Surface policy management (ADMX) overview

  • Applies to: Windows 11, Windows 10

Surface ADMX policy files give IT admins granular control over Surface-specific device settings through Mobile Device Management (MDM) solutions such as Microsoft Intune or traditional Group Policy. These administrative template files define policy settings that aren't included in the standard Windows ADMX packages, enabling centralized management of Surface diagnostic data collection and integrated privacy screen behavior.

By importing Surface ADMX policies into your management solution, you can enforce consistent device configurations across your Surface fleet without requiring manual intervention on each device.

Tip

For background on how ADMX-backed policies work in Windows, see Understanding ADMX policies.

Prerequisites

Before deploying Surface ADMX policies, ensure you have:

  • Devices running Windows 10 (version 2004 or later) or Windows 11.
  • One of the following management solutions:
    • An MDM solution that supports ADMX-backed policies (for example, Microsoft Intune).
    • Active Directory Group Policy infrastructure (for domain-joined devices).
  • Administrative access to your management console to create and assign policies.

Download Surface ADMX policy files

  1. Download the latest Surface ADMX Policy Package.
  2. Extract the .zip file to a local folder. The package contains:
    • Surface.admx — the policy definition file.
    • Surface.adml — the localization file that provides display strings for each policy setting.

Note

The Surface ADMX package currently includes only an en-US version of the .adml localization file. Other language versions aren't available at this time.

Import Surface ADMX policies into an MDM solution (Intune)

If your organization uses Microsoft Intune for device management, you can import Surface ADMX policies using the custom ADMX upload feature. For other MDM solutions, refer to the respective provider's documentation for enabling ADMX-backed policies.

To import ADMX into Intune

  1. Sign in to the Microsoft Intune admin center.
  2. Go to Devices > Configuration > Import ADMX and select Import.
  3. Upload the Surface.admx file, then upload the corresponding Surface.adml file in the same session.
  4. Wait for the import status to show Available. This may take a few minutes.
  5. Go to Devices > Configuration > Create > New policy.
  6. Select Windows 10 and later as the platform and choose Templates > Imported Administrative templates (Preview) as the profile type.
  7. Name your profile, then configure the imported Surface policy settings as needed.
  8. Assign the profile to the appropriate device groups.

Important

The .adml file must be uploaded in the same session as the .admx file. Uploading them separately can cause import failures or missing policy descriptions in the Intune portal.

Note

For full details on the ADMX import workflow, see Import custom ADMX and ADML administrative templates into Intune.

Manage Surface policies with Group Policy

If your organization uses Active Directory Group Policy to manage domain-joined devices, you can use the Surface ADMX templates directly in the Group Policy Editor.

To add Surface ADMX templates to Group Policy

  1. Download and extract the Surface ADMX Policy Package.
  2. Copy Surface.admx to the PolicyDefinitions folder:
    • Central store (recommended for domain environments): \\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\
    • Local machine: C:\Windows\PolicyDefinitions\
  3. Copy Surface.adml to the en-US subfolder within the PolicyDefinitions folder:
    • Central store: \\<domain>\SYSVOL\<domain>\Policies\PolicyDefinitions\en-US\
    • Local machine: C:\Windows\PolicyDefinitions\en-US\
  4. Open the Group Policy Management Console (GPMC) or Local Group Policy Editor (gpedit.msc).
  5. Navigate to Computer Configuration > Administrative Templates > Surface.
  6. Configure the desired policy settings and link the GPO to the appropriate organizational unit (OU).

Note

Group Policy settings apply to domain-joined devices. For Microsoft Entra joined or Microsoft Entra hybrid joined devices managed with Intune, use the MDM import method described above.

Available policy categories

The Surface ADMX package includes policies organized into the following categories:

Category Policies Description
Surface Diagnostic Data Surface Diagnostic Data Setting, End User Surface Diagnostic Data Setting Management Control Surface-specific diagnostic data collection and whether end users can override the configured settings.
Surface Integrated Privacy Screen Surface Display Privacy Setting Manage the integrated privacy screen on supported Surface for Business devices.

Registry reference

All Surface ADMX policies write to the following registry path:

Registry path: HKLM\Software\Policies\Surface

Value name Type Data Description
SurfaceDiagnosticDataSetting REG_DWORD 0 = Disabled, 1 = Required data Controls Surface diagnostic data collection
EndUserSurfaceDiagnosticDataSettingManagement REG_DWORD 0 = Disabled, 1 = Enabled Controls whether users can override the diagnostic data policy
SurfaceIntegratedPrivacyScreenSetting REG_DWORD 0 = Off by default, 1 = On by default, 2 = Force On Controls the integrated privacy screen behavior

For detailed information about each value, see the individual policy pages linked above.

Related content

  • Last updated on