is available only in Security & Compliance PowerShell. For more information, see [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell).
 
-Use the Remove-DeviceConfigurationPolicy cmdlet to remove mobile device configuration policies from Basic Mobility and Security in Microsoft 365.
+Use the Remove-DeviceConfigurationPolicy cmdlets to remove device configuration policies in Basic Mobility and Security. These policies were created by using the New-DeviceConfigurationPolicy cmdlet or on the **Basic Mobility and Security** page with option **If a device doesn't meet the requirements above, then...** \> **Allow access (device enrollment is required)** selected.
 
 For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
 
@@ -28,14 +28,12 @@ Remove-DeviceConfigurationPolicy [-Identity] <PolicyIdParameter>
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
 
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
+In device configuration policies, devices that don't meet the access requirement settings in the policy are prompted to enroll in Basic Mobility and Security from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device configuration rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+> [!TIP]
+> When you use this cmdlet to remove a device policy, the corresponding device rule is also marked for deletion and removed after a few minutes, but you can't remove the last remaining device rule in the organization (the associated rule remains with the Mode property perpetually in the PendingDeletion state).
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -46,12 +44,12 @@ To use this cmdlet in Security & Compliance PowerShell, you need to be assigned
 Remove-DeviceConfigurationPolicy -Identity "Engineering Group"
 ```
 
-This example removes the mobile device configuration policy named Engineering Group.
+This example removes the device configuration policy named Engineering Group.
 
 ## PARAMETERS
 
 ### -Identity
-The Identity parameter specifies the mobile device configuration policy that you want to remove. You can use any value that uniquely identifies the policy. For example:
+The Identity parameter specifies the device configuration policy that you want to remove. You can use any value that uniquely identifies the policy. For example:
 
 - Name
 - Distinguished name (DN)
diff --git a/exchange/exchange-ps/exchange/Set-DeviceConditionalAccessPolicy.md b/exchange/exchange-ps/exchange/Set-DeviceConditionalAccessPolicy.md
index 0bbba58e9e..287d118366 100644
--- a/exchange/exchange-ps/exchange/Set-DeviceConditionalAccessPolicy.md
+++ b/exchange/exchange-ps/exchange/Set-DeviceConditionalAccessPolicy.md
@@ -14,7 +14,7 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is available only in Security & Compliance PowerShell. For more information, see [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell).
 
-Use the Set-DeviceConditionalAccessPolicy cmdlet to modify mobile device conditional access policies in Basic Mobility and Security in Microsoft 365.
+Use the Set-DeviceConditionalAccessPolicy cmdlet to modify device conditional access policies in Basic Mobility and Security. These policies were created by using the New-DeviceConditionalAccessPolicy cmdlet or on the **Basic Mobility and Security** page with option **If a device doesn't meet the requirements above, then...** \> **Block access** selected.
 
 For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
 
@@ -22,8 +22,7 @@ For information about the parameter sets in the Syntax section below, see [Excha
 
 ### RetryDistribution
 ```
-Set-DeviceConditionalAccessPolicy [-Identity] <PolicyIdParameter>
- [-RetryDistribution]
+Set-DeviceConditionalAccessPolicy [-Identity] <PolicyIdParameter> [-RetryDistribution]
  [-Confirm]
  [-WhatIf]
  [<CommonParameters>]
@@ -41,14 +40,9 @@ Set-DeviceConditionalAccessPolicy [-Identity] <PolicyIdParameter>
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
-
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
 
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+In device conditional access policies, devices that don't meet the access requirement settings in the policy are prevented from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device conditional access rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -59,12 +53,12 @@ To use this cmdlet in Security & Compliance PowerShell, you need to be assigned
 Set-DeviceConditionalAccessPolicy -Identity Executives -Enabled $false
 ```
 
-This example disables the existing mobile device conditional access policy named Executives.
+This example disables the existing device conditional access policy named Executives.
 
 ## PARAMETERS
 
 ### -Identity
-The Identity parameter specifies the mobile device conditional access policy that you want to modify. You can use any value that uniquely identifies the policy. For example:
+The Identity parameter specifies the device conditional access policy that you want to modify. You can use any value that uniquely identifies the policy. For example:
 
 - Name
 - Distinguished name (DN)
@@ -140,6 +134,8 @@ The Enabled parameter specifies whether the policy is enabled. Valid values are:
 - $true: The policy is enabled. This is the default value.
 - $false: The policy is disabled.
 
+You can only disable and re-enable policies in PowerShell.
+
 ```yaml
 Type: Boolean
 Parameter Sets: Identity
diff --git a/exchange/exchange-ps/exchange/Set-DeviceConditionalAccessRule.md b/exchange/exchange-ps/exchange/Set-DeviceConditionalAccessRule.md
index f9e793ed4e..cce1388242 100644
--- a/exchange/exchange-ps/exchange/Set-DeviceConditionalAccessRule.md
+++ b/exchange/exchange-ps/exchange/Set-DeviceConditionalAccessRule.md
@@ -77,14 +77,9 @@ Set-DeviceConditionalAccessRule [-Identity] <ComplianceRuleIdParameter> -TargetG
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
 
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
-
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+In device conditional access policies, devices that don't meet the access requirement settings in the policy are prevented from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device conditional access rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -100,7 +95,7 @@ This example modifies the specified mobile device conditional access rule to blo
 ## PARAMETERS
 
 ### -Identity
-The Identity parameter specifies the mobile device conditional access rule that you want to modify. The name of the rule uses the syntax `<Mobile device conditional access policy name>{<GUID value>}`. For example, `Secure Email{914f151c-394b-4da9-9422-f5a2f65dec30}`. You can find the name value by running the command: Get-DeviceConfigurationRule | Format-List Name.
+The Identity parameter specifies the device conditional access rule that you want to view. The name of the rule uses the syntax `<AssociatedDeviceConditionalAccessPolicyName>{<xxx>}`. For example, `Management Group{394b}`.
 
 ```yaml
 Type: ComplianceRuleIdParameter
@@ -116,9 +111,12 @@ Accept wildcard characters: False
 ```
 
 ### -TargetGroups
-The TargetGroups parameter specifies the security groups that this rule applies to. This parameter uses the GUID value of the group. To find this GUID value, run the command Get-Group | Format-Table Name,GUID.
+The TargetGroups parameter specifies the security groups that this rule applies to. This parameter uses one or more GUID values to identify the groups:
+
+- The value `00000000-0000-0000-0000-000000000000` means the rule isn't assigned to any security groups.
+- Use the output of the **Get-MgGroup** cmdlet in Microsoft Graph PowerShell to find the display name and the associated GUID values of available security groups (Microsoft 365 Groups with the _GroupTypes_ value `Unified` aren't allowed).
 
-You can specify multiple groups separated by commas.
+You can specify multiple security group GUID values separated by commas.
 
 ```yaml
 Type: MultiValuedProperty
diff --git a/exchange/exchange-ps/exchange/Set-DeviceConfigurationPolicy.md b/exchange/exchange-ps/exchange/Set-DeviceConfigurationPolicy.md
index ed19ba795f..6a8c53e047 100644
--- a/exchange/exchange-ps/exchange/Set-DeviceConfigurationPolicy.md
+++ b/exchange/exchange-ps/exchange/Set-DeviceConfigurationPolicy.md
@@ -14,7 +14,7 @@ ms.reviewer:
 ## SYNOPSIS
 This cmdlet is available only in Security & Compliance PowerShell. For more information, see [Security & Compliance PowerShell](https://learn.microsoft.com/powershell/exchange/scc-powershell).
 
-Use the Set-DeviceConfigurationPolicy cmdlet to modify mobile device configuration policies in Basic Mobility and Security in Microsoft 365.
+Use the Set-DeviceConfigurationPolicy cmdlets to modify device configuration policies in Basic Mobility and Security. These policies were created by using the New-DeviceConfigurationPolicy cmdlet or on the **Basic Mobility and Security** page with option **If a device doesn't meet the requirements above, then...** \> **Allow access (device enrollment is required)** selected.
 
 For information about the parameter sets in the Syntax section below, see [Exchange cmdlet syntax](https://learn.microsoft.com/powershell/exchange/exchange-cmdlet-syntax).
 
@@ -41,14 +41,9 @@ Set-DeviceConfigurationPolicy [-Identity] <PolicyIdParameter>
 ```
 
 ## DESCRIPTION
-The cmdlets in Basic Mobility and Security are described in the following list:
+In PowerShell, a policy in Basic Mobility and Security contains a device policy (a device conditional access policy or a device configuration policy) and an associated device rule (a device conditional access rule or a device configuration rule). For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
 
-- DeviceTenantPolicy and DeviceTenantRule cmdlets: A policy that defines whether to block or allow mobile device access to Exchange Online email by unsupported devices that use Exchange ActiveSync only. This setting applies to all users in your organization. Both allow and block scenarios allow reporting for unsupported devices, and you can specify exceptions to the policy based on security groups.
-- DeviceConditionalAccessPolicy and DeviceConditionalAccessRule cmdlets: Policies that control mobile device access to Microsoft 365 for supported devices. These policies are applied to security groups. Unsupported devices are not allowed to enroll in Basic Mobility and Security.
-- DeviceConfigurationPolicy and DeviceConfigurationRule cmdlets: Policies that control mobile device settings for supported devices. These policies are applied to security groups.
-- Get-DevicePolicy: Returns all Basic Mobility and Security policies regardless of type (DeviceTenantPolicy, DeviceConditionalAccessPolicy or DeviceConfigurationPolicy).
-
-For more information about Basic Mobility and Security, see [Overview of Basic Mobility and Security for Microsoft 365](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/overview).
+In device configuration policies, devices that don't meet the access requirement settings in the policy are prompted to enroll in Basic Mobility and Security from accessing Microsoft 365 resources in supported apps. You specify the policy settings in the associated device configuration rule. For more information, see [Access control for Microsoft 365 email and documents](https://learn.microsoft.com/microsoft-365/admin/basic-mobility-security/capabilities#access-control-for-microsoft-365-email-and-documents).
 
 To use this cmdlet in Security & Compliance PowerShell, you need to be assigned permissions. For more information, see [Permissions in the Microsoft Defender portal](https://learn.microsoft.com/defender-office-365/mdo-portal-permissions) or [Permissions in the Microsoft Purview compliance portal](https://learn.microsoft.com/purview/microsoft-365-compliance-center-permissions).
 
@@ -59,12 +54,12 @@ To use this cmdlet in Security & Compliance PowerShell, you need to be assigned
 Set-DeviceConfigurationPolicy -Identity "Engineering Group" -Enabled $false
 ```
 
-This example disables the mobile device configuration policy named Engineering Group.
+This example disables the device configuration policy named Engineering Group.
 
 ## PARAMETERS
 
 ### -Identity
-The Identity parameter specifies the mobile device configuration policy that you want to modify. You can use any value that uniquely identifies the policy. For example:
+The Identity parameter specifies the device configuration policy that you want to modify. You can use any value that uniquely identifies the policy. For example:
 
 - Name
 - Distinguished name (DN)
@@ -140,6 +135,8 @@ The Enabled parameter specifies whether the policy is enabled. Valid values are:
 - $true: The policy is enabled. This is the default value.
 - $false: The policy is disabled.
 
+You can only disable and re-enable policies in PowerShell.
+
 ```yaml
 Type: Boolean
 Parameter Sets: Identity
diff --git a/exchange/exchange-ps/exchange/Set-DeviceConfigurationRule.md b/exchange/exchange-ps/exchange/Set-DeviceConfigurationRule.md
index 3ea511f71e..2d9bcd0c02 100644
--- a/exchange/exchange-ps/exchange/Set-DeviceConfigurationRule.md
+++ b/exchange/exchange-ps/exchange/Set-DeviceConfigurationRule.md
@@ -115,9 +115,12 @@ Accept wildcard characters: False
 ```
 
 ### -TargetGroups
-The TargetGroups parameter specifies the security groups that this rule applies to. This parameter uses the GUID value of the group. To find this GUID value, run the command Get-Group | Format-Table Name,GUID.
+The TargetGroups parameter specifies the security groups that this rule applies to. This parameter uses one or more GUID values to identify the groups:
 
-You can specify multiple groups separated by commas.
+- The value `00000000-0000-0000-0000-000000000000` means the rule isn't assigned to any security groups.
+- Use the output of the **Get-MgGroup** cmdlet in Microsoft Graph PowerShell to find the display name and the associated GUID values of available security groups (Microsoft 365 Groups with the _GroupTypes_ value `Unified` aren't allowed).
+
+You can specify multiple security group GUID values separated by commas.
 
 ```yaml
 Type: MultiValuedProperty
