Merge pull request #217215 from MicrosoftGuyJFlo/IdentiyProtectionDeploymentPlan

[Azure AD] Identity Protection - Deployment Plan

Author: v-dirichards

articles/active-directory/conditional-access/concept-conditional-access-policy-common.md

@@ -71,6 +71,7 @@ Organizations can select individual policy templates and:
 - [Block access by location](howto-conditional-access-policy-location.md)
 - [Block access except specific apps](howto-conditional-access-policy-block-access.md)
 
+## User exclusions
 [!INCLUDE [active-directory-policy-exclusions](../../../includes/active-directory-policy-exclude-user.md)]
 
 ## Next steps

articles/active-directory/conditional-access/howto-conditional-access-policy-admin-mfa.md

@@ -38,6 +38,7 @@ Microsoft recommends you require MFA on the following roles at a minimum, based
 
 Organizations can choose to include or exclude roles as they see fit.
 
+## User exclusions
 [!INCLUDE [active-directory-policy-exclusions](../../../includes/active-directory-policy-exclude-user.md)]
 
 [!INCLUDE [active-directory-policy-deploy-template](../../../includes/active-directory-policy-deploy-template.md)]

articles/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa.md

@@ -23,6 +23,7 @@ As Alex Weinert, the Directory of Identity Security at Microsoft, mentions in hi
 
 The guidance in this article will help your organization create an MFA policy for your environment.
 
+## User exclusions
 [!INCLUDE [active-directory-policy-exclusions](../../../includes/active-directory-policy-exclude-user.md)]
 
 ## Application exclusions

articles/active-directory/conditional-access/howto-conditional-access-policy-azure-management.md

@@ -31,6 +31,7 @@ These tools can provide highly privileged access to resources that can make the
 
 To protect these privileged resources, Microsoft recommends requiring multifactor authentication for any user accessing these resources. In Azure AD, these tools are grouped together in a suite called [Microsoft Azure Management](concept-conditional-access-cloud-apps.md#microsoft-azure-management). For Azure Government, this suite should be the Azure Government Cloud Management API app. 
 
+## User exclusions
 [!INCLUDE [active-directory-policy-exclusions](../../../includes/active-directory-policy-exclude-user.md)]
 
 [!INCLUDE [active-directory-policy-deploy-template](../../../includes/active-directory-policy-deploy-template.md)]

articles/active-directory/conditional-access/howto-conditional-access-policy-block-access.md

@@ -24,6 +24,7 @@ For organizations with a conservative cloud migration approach, the block all po
 
 Policies like these can have unintended side effects. Proper testing and validation are vital before enabling. Administrators should utilize tools such as [Conditional Access report-only mode](concept-conditional-access-report-only.md) and [the What If tool in Conditional Access](what-if-tool.md) when making changes.
 
+## User exclusions
 [!INCLUDE [active-directory-policy-exclusions](../../../includes/active-directory-policy-exclude-user.md)]
 
 ## Create a Conditional Access policy

articles/active-directory/conditional-access/howto-conditional-access-policy-compliant-device-admin.md

@@ -42,6 +42,7 @@ Microsoft recommends you require enable this policy for the following roles at a
 
 Organizations can choose to include or exclude roles as they see fit.
 
+## User exclusions
 [!INCLUDE [active-directory-policy-exclusions](../../../includes/active-directory-policy-exclude-user.md)]
 
 [!INCLUDE [active-directory-policy-deploy-template](../../../includes/active-directory-policy-deploy-template.md)]

articles/active-directory/conditional-access/howto-conditional-access-policy-compliant-device.md

@@ -28,6 +28,7 @@ Policy compliance information is sent to Azure AD where Conditional Access decid
 
 Requiring a hybrid Azure AD joined device is dependent on your devices already being hybrid Azure AD joined. For more information, see the article [Configure hybrid Azure AD join](../devices/howto-hybrid-azure-ad-join.md).
 
+## User exclusions
 [!INCLUDE [active-directory-policy-exclusions](../../../includes/active-directory-policy-exclude-user.md)]
 
 [!INCLUDE [active-directory-policy-deploy-template](../../../includes/active-directory-policy-deploy-template.md)]

articles/active-directory/conditional-access/howto-policy-app-enforced-restriction.md

@@ -19,6 +19,7 @@ ms.collection: M365-identity-device-management
 
 Block or limit access to SharePoint, OneDrive, and Exchange content from unmanaged devices.
 
+## User exclusions
 [!INCLUDE [active-directory-policy-exclusions](../../../includes/active-directory-policy-exclude-user.md)]
 
 [!INCLUDE [active-directory-policy-deploy-template](../../../includes/active-directory-policy-deploy-template.md)]

articles/active-directory/conditional-access/howto-policy-guest-mfa.md

@@ -19,6 +19,7 @@ ms.collection: M365-identity-device-management
 
 Require guest users perform multifactor authentication when accessing your organization's resources.
 
+## User exclusions
 [!INCLUDE [active-directory-policy-exclusions](../../../includes/active-directory-policy-exclude-user.md)]
 
 [!INCLUDE [active-directory-policy-deploy-template](../../../includes/active-directory-policy-deploy-template.md)]

articles/active-directory/conditional-access/howto-policy-persistent-browser-session.md

@@ -19,6 +19,7 @@ ms.collection: M365-identity-device-management
 
 Protect user access on unmanaged devices by preventing browser sessions from remaining signed in after the browser is closed and setting a sign-in frequency to 1 hour.
 
+## User exclusions
 [!INCLUDE [active-directory-policy-exclusions](../../../includes/active-directory-policy-exclude-user.md)]
 
 [!INCLUDE [active-directory-policy-deploy-template](../../../includes/active-directory-policy-deploy-template.md)]