mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-09 11:57:23 +00:00
archive wip content and cleanup
This commit is contained in:
Aaron Czechowski
parent
71f811ca83
commit
23475e66fa
@ -5077,7 +5077,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/app-behavior-with-wip.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/app-behavior-with-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/app-behavior-with-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -5727,7 +5727,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/collect-wip-audit-event-logs.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/collect-wip-audit-event-logs",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -6037,7 +6037,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/create-and-verify-an-efs-dra-certificate.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -6052,7 +6052,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/create-edp-policy-using-sccm.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -6097,7 +6097,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/create-wip-policy-using-sccm.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -6547,12 +6547,12 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/enlightened-microsoft-apps-and-edp.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/enlightened-microsoft-apps-and-wip.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -7917,12 +7917,12 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/guidance-and-best-practices-edp.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/guidance-and-best-practices-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/guidance-and-best-practices-wip.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/guidance-and-best-practices-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -8177,7 +8177,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/limitations-with-wip.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/limitations-with-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/limitations-with-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -8282,7 +8282,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/mandatory-settings-for-wip.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/mandatory-settings-for-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/mandatory-settings-for-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -8662,12 +8662,12 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/overview-create-edp-policy.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/overview-create-wip-policy",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/overview-create-wip-policy",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/overview-create-wip-policy.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/overview-create-wip-policy",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/overview-create-wip-policy",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -8837,12 +8837,12 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/protect-enterprise-data-using-edp.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/protect-enterprise-data-using-wip.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -8867,7 +8867,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/recommended-network-definitions-for-wip.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -9232,12 +9232,12 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/testing-scenarios-for-edp.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/testing-scenarios-for-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/testing-scenarios-for-wip.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/testing-scenarios-for-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/testing-scenarios-for-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -9522,7 +9522,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/using-owa-with-wip.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/using-owa-with-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/using-owa-with-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -9757,12 +9757,12 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/wip-app-enterprise-context.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/wip-app-enterprise-context",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/wip-app-enterprise-context",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/keep-secure/wip-enterprise-overview.md",
|
||||
"redirect_url": "/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -12377,22 +12377,22 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/app-behavior-with-wip.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/app-behavior-with-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/app-behavior-with-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/collect-wip-audit-event-logs.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/collect-wip-audit-event-logs",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -12402,7 +12402,7 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-intune-azure.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -12417,12 +12417,12 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/create-wip-policy-using-sccm.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -12432,57 +12432,57 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/guidance-and-best-practices-wip.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/guidance-and-best-practices-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/limitations-with-wip.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/limitations-with-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/limitations-with-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/mandatory-settings-for-wip.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/mandatory-settings-for-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/overview-create-wip-policy-sccm",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/overview-create-wip-policy.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/overview-create-wip-policy",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/overview-create-wip-policy",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/recommended-network-definitions-for-wip.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/testing-scenarios-for-wip.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/testing-scenarios-for-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/using-owa-with-wip.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/using-owa-with-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/using-owa-with-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-information-protection/wip-app-enterprise-context.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/wip-app-enterprise-context",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
|
||||
@ -852,27 +852,27 @@
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/how-wip-works-with-labels.md",
|
||||
"redirect_url": "/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/guidance-and-best-practices-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
@ -9184,6 +9184,106 @@
|
||||
"source_path": "windows/security/identity-protection/hello-for-business/hello-feature-dual-enrollment.md",
|
||||
"redirect_url": "/windows/security/identity-protection/hello-for-business/dual-enrollment",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/app-behavior-with-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/collect-wip-audit-event-logs",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/guidance-and-best-practices-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/how-to-disable-wip.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/how-to-disable-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/limitations-with-wip.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/limitations-with-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/mandatory-settings-for-wip.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/mandatory-settings-for-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/overview-create-wip-policy-configmgr",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/overview-create-wip-policy.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/overview-create-wip-policy",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/recommended-network-definitions-for-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/testing-scenarios-for-wip.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/testing-scenarios-for-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/using-owa-with-wip.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/using-owa-with-wip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/wip-app-enterprise-context",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/information-protection/windows-information-protection/wip-learning.md",
|
||||
"redirect_url": "/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/wip-learning",
|
||||
"redirect_document_id": false
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -42,7 +42,7 @@
|
||||
},
|
||||
{
|
||||
"source_path":"windows/whats-new/edp-whats-new-overview.md",
|
||||
"redirect_url":"/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip",
|
||||
"redirect_url":"/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip",
|
||||
"redirect_document_id":false
|
||||
},
|
||||
{
|
||||
|
||||
@ -9,7 +9,7 @@ ms.date: 07/08/2024
|
||||
|
||||
Windows Information Protection (WIP) is a lightweight solution for managing company data access and security on personal devices. WIP support is built into Windows.
|
||||
|
||||
[!INCLUDE [Deprecate Windows Information Protection](../security/information-protection/windows-information-protection/includes/wip-deprecation.md)]
|
||||
[!INCLUDE [Deprecate Windows Information Protection](mdm/includes/wip-deprecation.md)]
|
||||
|
||||
## Integration with Microsoft Entra ID
|
||||
|
||||
@ -23,7 +23,7 @@ Regular non administrator users can enroll to MAM.
|
||||
|
||||
## Understand Windows Information Protection
|
||||
|
||||
WIP takes advantage of [built-in policies](/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip) to protect company data on the device. To protect user-owned applications on personal devices, WPJ limits enforcement of WIP policies to [enlightened apps](/windows/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip) and WIP-aware apps. Enlightened apps can differentiate between corporate and personal data, correctly determining which to protect based on WIP policies. WIP-aware apps indicate to Windows that they don't handle personal data, and therefore, it's safe for Windows to protect data on their behalf.
|
||||
WIP takes advantage of [built-in policies](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip) to protect company data on the device. To protect user-owned applications on personal devices, WPJ limits enforcement of WIP policies to [enlightened apps](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip) and WIP-aware apps. Enlightened apps can differentiate between corporate and personal data, correctly determining which to protect based on WIP policies. WIP-aware apps indicate to Windows that they don't handle personal data, and therefore, it's safe for Windows to protect data on their behalf.
|
||||
|
||||
To make applications WIP-aware, app developers need to include the following data in the app resource file.
|
||||
|
||||
|
||||
@ -1,12 +1,13 @@
|
||||
---
|
||||
title: EnterpriseDataProtection CSP
|
||||
description: Learn how the EnterpriseDataProtection configuration service provider (CSP) configures Windows Information Protection (formerly, Enterprise Data Protection) settings.
|
||||
ms.assetid: E2D4467F-A154-4C00-9208-7798EF3E25B3
|
||||
ms.date: 08/09/2017
|
||||
---
|
||||
|
||||
# EnterpriseDataProtection CSP
|
||||
|
||||
[!INCLUDE [wip-deprecation](includes/wip-deprecation.md)]
|
||||
|
||||
The table below shows the applicability of Windows:
|
||||
|
||||
|Edition|Windows 10|Windows 11|
|
||||
@ -18,12 +19,7 @@ The table below shows the applicability of Windows:
|
||||
|Enterprise|Yes|Yes|
|
||||
|Education|Yes|Yes|
|
||||
|
||||
The EnterpriseDataProtection configuration service provider (CSP) is used to configure settings for Windows Information Protection (WIP), formerly known as Enterprise Data Protection. For more information about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip).
|
||||
|
||||
> [!NOTE]
|
||||
> Starting in July 2022, Microsoft is deprecating Windows Information Protection (WIP) and the APIs that support WIP. Microsoft will continue to support WIP on supported versions of Windows. New versions of Windows won't include new capabilities for WIP, and it won't be supported in future versions of Windows. For more information, see [Announcing sunset of Windows Information Protection](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/announcing-the-sunset-of-windows-information-protection-wip/ba-p/3579282).
|
||||
>
|
||||
> For your data protection needs, Microsoft recommends that you use [Microsoft Purview Information Protection](/microsoft-365/compliance/information-protection) and [Microsoft Purview Data Loss Prevention](/microsoft-365/compliance/dlp-learn-about-dlp). Purview simplifies the configuration set-up and provides an advanced set of capabilities.
|
||||
The EnterpriseDataProtection configuration service provider (CSP) is used to configure settings for Windows Information Protection (WIP), formerly known as Enterprise Data Protection. For more information about WIP, see [Protect your enterprise data using Windows Information Protection (WIP)](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip).
|
||||
|
||||
> [!NOTE]
|
||||
> To make Windows Information Protection functional, the AppLocker CSP and the network isolation-specific settings must also be configured. For more information, see [AppLocker CSP](applocker-csp.md) and NetworkIsolation policies in [Policy CSP](policy-configuration-service-provider.md).
|
||||
@ -32,8 +28,8 @@ While Windows Information Protection has no hard dependency on VPN, for best res
|
||||
|
||||
To learn more about Windows Information Protection, see the following articles:
|
||||
|
||||
- [Create a Windows Information Protection (WIP) policy](/windows/security/information-protection/windows-information-protection/overview-create-wip-policy)
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip)
|
||||
- [Create a Windows Information Protection (WIP) policy](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/overview-create-wip-policy)
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/guidance-and-best-practices-wip)
|
||||
|
||||
The following example shows the EnterpriseDataProtection CSP in tree format.
|
||||
|
||||
@ -52,13 +48,16 @@ EnterpriseDataProtection
|
||||
----Status
|
||||
```
|
||||
|
||||
<a href="" id="--device-vendor-msft-enterprisedataprotection"></a>**./Device/Vendor/MSFT/EnterpriseDataProtection**
|
||||
## <a href="" id="--device-vendor-msft-enterprisedataprotection"></a> `./Device/Vendor/MSFT/EnterpriseDataProtection`
|
||||
|
||||
The root node for the CSP.
|
||||
|
||||
<a href="" id="settings"></a>**Settings**
|
||||
### <a href="" id="settings"></a> Settings
|
||||
|
||||
The root node for the Windows Information Protection (WIP) configuration settings.
|
||||
|
||||
<a href="" id="settings-edpenforcementlevel"></a>**Settings/EDPEnforcementLevel**
|
||||
#### <a href="" id="settings-edpenforcementlevel"></a> Settings/EDPEnforcementLevel
|
||||
|
||||
Set the WIP enforcement level.
|
||||
|
||||
> [!NOTE]
|
||||
@ -66,15 +65,16 @@ Set the WIP enforcement level.
|
||||
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) – Off / No protection (decrypts previously protected data).
|
||||
- 1 – Silent mode (encrypt and audit only).
|
||||
- 2 – Allow override mode (encrypt, prompt and allow overrides, and audit).
|
||||
- 3 – Hides overrides (encrypt, prompt but hide overrides, and audit).
|
||||
- 0 (default) - Off / No protection (decrypts previously protected data).
|
||||
- 1 - Silent mode (encrypt and audit only).
|
||||
- 2 - Allow override mode (encrypt, prompt and allow overrides, and audit).
|
||||
- 3 - Hides overrides (encrypt, prompt but hide overrides, and audit).
|
||||
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is integer.
|
||||
|
||||
<a href="" id="settings-enterpriseprotecteddomainnames"></a>**Settings/EnterpriseProtectedDomainNames**
|
||||
A list of domains used by the enterprise for its user identities separated by pipes ("|"). The first domain in the list must be the primary enterprise ID, that is, the one representing the managing authority for Windows Information Protection. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. For example, the domains for all email accounts owned by the enterprise would be expected to appear in this list. Attempts to change this value will fail when the WIP cleanup is running.
|
||||
#### <a href="" id="settings-enterpriseprotecteddomainnames"></a> Settings/EnterpriseProtectedDomainNames
|
||||
|
||||
A list of domains used by the enterprise for its user identities separated by pipes (`|`). The first domain in the list must be the primary enterprise ID, that is, the one representing the managing authority for Windows Information Protection. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. For example, the domains for all email accounts owned by the enterprise would be expected to appear in this list. Attempts to change this value will fail when the WIP cleanup is running.
|
||||
|
||||
Changing the primary enterprise ID isn't supported and may cause unexpected behavior on the client.
|
||||
|
||||
@ -89,7 +89,8 @@ Here are the steps to create canonical domain names:
|
||||
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is string.
|
||||
|
||||
<a href="" id="settings-allowuserdecryption"></a>**Settings/AllowUserDecryption**
|
||||
#### <a href="" id="settings-allowuserdecryption"></a> Settings/AllowUserDecryption
|
||||
|
||||
Allows the user to decrypt files. If this is set to 0 (Not Allowed), then the user won't be able to remove protection from enterprise content through the operating system or the application user experiences.
|
||||
|
||||
> [!IMPORTANT]
|
||||
@ -97,17 +98,18 @@ Allows the user to decrypt files. If this is set to 0 (Not Allowed), then the us
|
||||
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 – Not allowed.
|
||||
- 1 (default) – Allowed.
|
||||
- 0 - Not allowed.
|
||||
- 1 (default) - Allowed.
|
||||
|
||||
Most restricted value is 0.
|
||||
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is integer.
|
||||
|
||||
<a href="" id="settings-datarecoverycertificate"></a>**Settings/DataRecoveryCertificate**
|
||||
#### <a href="" id="settings-datarecoverycertificate"></a> Settings/DataRecoveryCertificate
|
||||
|
||||
Specifies a recovery certificate that can be used for data recovery of encrypted files. This certificate is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through mobile device management (MDM) instead of Group Policy.
|
||||
|
||||
> [!Note]
|
||||
> [!NOTE]
|
||||
> If this policy and the corresponding Group Policy setting are both configured, the Group Policy setting is enforced.
|
||||
|
||||
DRA information from MDM policy must be a serialized binary blob identical to what we expect from GP.
|
||||
@ -115,37 +117,37 @@ The binary blob is the serialized version of following structure:
|
||||
|
||||
```cpp
|
||||
//
|
||||
// Recovery Policy Data Structures
|
||||
// Recovery Policy Data Structures
|
||||
//
|
||||
|
||||
typedef struct _RECOVERY_POLICY_HEADER {
|
||||
USHORT MajorRevision;
|
||||
USHORT MinorRevision;
|
||||
ULONG RecoveryKeyCount;
|
||||
USHORT MajorRevision;
|
||||
USHORT MinorRevision;
|
||||
ULONG RecoveryKeyCount;
|
||||
} RECOVERY_POLICY_HEADER, *PRECOVERY_POLICY_HEADER;
|
||||
|
||||
typedef struct _RECOVERY_POLICY_1_1 {
|
||||
RECOVERY_POLICY_HEADER RecoveryPolicyHeader;
|
||||
RECOVERY_KEY_1_1 RecoveryKeyList[1];
|
||||
} RECOVERY_POLICY_1_1, *PRECOVERY_POLICY_1_1;
|
||||
typedef struct _RECOVERY_POLICY_1_1 {
|
||||
RECOVERY_POLICY_HEADER RecoveryPolicyHeader;
|
||||
RECOVERY_KEY_1_1 RecoveryKeyList[1];
|
||||
} RECOVERY_POLICY_1_1, *PRECOVERY_POLICY_1_1;
|
||||
|
||||
#define EFS_RECOVERY_POLICY_MAJOR_REVISION_1 (1)
|
||||
#define EFS_RECOVERY_POLICY_MINOR_REVISION_0 (0)
|
||||
#define EFS_RECOVERY_POLICY_MAJOR_REVISION_1 (1)
|
||||
#define EFS_RECOVERY_POLICY_MINOR_REVISION_0 (0)
|
||||
|
||||
#define EFS_RECOVERY_POLICY_MINOR_REVISION_1 (1)
|
||||
#define EFS_RECOVERY_POLICY_MINOR_REVISION_1 (1)
|
||||
|
||||
///////////////////////////////////////////////////////////////////////////////
|
||||
// /
|
||||
// RECOVERY_KEY Data Structure /
|
||||
// /
|
||||
// /
|
||||
// RECOVERY_KEY Data Structure /
|
||||
// /
|
||||
///////////////////////////////////////////////////////////////////////////////
|
||||
|
||||
//
|
||||
// Current format of recovery data.
|
||||
//
|
||||
|
||||
typedef struct _RECOVERY_KEY_1_1 {
|
||||
ULONG TotalLength;
|
||||
typedef struct _RECOVERY_KEY_1_1 {
|
||||
ULONG TotalLength;
|
||||
EFS_PUBLIC_KEY_INFO PublicKeyInfo;
|
||||
} RECOVERY_KEY_1_1, *PRECOVERY_KEY_1_1;
|
||||
|
||||
@ -180,7 +182,7 @@ typedef struct _EFS_PUBLIC_KEY_INFO {
|
||||
|
||||
//
|
||||
// The following fields contain offsets based at the
|
||||
// beginning of the structure. Each offset is to
|
||||
// beginning of the structure. Each offset is to
|
||||
// a NULL terminated WCHAR string.
|
||||
//
|
||||
|
||||
@ -205,16 +207,16 @@ typedef struct _EFS_PUBLIC_KEY_INFO {
|
||||
|
||||
struct {
|
||||
|
||||
ULONG CertificateLength; // in bytes
|
||||
ULONG Certificate; // offset from start of structure
|
||||
ULONG CertificateLength; // in bytes
|
||||
ULONG Certificate; // offset from start of structure
|
||||
|
||||
} CertificateInfo;
|
||||
|
||||
|
||||
struct {
|
||||
|
||||
ULONG ThumbprintLength; // in bytes
|
||||
ULONG CertHashData; // offset from start of structure
|
||||
ULONG ThumbprintLength; // in bytes
|
||||
ULONG CertHashData; // offset from start of structure
|
||||
|
||||
} CertificateThumbprint;
|
||||
};
|
||||
@ -238,17 +240,19 @@ For EFSCertificate KeyTag, it's expected to be a DER ENCODED binary certificate.
|
||||
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is base-64 encoded certificate.
|
||||
|
||||
<a href="" id="settings-revokeonunenroll"></a>**Settings/RevokeOnUnenroll**
|
||||
#### <a href="" id="settings-revokeonunenroll"></a> Settings/RevokeOnUnenroll
|
||||
|
||||
This policy controls whether to revoke the Windows Information Protection keys when a device unenrolls from the management service. If set to 0 (Don't revoke keys), the keys won't be revoked and the user will continue to have access to protected files after unenrollment. If the keys aren't revoked, there will be no revoked file cleanup, later. Prior to sending the unenroll command, when you want a device to do a selective wipe when it's unenrolled, then you should explicitly set this policy to 1.
|
||||
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 – Don't revoke keys.
|
||||
- 1 (default) – Revoke keys.
|
||||
- 0 - Don't revoke keys.
|
||||
- 1 (default) - Revoke keys.
|
||||
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is integer.
|
||||
|
||||
<a href="" id="settings-revokeonmdmhandoff"></a>**Settings/RevokeOnMDMHandoff**
|
||||
#### <a href="" id="settings-revokeonmdmhandoff"></a> Settings/RevokeOnMDMHandoff
|
||||
|
||||
Added in Windows 10, version 1703. This policy controls whether to revoke the Windows Information Protection keys when a device upgrades from mobile application management (MAM) to MDM. If set to 0 (Don't revoke keys), the keys won't be revoked and the user will continue to have access to protected files after upgrade. This setting is recommended if the MDM service is configured with the same WIP EnterpriseID as the MAM service.
|
||||
|
||||
- 0 - Don't revoke keys.
|
||||
@ -256,25 +260,29 @@ Added in Windows 10, version 1703. This policy controls whether to revoke the Wi
|
||||
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is integer.
|
||||
|
||||
<a href="" id="settings-rmstemplateidforedp"></a>**Settings/RMSTemplateIDForEDP**
|
||||
#### <a href="" id="settings-rmstemplateidforedp"></a> Settings/RMSTemplateIDForEDP
|
||||
|
||||
TemplateID GUID to use for Rights Management Service (RMS) encryption. The RMS template allows the IT admin to configure the details about who has access to RMS-protected file and how long they have access.
|
||||
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is string (GUID).
|
||||
|
||||
<a href="" id="settings-allowazurermsforedp"></a>**Settings/AllowAzureRMSForEDP**
|
||||
#### <a href="" id="settings-allowazurermsforedp"></a> Settings/AllowAzureRMSForEDP
|
||||
|
||||
Specifies whether to allow Azure RMS encryption for Windows Information Protection.
|
||||
|
||||
- 0 (default) – Don't use RMS.
|
||||
- 1 – Use RMS.
|
||||
- 0 (default) - Don't use RMS.
|
||||
- 1 - Use RMS.
|
||||
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is integer.
|
||||
|
||||
<a href="" id="settings-smbautoencryptedfileextensions"></a>**Settings/SMBAutoEncryptedFileExtensions**
|
||||
#### <a href="" id="settings-smbautoencryptedfileextensions"></a> Settings/SMBAutoEncryptedFileExtensions
|
||||
|
||||
Added in Windows 10, version 1703. Specifies a list of file extensions, so that files with these extensions are encrypted when copying from a Server Message Block (SMB) share within the corporate boundary as defined in the Policy CSP nodes for [NetworkIsolation/EnterpriseIPRange](policy-csp-networkisolation.md) and [NetworkIsolation/EnterpriseNetworkDomainNames](policy-csp-networkisolation.md). Use semicolon (;) delimiter in the list.
|
||||
When this policy isn't specified, the existing auto-encryption behavior is applied. When this policy is configured, only files with the extensions in the list will be encrypted.
|
||||
Supported operations are Add, Get, Replace and Delete. Value type is string.
|
||||
|
||||
<a href="" id="settings-edpshowicons"></a>**Settings/EDPShowIcons**
|
||||
#### <a href="" id="settings-edpshowicons"></a> Settings/EDPShowIcons
|
||||
|
||||
Determines whether overlays are added to icons for WIP protected files in Explorer and enterprise only app tiles on the **Start** menu. Starting in Windows 10, version 1703 this setting also configures the visibility of the Windows Information Protection icon in the title bar of a WIP-protected app.
|
||||
The following list shows the supported values:
|
||||
|
||||
@ -283,7 +291,8 @@ The following list shows the supported values:
|
||||
|
||||
Supported operations are Add, Get, Replace, and Delete. Value type is integer.
|
||||
|
||||
<a href="" id="status"></a>**Status**
|
||||
### <a href="" id="status"></a> Status
|
||||
|
||||
A read-only bit mask that indicates the current state of Windows Information Protection on the Device. The MDM service can use this value to determine the current overall state of WIP. WIP is only on (bit 0 = 1) if WIP mandatory policies and WIP AppLocker settings are configured.
|
||||
|
||||
Suggested values:
|
||||
@ -310,8 +319,8 @@ Bits 2 and 4 are reserved for future use.
|
||||
|
||||
Supported operation is Get. Value type is integer.
|
||||
|
||||
## Related topics
|
||||
## Related articles
|
||||
|
||||
[Configuration service provider reference](index.yml)
|
||||
|
||||
|
||||
[Protect your enterprise data using Windows Information Protection (WIP)](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip)
|
||||
|
||||
@ -112,7 +112,7 @@ Once the device has connectivity to the domain controllers, DPAPI recovers the u
|
||||
|
||||
When data protected with user DPAPI is unusable, then the user loses access to all work data protected by Windows Information Protection. The impact includes: Outlook is unable to start and work protected documents can't be opened. If DPAPI is working, then newly created work data is protected and can be accessed.
|
||||
|
||||
**Workaround:** Users can resolve the problem by connecting their device to the domain and rebooting or using their Encrypting File System Data Recovery Agent certificate. For more information about Encrypting File System Data Recovery Agent certificate, see [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate).
|
||||
**Workaround:** Users can resolve the problem by connecting their device to the domain and rebooting or using their Encrypting File System Data Recovery Agent certificate. For more information about Encrypting File System Data Recovery Agent certificate, see [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate).
|
||||
|
||||
## Known issues
|
||||
|
||||
|
||||
@ -1,50 +0,0 @@
|
||||
---
|
||||
title: Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)
|
||||
description: Learn how unenlightened and enlightened apps might behave, based on Windows Information Protection (WIP) network policies, app configuration, and other criteria
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/26/2019
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
Windows Information Protection (WIP) classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data is encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or people will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default.
|
||||
|
||||
To avoid the automatic encryption of data, developers can enlighten apps by adding and compiling code using the Windows Information Protection application programming interfaces. The most likely candidates for enlightenment are apps that:
|
||||
|
||||
- Don't use common controls for saving files.
|
||||
- Don't use common controls for text boxes.
|
||||
- Simultaneously work on personal and corporate data (for example, contact apps that display personal and corporate data in a single view or a browser that displays personal and corporate web pages on tabs within a single instance).
|
||||
|
||||
We strongly suggest that the only unenlightened apps you add to your allowed apps list are Line-of-Business (LOB) apps.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> After revoking WIP, unenlightened apps will have to be uninstalled and re-installed since their settings files will remain encrypted. For more info about creating enlightened apps, see the [Windows Information Protection (WIP)](/windows/uwp/enterprise/wip-hub) topic in the Windows Dev Center.
|
||||
|
||||
## Unenlightened app behavior
|
||||
This table includes info about how unenlightened apps might behave, based on your Windows Information Protection (WIP) networking policies, your app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames.
|
||||
|
||||
|App rule setting|Networking policy configuration|
|
||||
|--- |--- |
|
||||
|**Not required.** App connects to enterprise cloud resources directly, using an IP address.| **Name-based policies, without the `/*AppCompat*/` string:**<li>App is entirely blocked from both personal and enterprise cloud resources.<li>No encryption is applied.<li>App can't access local Work files.<br/><br/>**Name-based policies, using the `/*AppCompat*/` string or proxy-based policies:**<li>App can access both personal and enterprise cloud resources. However, you might encounter apps using policies that restrict access to enterprise cloud resources.<li>No encryption is applied.<li>App can't access local Work files.|
|
||||
|**Not required.** App connects to enterprise cloud resources, using a hostname.|<li>App is blocked from accessing enterprise cloud resources, but can access other network resources.<li>No encryption is applied.<li>App can't access local Work files.|
|
||||
|**Allow.** App connects to enterprise cloud resources, using an IP address or a hostname.|<li>App can access both personal and enterprise cloud resources.<li>Auto-encryption is applied.<li>App can access local Work files.|
|
||||
|**Exempt.** App connects to enterprise cloud resources, using an IP address or a hostname.|<li>App can access both personal and enterprise cloud resources.<li>No encryption is applied.<li>App can access local Work files.|
|
||||
|
||||
## Enlightened app behavior
|
||||
This table includes info about how enlightened apps might behave, based on your Windows Information Protection (WIP) networking policies, your app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames.
|
||||
|
||||
|App rule setting|Networking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies|
|
||||
|--- |--- |
|
||||
|**Not required.** App connects to enterprise cloud resources, using an IP address or a hostname.|<li>App is blocked from accessing enterprise cloud resources, but can access other network resources.<li> No encryption is applied.<li> App can't access local Work files.|
|
||||
|**Allow.** App connects to enterprise cloud resources, using an IP address or a hostname.|<li>App can access both personal and enterprise cloud resources.<li> App protects work data and leaves personal data unprotected.<li> App can access local Work files.|
|
||||
|**Exempt.** App connects to enterprise cloud resources, using an IP address or a hostname.|<li>App can access both personal and enterprise cloud resources.<li> App protects work data and leaves personal data unprotected.<li> App can access local Work files.|
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,205 +0,0 @@
|
||||
---
|
||||
title: How to collect Windows Information Protection (WIP) audit event logs
|
||||
description: How to collect & understand Windows Information Protection audit event logs via the Reporting configuration service provider (CSP) or Windows Event Forwarding.
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/26/2019
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# How to collect Windows Information Protection (WIP) audit event logs
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
Windows Information Protection (WIP) creates audit events in the following situations:
|
||||
|
||||
- If an employee changes the File ownership for a file from **Work** to **Personal**.
|
||||
|
||||
- If data is marked as **Work**, but shared to a personal app or webpage. For example, through copying and pasting, dragging and dropping, sharing a contact, uploading to a personal webpage, or if the user grants a personal app provides temporary access to a work file.
|
||||
|
||||
- If an app has custom audit events.
|
||||
|
||||
## Collect WIP audit logs by using the Reporting configuration service provider (CSP)
|
||||
Collect the WIP audit logs from your employee's devices by following the guidance provided by the [Reporting configuration service provider (CSP)](/windows/client-management/mdm/reporting-csp) documentation. This topic provides info about the actual audit events.
|
||||
|
||||
>[!Note]
|
||||
>The **Data** element in the response includes the requested audit logs in an XML-encoded format.
|
||||
|
||||
### User element and attributes
|
||||
This table includes all available attributes for the **User** element.
|
||||
|
||||
|Attribute |Value type |Description |
|
||||
|----------|-----------|------------|
|
||||
|UserID |String |The security identifier (SID) of the user corresponding to this audit report. |
|
||||
|EnterpriseID |String |The enterprise ID corresponding to this audit report. |
|
||||
|
||||
### Log element and attributes
|
||||
This table includes all available attributes/elements for the **Log** element. The response can contain zero (0) or more **Log** elements.
|
||||
|
||||
|Attribute/Element |Value type |Description |
|
||||
|----------|-----------|------------|
|
||||
|ProviderType |String |This is always **EDPAudit**. |
|
||||
|LogType |String |Includes:<ul><li>**DataCopied.** Work data is copied or shared to a personal location.</li><li>**ProtectionRemoved.** Windows Information Protection is removed from a Work-defined file.</li><li>**ApplicationGenerated.** A custom audit log provided by an app.</li></ul>|
|
||||
|TimeStamp |Int |Uses the [FILETIME structure](/windows/win32/api/minwinbase/ns-minwinbase-filetime) to represent the time that the event happened. |
|
||||
|Policy |String |How the work data was shared to the personal location:<ul><li>**CopyPaste.** Work data was pasted into a personal location or app.</li><li>**ProtectionRemoved.** Work data was changed to be unprotected.</li><li>**DragDrop.** Work data was dropped into a personal location or app.</li><li>**Share.** Work data was shared with a personal location or app.</li><li>**NULL.** Any other way work data could be made personal beyond the options above. For example, when a work file is opened using a personal application (also known as, temporary access).</li></ul> |
|
||||
|Justification |String |Not implemented. This will always be either blank or NULL.<br><br>**Note**<br>Reserved for future use to collect the user justification for changing from **Work** to **Personal**. |
|
||||
|Object |String |A description of the shared work data. For example, if an employee opens a work file by using a personal app, this would be the file path. |
|
||||
|DataInfo |String |Any additional info about how the work file changed:<ul><li>**A file path.** If an employee uploads a work file to a personal website by using Microsoft Edge or Internet Explorer, the file path is included here.</li><li>**Clipboard data types.** If an employee pastes work data into a personal app, the list of clipboard data types provided by the work app are included here. For more info, see the [Examples](#examples) section of this topic.</li></ul> |
|
||||
|Action |Int |Provides info about what happened when the work data was shared to personal, including:<ul><li>**1.** File decrypt.</li><li>**2.** Copy to location.</li><li>**3.** Send to recipient.</li><li>**4.** Other.</li></ul> |
|
||||
|FilePath |String |The file path to the file specified in the audit event. For example, the location of a file that's been decrypted by an employee or uploaded to a personal website. |
|
||||
|SourceApplicationName |String |The source app or website. For the source app, this is the AppLocker identity. For the source website, this is the hostname. |
|
||||
|SourceName |String |A string provided by the app that's logging the event. It's intended to describe the source of the work data. |
|
||||
|DestinationEnterpriseID |String |The enterprise ID value for the app or website where the employee is sharing the data.<br><br>**NULL**, **Personal**, or **blank** means there's no enterprise ID because the work data was shared to a personal location. Because we don't currently support multiple enrollments, you'll always see one of these values. |
|
||||
|DestinationApplicationName |String |The destination app or website. For the destination app, this is the AppLocker identity. For the destination website, this is the hostname. |
|
||||
|DestinationName |String |A string provided by the app that's logging the event. It's intended to describe the destination of the work data. |
|
||||
|Application |String |The AppLocker identity for the app where the audit event happened. |
|
||||
|
||||
### Examples
|
||||
|
||||
Here are a few examples of responses from the Reporting CSP.
|
||||
|
||||
#### File ownership on a file is changed from work to personal
|
||||
|
||||
```xml
|
||||
<SyncML><SyncHdr/><SyncBody><Status><CmdID>1</CmdID><MsgRef>1</MsgRef><CmdRef>0</CmdRef><Cmd>SyncHdr</Cmd><Data>200</Data></Status><Status><CmdID>2</CmdID><MsgRef>1</MsgRef><CmdRef>2</CmdRef><Cmd>Replace</Cmd><Data>200</Data></Status><Status><CmdID>3</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Cmd>Get</Cmd><Data>200</Data></Status><Results><CmdID>4</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Item><Source><LocURI>./Vendor/MSFT/Reporting/EnterpriseDataProtection/RetrieveByTimeRange/Logs</LocURI></Source><Meta><Format xmlns="syncml:metinf">xml</Format></Meta><Data><?xml version="1.0" encoding="utf-8"?>
|
||||
<Reporting Version="com.contoso/2.0/MDM/Reporting">
|
||||
<User UserID="S-1-12-1-1111111111-1111111111-1111111111-1111111111" EnterpriseID="corp.contoso.com">
|
||||
<Log ProviderType="EDPAudit" LogType="ProtectionRemoved" TimeStamp="131357166318347527">
|
||||
<Policy>Protection removed</Policy>
|
||||
<Justification>NULL</Justification>
|
||||
<FilePath>C:\Users\TestUser\Desktop\tmp\demo\Work document.docx</FilePath>
|
||||
</Log>
|
||||
</User>
|
||||
</Reporting></Data></Item></Results><Final/></SyncBody></SyncML>
|
||||
```
|
||||
|
||||
#### A work file is uploaded to a personal webpage in Edge
|
||||
|
||||
```xml
|
||||
<SyncML><SyncHdr/><SyncBody><Status><CmdID>1</CmdID><MsgRef>1</MsgRef><CmdRef>0</CmdRef><Cmd>SyncHdr</Cmd><Data>200</Data></Status><Status><CmdID>2</CmdID><MsgRef>1</MsgRef><CmdRef>2</CmdRef><Cmd>Replace</Cmd><Data>200</Data></Status><Status><CmdID>3</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Cmd>Get</Cmd><Data>200</Data></Status><Results><CmdID>4</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Item><Source><LocURI>./Vendor/MSFT/Reporting/EnterpriseDataProtection/RetrieveByTimeRange/Logs</LocURI></Source><Meta><Format xmlns="syncml:metinf">xml</Format></Meta><Data><?xml version="1.0" encoding="utf-8"?>
|
||||
<Reporting Version="com.contoso/2.0/MDM/Reporting">
|
||||
<User UserID="S-1-12-1-1111111111-1111111111-1111111111-1111111111" EnterpriseID="corp.contoso.com">
|
||||
<Log ProviderType="EDPAudit" LogType="DataCopied" TimeStamp="131357192409318534">
|
||||
<Policy>CopyPaste</Policy>
|
||||
<Justification>NULL</Justification>
|
||||
<SourceApplicationName>NULL</SourceApplicationName>
|
||||
<DestinationEnterpriseID>NULL</DestinationEnterpriseID>
|
||||
<DestinationApplicationName>mail.contoso.com</DestinationApplicationName>
|
||||
<DataInfo>C:\Users\TestUser\Desktop\tmp\demo\Work document.docx</DataInfo>
|
||||
</Log>
|
||||
</User>
|
||||
</Reporting></Data></Item></Results><Final/></SyncBody></SyncML>
|
||||
```
|
||||
|
||||
#### Work data is pasted into a personal webpage
|
||||
|
||||
```xml
|
||||
<SyncML><SyncHdr/><SyncBody><Status><CmdID>1</CmdID><MsgRef>1</MsgRef><CmdRef>0</CmdRef><Cmd>SyncHdr</Cmd><Data>200</Data></Status><Status><CmdID>2</CmdID><MsgRef>1</MsgRef><CmdRef>2</CmdRef><Cmd>Replace</Cmd><Data>200</Data></Status><Status><CmdID>3</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Cmd>Get</Cmd><Data>200</Data></Status><Results><CmdID>4</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Item><Source><LocURI>./Vendor/MSFT/Reporting/EnterpriseDataProtection/RetrieveByTimeRange/Logs</LocURI></Source><Meta><Format xmlns="syncml:metinf">xml</Format></Meta><Data><?xml version="1.0" encoding="utf-8"?>
|
||||
<Reporting Version="com.contoso/2.0/MDM/Reporting">
|
||||
<User UserID="S-1-12-1-1111111111-1111111111-1111111111-1111111111" EnterpriseID="corp.contoso.com">
|
||||
<Log ProviderType="EDPAudit" LogType="DataCopied" TimeStamp="131357193734179782">
|
||||
<Policy>CopyPaste</Policy>
|
||||
<Justification>NULL</Justification>
|
||||
<SourceApplicationName>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT OFFICE 2016\WINWORD.EXE\16.0.8027.1000</SourceApplicationName>
|
||||
<DestinationEnterpriseID>NULL</DestinationEnterpriseID>
|
||||
<DestinationApplicationName>mail.contoso.com</DestinationApplicationName>
|
||||
<DataInfo>EnterpriseDataProtectionId|Object Descriptor|Rich Text Format|HTML Format|AnsiText|Text|EnhancedMetafile|Embed Source|Link Source|Link Source Descriptor|ObjectLink|Hyperlink</DataInfo>
|
||||
</Log>
|
||||
</User>
|
||||
</Reporting></Data></Item></Results><Final/></SyncBody></SyncML>
|
||||
```
|
||||
|
||||
#### A work file is opened with a personal application
|
||||
|
||||
```xml
|
||||
<SyncML><SyncHdr/><SyncBody><Status><CmdID>1</CmdID><MsgRef>1</MsgRef><CmdRef>0</CmdRef><Cmd>SyncHdr</Cmd><Data>200</Data></Status><Status><CmdID>2</CmdID><MsgRef>1</MsgRef><CmdRef>2</CmdRef><Cmd>Replace</Cmd><Data>200</Data></Status><Status><CmdID>3</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Cmd>Get</Cmd><Data>200</Data></Status><Results><CmdID>4</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Item><Source><LocURI>./Vendor/MSFT/Reporting/EnterpriseDataProtection/RetrieveByTimeRange/Logs</LocURI></Source><Meta><Format xmlns="syncml:metinf">xml</Format></Meta><Data><?xml version="1.0" encoding="utf-8"?>
|
||||
<Reporting Version="com.contoso/2.0/MDM/Reporting">
|
||||
<User UserID="S-1-12-1-1111111111-1111111111-1111111111-1111111111" EnterpriseID="corp.contoso.com">
|
||||
<Log ProviderType="EDPAudit" LogType="ApplicationGenerated" TimeStamp="131357194991209469">
|
||||
<Policy>NULL</Policy>
|
||||
<Justification></Justification>
|
||||
<Object>C:\Users\TestUser\Desktop\tmp\demo\Work document.docx</Object>
|
||||
<Action>1</Action>
|
||||
<SourceName>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT® WINDOWS® OPERATING SYSTEM\WORDPAD.EXE\10.0.15063.2</SourceName>
|
||||
<DestinationEnterpriseID>Personal</DestinationEnterpriseID>
|
||||
<DestinationName>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT® WINDOWS® OPERATING SYSTEM\WORDPAD.EXE\10.0.15063.2</DestinationName>
|
||||
<Application>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT® WINDOWS® OPERATING SYSTEM\WORDPAD.EXE\10.0.15063.2</Application>
|
||||
</Log>
|
||||
</User>
|
||||
</Reporting></Data></Item></Results><Final/></SyncBody></SyncML>
|
||||
```
|
||||
|
||||
#### Work data is pasted into a personal application
|
||||
|
||||
```xml
|
||||
<SyncML><SyncHdr/><SyncBody><Status><CmdID>1</CmdID><MsgRef>1</MsgRef><CmdRef>0</CmdRef><Cmd>SyncHdr</Cmd><Data>200</Data></Status><Status><CmdID>2</CmdID><MsgRef>1</MsgRef><CmdRef>2</CmdRef><Cmd>Replace</Cmd><Data>200</Data></Status><Status><CmdID>3</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Cmd>Get</Cmd><Data>200</Data></Status><Results><CmdID>4</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Item><Source><LocURI>./Vendor/MSFT/Reporting/EnterpriseDataProtection/RetrieveByTimeRange/Logs</LocURI></Source><Meta><Format xmlns="syncml:metinf">xml</Format></Meta><Data><?xml version="1.0" encoding="utf-8"?>
|
||||
<Reporting Version="com.contoso/2.0/MDM/Reporting">
|
||||
<User UserID="S-1-12-1-1111111111-1111111111-1111111111-1111111111" EnterpriseID="corp.contoso.com">
|
||||
<Log ProviderType="EDPAudit" LogType="DataCopied" TimeStamp="131357196076537270">
|
||||
<Policy>CopyPaste</Policy>
|
||||
<Justification>NULL</Justification>
|
||||
<SourceApplicationName>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT OFFICE 2016\WINWORD.EXE\16.0.8027.1000</SourceApplicationName>
|
||||
<DestinationEnterpriseID>NULL</DestinationEnterpriseID>
|
||||
<DestinationApplicationName></DestinationApplicationName>
|
||||
<DataInfo>EnterpriseDataProtectionId|Object Descriptor|Rich Text Format|HTML Format|AnsiText|Text|EnhancedMetafile|Embed Source|Link Source|Link Source Descriptor|ObjectLink|Hyperlink</DataInfo>
|
||||
</Log>
|
||||
</User>
|
||||
</Reporting></Data></Item></Results><Final/></SyncBody></SyncML>
|
||||
```
|
||||
|
||||
## Collect WIP audit logs by using Windows Event Forwarding (for Windows desktop domain-joined devices only)
|
||||
|
||||
Use Windows Event Forwarding to collect and aggregate your Windows Information Protection audit events. You can view your audit events in the Event Viewer.
|
||||
|
||||
**To view the WIP events in the Event Viewer**
|
||||
|
||||
1. Open Event Viewer.
|
||||
|
||||
2. In the console tree under **Application and Services Logs\Microsoft\Windows**, click **EDP-Audit-Regular** and **EDP-Audit-TCB**.
|
||||
|
||||
## Collect WIP audit logs using Azure Monitor
|
||||
|
||||
You can collect audit logs using Azure Monitor. See [Windows event log data sources in Azure Monitor.]()
|
||||
|
||||
**To view the WIP events in Azure Monitor**
|
||||
|
||||
1. Use an existing or create a new Log Analytics workspace.
|
||||
|
||||
2. In **Log Analytics** > **Advanced Settings**, select **Data**. In Windows Event Logs, add logs to receive:
|
||||
|
||||
```console
|
||||
Microsoft-Windows-EDP-Application-Learning/Admin
|
||||
Microsoft-Windows-EDP-Audit-TCB/Admin
|
||||
```
|
||||
>[!NOTE]
|
||||
>If using Windows Events Logs, the event log names can be found under Properties of the event in the Events folder (Application and Services Logs\Microsoft\Windows, click EDP-Audit-Regular and EDP-Audit-TCB).
|
||||
|
||||
3. Download Microsoft [Monitoring Agent](/azure/azure-monitor/platform/agent-windows#install-the-agent-using-dsc-in-azure-automation).
|
||||
|
||||
4. To get MSI for Intune installation as stated in the Azure Monitor article, extract: `MMASetup-.exe /c /t:`
|
||||
|
||||
Install Microsoft Monitoring Agent to WIP devices using Workspace ID and Primary key. More information on Workspace ID and Primary key can be found in **Log Analytics** > **Advanced Settings**.
|
||||
|
||||
5. To deploy MSI via Intune, in installation parameters add: `/q /norestart NOAPM=1 ADD_OPINSIGHTS_WORKSPACE=1 OPINSIGHTS_WORKSPACE_AZURE_CLOUD_TYPE=0 OPINSIGHTS_WORKSPACE_ID=<WORKSPACE_ID> OPINSIGHTS_WORKSPACE_KEY=<WORKSPACE_KEY> AcceptEndUserLicenseAgreement=1`
|
||||
|
||||
>[!NOTE]
|
||||
>Replace <WORKSPACE_ID> & <WORKSPACE_KEY> received from step 5. In installation parameters, don't place <WORKSPACE_ID> & <WORKSPACE_KEY> in quotes ("" or '').
|
||||
|
||||
6. After the agent is deployed, data will be received within approximately 10 minutes.
|
||||
|
||||
7. To search for logs, go to **Log Analytics workspace** > **Logs**, and type **Event** in search.
|
||||
|
||||
***Example***
|
||||
|
||||
```console
|
||||
Event | where EventLog == "Microsoft-Windows-EDP-Audit-TCB/Admin"
|
||||
```
|
||||
|
||||
## Additional resources
|
||||
- [How to deploy app via Intune](/intune/apps-add)
|
||||
- [How to create Log workspace](/azure/azure-monitor/learn/quick-create-workspace)
|
||||
- [How to use Microsoft Monitoring Agents for Windows](/azure/azure-monitor/platform/agents-overview)
|
||||
@ -1,162 +0,0 @@
|
||||
---
|
||||
title: Create an EFS Data Recovery Agent certificate
|
||||
description: Follow these steps to create, verify, and perform a quick recovery by using an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate.
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.reviewer: rafals
|
||||
ms.topic: how-to
|
||||
ms.date: 07/15/2022
|
||||
---
|
||||
|
||||
# Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate
|
||||
|
||||
[!INCLUDE [Deprecate Windows Information Protection](includes/wip-deprecation.md)]
|
||||
<!-- 6010051 -->
|
||||
|
||||
_Applies to:_
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
If you don't already have an EFS DRA certificate, you'll need to create and extract one from your system before you can use Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your organization. For the purposes of this section, we'll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. For more info about when to use a PKI and the general strategy you should use to deploy DRA certificates, see the [Security Watch Deploying EFS: Part 1](/previous-versions/technet-magazine/cc162507(v=msdn.10)) article on TechNet. For more general info about EFS protection, see [Protecting Data by Using EFS to Encrypt Hard Drives](/previous-versions/tn-archive/cc875821(v=technet.10)).<br><br>If your DRA certificate has expired, you won't be able to encrypt your files with it. To fix this, you'll need to create a new certificate, using the steps in this topic, and then deploy it through policy.
|
||||
|
||||
## Manually create an EFS DRA certificate
|
||||
|
||||
1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate.
|
||||
|
||||
2. Run this command:
|
||||
|
||||
```cmd
|
||||
cipher /r:EFSRA
|
||||
```
|
||||
|
||||
Where *EFSRA* is the name of the `.cer` and `.pfx` files that you want to create.
|
||||
|
||||
3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file.
|
||||
|
||||
The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1.
|
||||
|
||||
>[!Important]
|
||||
>Because the private keys in your DRA .pfx files can be used to decrypt any WIP file, you must protect them accordingly. We highly recommend storing these files offline, keeping copies on a smart card with strong protection for normal use and master copies in a secured physical location.
|
||||
|
||||
4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as [Microsoft Intune](create-wip-policy-using-intune-azure.md) or [Microsoft Configuration Manager](create-wip-policy-using-configmgr.md).
|
||||
|
||||
> [!NOTE]
|
||||
> This certificate can be used in Intune for policies both _with_ device enrollment (MDM) and _without_ device enrollment (MAM).
|
||||
|
||||
## Verify your data recovery certificate is correctly set up on a WIP client computer
|
||||
|
||||
1. Find or create a file that's encrypted using Windows Information Protection. For example, you could open an app on your allowed app list, and then create and save a file so it's encrypted by WIP.
|
||||
|
||||
2. Open an app on your protected app list, and then create and save a file so that it's encrypted by WIP.
|
||||
|
||||
3. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command:
|
||||
|
||||
```cmd
|
||||
cipher /c filename
|
||||
```
|
||||
|
||||
Where *filename* is the name of the file you created in Step 1.
|
||||
|
||||
4. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list.
|
||||
|
||||
## Recover your data using the EFS DRA certificate in a test environment
|
||||
|
||||
1. Copy your WIP-encrypted file to a location where you have admin access.
|
||||
|
||||
2. Install the EFSDRA.pfx file, using its password.
|
||||
|
||||
3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command:
|
||||
|
||||
```cmd
|
||||
cipher /d encryptedfile.extension
|
||||
```
|
||||
|
||||
Where *encryptedfile.extension* is the name of your encrypted file. For example, `corporatedata.docx`.
|
||||
|
||||
## Recover WIP-protected after unenrollment
|
||||
|
||||
It's possible that you might revoke data from an unenrolled device only to later want to restore it all. This can happen in the case of a missing device being returned or if an unenrolled employee enrolls again. If the employee enrolls again using the original user profile, and the revoked key store is still on the device, all of the revoked data can be restored at once.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>To maintain control over your enterprise data, and to be able to revoke again in the future, you must only perform this process after the employee has re-enrolled the device.
|
||||
|
||||
1. Have the employee sign in to the unenrolled device, open an elevated command prompt, and type:
|
||||
|
||||
```cmd
|
||||
Robocopy "%localappdata%\Microsoft\EDP\Recovery" "new_location" * /EFSRAW
|
||||
```
|
||||
|
||||
Where "*new_location*" is in a different directory. This can be on the employee's device or on a shared folder on a computer that runs Windows 8 or Windows Server 2012 or newer and can be accessed while you're logged in as a data recovery agent.
|
||||
|
||||
To start Robocopy in S mode, open Task Manager. Click **File** > **Run new task**, type the command, and click **Create this task with administrative privileges**.
|
||||
|
||||
|
||||
|
||||
If the employee performed a clean installation and there is no user profile, you need to recover the keys from the System Volume folder in each drive. Type:
|
||||
|
||||
```cmd
|
||||
Robocopy "drive_letter:\System Volume Information\EDP\Recovery\" "new_location" * /EFSRAW
|
||||
```
|
||||
|
||||
2. Sign in to a different device with administrator credentials that have access to your organization's DRA certificate, and perform the file decryption and recovery by typing:
|
||||
|
||||
```cmd
|
||||
cipher.exe /D "new_location"
|
||||
```
|
||||
|
||||
3. Have your employee sign in to the unenrolled device, and type:
|
||||
|
||||
```cmd
|
||||
Robocopy "new_location" "%localappdata%\Microsoft\EDP\Recovery\Input"
|
||||
```
|
||||
|
||||
4. Ask the employee to lock and unlock the device.
|
||||
|
||||
The Windows Credential service automatically recovers the employee's previously revoked keys from the `Recovery\Input` location.
|
||||
|
||||
## Auto-recovery of encryption keys
|
||||
Starting with Windows 10, version 1709, WIP includes a data recovery feature that lets your employees auto-recover access to work files if the encryption key is lost and the files are no longer accessible. This typically happens if an employee reimages the operating system partition, removing the WIP key info, or if a device is reported as lost and you mistakenly target the wrong device for unenrollment.
|
||||
|
||||
To help make sure employees can always access files, WIP creates an auto-recovery key that's backed up to their Microsoft Entra identity.
|
||||
|
||||
The employee experience is based on signing in with a Microsoft Entra ID work account. The employee can either:
|
||||
|
||||
- Add a work account through the **Windows Settings > Accounts > Access work or school > Connect** menu.
|
||||
|
||||
-OR-
|
||||
|
||||
- Open **Windows Settings > Accounts > Access work or school > Connect** and choose the **Join this device to Microsoft Entra ID** link, under **Alternate actions**.
|
||||
|
||||
>[!Note]
|
||||
>To perform a Microsoft Entra Domain Join from the Settings page, the employee must have administrator privileges to the device.
|
||||
|
||||
After signing in, the necessary WIP key info is automatically downloaded and employees are able to access the files again.
|
||||
|
||||
### To test what the employee sees during the WIP key recovery process
|
||||
|
||||
1. Attempt to open a work file on an unenrolled device.
|
||||
|
||||
The **Connect to Work to access work files** box appears.
|
||||
|
||||
2. Click **Connect**.
|
||||
|
||||
The **Access work or school settings** page appears.
|
||||
|
||||
3. Sign-in to Microsoft Entra ID as the employee and verify that the files now open
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Security Watch Deploying EFS: Part 1](/previous-versions/technet-magazine/cc162507(v=msdn.10))
|
||||
|
||||
- [Protecting Data by Using EFS to Encrypt Hard Drives](/previous-versions/tn-archive/cc875821(v=technet.10))
|
||||
|
||||
- [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune-azure.md)
|
||||
|
||||
- [Create a Windows Information Protection (WIP) policy using Microsoft Configuration Manager](create-wip-policy-using-configmgr.md)
|
||||
|
||||
- [Creating a Domain-Based Recovery Agent](/previous-versions/tn-archive/cc875821(v=technet.10)#EJAA)
|
||||
@ -1,64 +0,0 @@
|
||||
---
|
||||
title: Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune
|
||||
description: After you've created and deployed your Windows Information Protection (WIP) policy, use Microsoft Intune to link it to your Virtual Private Network (VPN) policy
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/26/2019
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Associate and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to associate and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy.
|
||||
|
||||
## Associate your WIP policy to your VPN policy using Intune
|
||||
|
||||
To associate your WIP policy with your organization's existing VPN policy, use the following steps:
|
||||
|
||||
1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
2. Select **Devices** > **Configuration profiles** > **Create profile**.
|
||||
3. Enter the following properties:
|
||||
|
||||
- **Platform**: Select **Windows 10 and later**
|
||||
- **Profile**: Select **Templates** > **Custom**.
|
||||
|
||||
4. Select **Create**.
|
||||
5. In **Basics**, enter the following properties:
|
||||
|
||||
- **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify them later.
|
||||
- **Description**: Enter a description for the profile. This setting is optional, but recommended.
|
||||
|
||||
6. Select **Next**.
|
||||
7. In **Configuration settings**, enter the following properties:
|
||||
|
||||
- **Name**: Enter a name for your setting. For example, enter `EDPModeID`.
|
||||
- **OMA-URI**: Enter `./Vendor/MSFT/VPNv2/YourVPNProfileName/EDPModeId`.
|
||||
- **Data type**: Select `String`.
|
||||
- **Value**: Type your fully qualified domain that should be used by the OMA-URI setting. For example, enter `corp.contoso.com`.
|
||||
|
||||
For more information on these settings, see [Use custom settings for Windows devices in Intune](/mem/intune/configuration/custom-settings-windows-10).
|
||||
|
||||
8. Select **Next**, and continue configuring the policy. For the specific steps and recommendations, see [Create a profile with custom settings in Intune](/mem/intune/configuration/custom-settings-configure).
|
||||
|
||||
## Deploy your VPN policy using Microsoft Intune
|
||||
|
||||
After you've created your VPN policy, you'll need to deploy it to the same group you deployed your Windows Information Protection (WIP) policy.
|
||||
|
||||
1. On the **App policy** blade, select your newly created policy, select **User groups** from the menu that appears, and then select **Add user group**.
|
||||
|
||||
A list of user groups, made up of all of the security groups in your Microsoft Entra ID, appear in the **Add user group** blade.
|
||||
|
||||
2. Choose the group you want your policy to apply to, and then select **Select** to deploy the policy.
|
||||
|
||||
The policy is deployed to the selected users' devices.
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,480 +0,0 @@
|
||||
---
|
||||
title: Create and deploy a WIP policy in Configuration Manager
|
||||
description: Use Microsoft Configuration Manager to create and deploy a Windows Information Protection (WIP) policy. Choose protected apps, WIP-protection level, and find enterprise data.
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.reviewer: rafals
|
||||
ms.topic: how-to
|
||||
ms.date: 07/15/2022
|
||||
---
|
||||
|
||||
# Create and deploy a Windows Information Protection policy in Configuration Manager
|
||||
|
||||
[!INCLUDE [Deprecate Windows Information Protection](includes/wip-deprecation.md)]
|
||||
<!-- 6010051 -->
|
||||
|
||||
_Applies to:_
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Microsoft Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy. You can choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network.
|
||||
|
||||
## Add a WIP policy
|
||||
After you've installed and set up Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy.
|
||||
|
||||
>[!TIP]
|
||||
> Review the [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md) article before creating a new configuration item to avoid common issues.
|
||||
|
||||
**To create a configuration item for WIP**
|
||||
|
||||
1. Open the Configuration Manager console, select the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node.
|
||||
|
||||
|
||||
|
||||
2. Select the **Create Configuration Item** button.<p>
|
||||
The **Create Configuration Item Wizard** starts.
|
||||
|
||||
|
||||
|
||||
3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes.
|
||||
|
||||
4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use Configuration Manager for device management, and then select **Next**.
|
||||
|
||||
- **Settings for devices managed with the Configuration Manager client:** Windows 10
|
||||
|
||||
-OR-
|
||||
|
||||
- **Settings for devices managed without the Configuration Manager client:** Windows 8.1 and Windows 10
|
||||
|
||||
5. On the **Supported Platforms** screen, select the **Windows 10** box, and then select **Next**.
|
||||
|
||||
|
||||
|
||||
6. On the **Device Settings** screen, select **Windows Information Protection**, and then select **Next**.
|
||||
|
||||
|
||||
|
||||
The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization.
|
||||
|
||||
## Add app rules to your policy
|
||||
|
||||
During the policy-creation process in Configuration Manager, you can choose the apps you want to give access to your enterprise data through Windows Information Protection. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
|
||||
|
||||
The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.<p>Care must be taken to get a support statement from the software provider that their app is safe with Windows Information Protection before adding it to your **App rules** list. If you don't get this statement, it's possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
|
||||
|
||||
### Add a store app rule to your policy
|
||||
For this example, we're going to add Microsoft OneNote, a store app, to the **App Rules** list.
|
||||
|
||||
**To add a store app**
|
||||
|
||||
1. From the **App rules** area, select **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it's *Microsoft OneNote*.
|
||||
|
||||
3. Select **Allow** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
Allow turns on WIP, helping to protect that app's corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section.
|
||||
|
||||
4. Pick **Store App** from the **Rule template** drop-down list.
|
||||
|
||||
The box changes to show the store app rule options.
|
||||
|
||||
5. Type the name of the app and the name of its publisher, and then select **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`.
|
||||
|
||||
If you don't know the publisher or product name, you can find them for both desktop devices by following these steps.
|
||||
|
||||
**To find the Publisher and Product Name values for Store apps without installing them**
|
||||
|
||||
1. Go to the [Microsoft Store](https://apps.microsoft.com/) website, and find your app. For example, Microsoft OneNote.
|
||||
|
||||
> [!NOTE]
|
||||
> If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in [Add an AppLocker policy file](#add-an-applocker-policy-file) in this article.
|
||||
|
||||
2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is `https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl`, and you'd copy the ID value, `9wzdncrfhvjl`.
|
||||
|
||||
3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run `https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata`, where `9wzdncrfhvjl` is replaced with your ID value.
|
||||
|
||||
The API runs and opens a text editor with the app details.
|
||||
|
||||
```json
|
||||
{
|
||||
"packageIdentityName": "Microsoft.Office.OneNote",
|
||||
"publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
|
||||
}
|
||||
```
|
||||
|
||||
4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of Intune.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that's using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as "CN=" followed by the `windowsPhoneLegacyId`.
|
||||
>
|
||||
> For example:
|
||||
>
|
||||
> ```json
|
||||
> {
|
||||
> "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
|
||||
> }
|
||||
> ```
|
||||
|
||||
### Add a desktop app rule to your policy
|
||||
|
||||
For this example, we're going to add Internet Explorer, a desktop app, to the **App Rules** list.
|
||||
|
||||
**To add a desktop app to your policy**
|
||||
|
||||
1. From the **App rules** area, select **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it's *Internet Explorer*.
|
||||
|
||||
3. Select **Allow** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
Allow turns on WIP, helping to protect that app's corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section.
|
||||
|
||||
4. Pick **Desktop App** from the **Rule template** drop-down list.
|
||||
|
||||
The box changes to show the desktop app rule options.
|
||||
|
||||
5. Pick the options you want to include for the app rule (see table), and then select **OK**.
|
||||
|
||||
|Option|Manages|
|
||||
|--- |--- |
|
||||
|All fields left as "*"|All files signed by any publisher. (Not recommended.)|
|
||||
|**Publisher** selected|All files signed by the named publisher. This might be useful if your company is the publisher and signer of internal line-of-business apps.|
|
||||
|**Publisher** and **Product Name** selected|All files for the specified product, signed by the named publisher.|
|
||||
|**Publisher**, **Product Name**, and **Binary name** selected|Any version of the named file or package for the specified product, signed by the named publisher.|
|
||||
|**Publisher**, **Product Name**, **Binary name**, and **File Version, and above**, selected|Specified version or newer releases of the named file or package for the specified product, signed by the named publisher. This option is recommended for enlightened apps that weren't previously enlightened.|
|
||||
|**Publisher**, **Product Name**, **Binary name**, and **File Version, And below** selected|Specified version or older releases of the named file or package for the specified product, signed by the named publisher.|
|
||||
|**Publisher**, **Product Name**, **Binary name**, and **File Version, Exactly** selected|Specified version of the named file or package for the specified product, signed by the named publisher.|
|
||||
|
||||
If you're unsure about what to include for the publisher, you can run this PowerShell command:
|
||||
|
||||
```powershell
|
||||
Get-AppLockerFileInformation -Path "<path of the exe>"
|
||||
```
|
||||
|
||||
Where `"<path of the exe>"` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Internet Explorer\iexplore.exe"`.
|
||||
|
||||
In this example, you'd get the following info:
|
||||
|
||||
```console
|
||||
Path Publisher
|
||||
---- ---------
|
||||
%PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR...
|
||||
```
|
||||
|
||||
Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box.
|
||||
|
||||
### Add an AppLocker policy file
|
||||
|
||||
For this example, we're going to add an AppLocker XML file to the **App Rules** list. You'll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](../../application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md) content.
|
||||
|
||||
**To create an app rule and xml file using the AppLocker tool**
|
||||
|
||||
1. Open the Local Security Policy snap-in (SecPol.msc).
|
||||
|
||||
2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then select **Packaged App Rules**.
|
||||
|
||||
|
||||
|
||||
3. Right-click in the right-hand pane, and then select **Create New Rule**.
|
||||
|
||||
The **Create Packaged app Rules** wizard appears.
|
||||
|
||||
4. On the **Before You Begin** page, select **Next**.
|
||||
|
||||
|
||||
|
||||
5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then select **Next**.
|
||||
|
||||
|
||||
|
||||
6. On the **Publisher** page, select **Select** from the **Use an installed packaged app as a reference** area.
|
||||
|
||||
|
||||
|
||||
7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then select **OK**. For this example, we're using Microsoft Photos.
|
||||
|
||||
|
||||
|
||||
8. On the updated **Publisher** page, select **Create**.
|
||||
|
||||
|
||||
|
||||
9. Review the Local Security Policy snap-in to make sure your rule is correct.
|
||||
|
||||
|
||||
|
||||
10. In the left pane, right-click on **AppLocker**, and then select **Export policy**.
|
||||
|
||||
The **Export policy** box opens, letting you export and save your new policy as XML.
|
||||
|
||||
|
||||
|
||||
11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then select **Save**.
|
||||
|
||||
The policy is saved and you'll see a message that says one rule was exported from the policy.
|
||||
|
||||
**Example XML file**<br>
|
||||
This is the XML file that AppLocker creates for Microsoft Photos.
|
||||
|
||||
```xml
|
||||
<AppLockerPolicy Version="1">
|
||||
<RuleCollection Type="Exe" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Msi" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Script" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Dll" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Appx" EnforcementMode="NotConfigured">
|
||||
<FilePublisherRule Id="5e0c752b-5921-4f72-8146-80ad5f582110" Name="Microsoft.Windows.Photos, version 16.526.0.0 and above, from Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
|
||||
<Conditions>
|
||||
<FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.Photos" BinaryName="*">
|
||||
<BinaryVersionRange LowSection="16.526.0.0" HighSection="*" />
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
</RuleCollection>
|
||||
</AppLockerPolicy>
|
||||
```
|
||||
12. After you've created your XML file, you need to import it by using Configuration Manager.
|
||||
|
||||
**To import your Applocker policy file app rule using Configuration Manager**
|
||||
|
||||
1. From the **App rules** area, select **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it's *Allowed app list*.
|
||||
|
||||
3. Select **Allow** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
Allow turns on WIP, helping to protect that app's corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section.
|
||||
|
||||
4. Pick the **AppLocker policy file** from the **Rule template** drop-down list.
|
||||
|
||||
The box changes to let you import your AppLocker XML policy file.
|
||||
|
||||
5. Select the ellipsis (...) to browse for your AppLocker XML file, select **Open**, and then select **OK** to close the **Add app rule** box.
|
||||
|
||||
The file is imported and the apps are added to your **App Rules** list.
|
||||
|
||||
### Exempt apps from WIP restrictions
|
||||
If you're running into compatibility issues where your app is incompatible with Windows Information Protection (WIP), but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak.
|
||||
|
||||
**To exempt a store app, a desktop app, or an AppLocker policy file app rule**
|
||||
|
||||
1. From the **App rules** area, select **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it's *Exempt apps list*.
|
||||
|
||||
3. Select **Exempt** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
When you exempt apps, they're allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see [Add app rules to your policy](#add-app-rules-to-your-policy) in this article.
|
||||
|
||||
4. Fill out the rest of the app rule info, based on the type of rule you're adding:
|
||||
|
||||
- **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this article.
|
||||
|
||||
- **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this article.
|
||||
|
||||
- **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this article, using a list of exempted apps.
|
||||
|
||||
5. Select **OK**.
|
||||
|
||||
## Manage the WIP-protection level for your enterprise data
|
||||
After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode.
|
||||
|
||||
We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**.
|
||||
|
||||
>[!NOTE]
|
||||
>For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).
|
||||
|
||||
|Mode |Description |
|
||||
|-----|------------|
|
||||
|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.|
|
||||
|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. |
|
||||
|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would have been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.|
|
||||
|Off |WIP is turned off and doesn't help to protect or audit your data.<p>After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Your previous decryption and policy info isn't automatically reapplied if you turn WIP protection back on. For more information, see [How to disable Windows Information Protection](how-to-disable-wip.md).|
|
||||
|
||||
:::image type="content" alt-text="Create Configuration Item wizard, choose your WIP-protection level" source="images/wip-configmgr-appmgmt.png":::
|
||||
|
||||
## Define your enterprise-managed identity domains
|
||||
Corporate identity, usually expressed as your primary internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you've marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies.
|
||||
|
||||
You can specify multiple domains owned by your enterprise by separating them with the `|` character. For example, `contoso.com|newcontoso.com`. With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list.
|
||||
|
||||
**To add your corporate identity**
|
||||
|
||||
- Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`.
|
||||
|
||||
|
||||
|
||||
## Choose where apps can access enterprise data
|
||||
After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network.
|
||||
|
||||
There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise's range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT).
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Every WIP policy should include policy that defines your enterprise network locations.<br>
|
||||
>Classless Inter-Domain Routing (CIDR) notation isn't supported for WIP configurations.
|
||||
|
||||
**To define where your protected apps can find and send enterprise data on your network**
|
||||
|
||||
1. Add additional network locations your apps can access by clicking **Add**.
|
||||
|
||||
The **Add or edit corporate network definition** box appears.
|
||||
|
||||
2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table.
|
||||
|
||||
|
||||
|
||||
- **Enterprise Cloud Resources**: Specify the cloud resources to be treated as corporate and protected by WIP.
|
||||
|
||||
For each cloud resource, you may also optionally specify a proxy server from your internal proxy servers list to route traffic for this cloud resource. All traffic routed through your internal proxy servers is considered enterprise.
|
||||
|
||||
If you have multiple resources, you must separate them using the `|` delimiter. If you don't use proxy servers, you must also include the `,` delimiter just before the `|`. For example: URL `<,proxy>|URL <,proxy>`.
|
||||
|
||||
**Format examples**:
|
||||
|
||||
- **With proxy**: `contoso.sharepoint.com,contoso.internalproxy1.com|contoso.visualstudio.com,contoso.internalproxy2.com`
|
||||
|
||||
- **Without proxy**: `contoso.sharepoint.com|contoso.visualstudio.com`
|
||||
|
||||
>[!Important]
|
||||
> In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can't tell whether it's attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.
|
||||
|
||||
- **Enterprise Network Domain Names (Required)**: Specify the DNS suffixes used in your environment. All traffic to the fully qualified domains appearing in this list will be protected.
|
||||
|
||||
This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.
|
||||
|
||||
If you have multiple resources, you must separate them using the "," delimiter.
|
||||
|
||||
**Format examples**: `corp.contoso.com,region.contoso.com`
|
||||
|
||||
- **Proxy servers**: Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources.
|
||||
|
||||
This list shouldn't include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.
|
||||
|
||||
If you have multiple resources, you must separate them using the ";" delimiter.
|
||||
|
||||
**Format examples**: `proxy.contoso.com:80;proxy2.contoso.com:443`
|
||||
|
||||
- **Internal proxy servers**: Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources.
|
||||
|
||||
This list shouldn't include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.
|
||||
|
||||
If you have multiple resources, you must separate them using the ";" delimiter.
|
||||
|
||||
**Format examples**: `contoso.internalproxy1.com;contoso.internalproxy2.com`
|
||||
|
||||
- **Enterprise IPv4 Range (Required)**: Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.
|
||||
|
||||
If you have multiple ranges, you must separate them using the "," delimiter.
|
||||
|
||||
**Format examples**:
|
||||
|
||||
- **Starting IPv4 Address:** `3.4.0.1`
|
||||
- **Ending IPv4 Address:** `3.4.255.254`
|
||||
- **Custom URI:** `3.4.0.1-3.4.255.254, 10.0.0.1-10.255.255.254`
|
||||
|
||||
- **Enterprise IPv6 Range**: Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.
|
||||
|
||||
If you have multiple ranges, you must separate them using the "," delimiter.
|
||||
|
||||
**Format examples**:
|
||||
|
||||
- **Starting IPv6 Address:** `2a01:110::`
|
||||
- **Ending IPv6 Address:** `2a01:110:7fff:ffff:ffff:ffff:ffff:ffff`
|
||||
- **Custom URI:** `2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff`
|
||||
|
||||
- **Neutral Resources**: Specify your authentication redirection endpoints for your company. These locations are considered enterprise or personal, based on the context of the connection before the redirection.
|
||||
|
||||
If you have multiple resources, you must separate them using the "," delimiter.
|
||||
|
||||
**Format examples**: `sts.contoso.com,sts.contoso2.com`
|
||||
|
||||
3. Add as many locations as you need, and then select **OK**.
|
||||
|
||||
The **Add or edit corporate network definition** box closes.
|
||||
|
||||
4. Decide if you want to Windows to look for additional network settings and if you want to show the WIP icon on your corporate files while in File Explorer.
|
||||
|
||||
:::image type="content" alt-text="Create Configuration Item wizard, Add whether to search for additional network settings" source="images/wip-configmgr-optsettings.png":::
|
||||
|
||||
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Select this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. Not configured is the default option.
|
||||
|
||||
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Select this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option.
|
||||
|
||||
- **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Select this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option.
|
||||
|
||||
5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, select **Browse** to add a data recovery certificate for your policy.
|
||||
|
||||
|
||||
|
||||
After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees' local device drive. If somehow the employees' local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data.
|
||||
|
||||
For more info about how to find and export your data recovery certificate, see [Data Recovery and Encrypting File System (EFS)](/previous-versions/tn-archive/cc512680(v=technet.10)). For more info about creating and verifying your EFS DRA certificate, see [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md).
|
||||
|
||||
## Choose your optional WIP-related settings
|
||||
After you've decided where your protected apps can access enterprise data on your network, you'll be asked to decide if you want to add any optional WIP settings.
|
||||
|
||||
|
||||
|
||||
**To set your optional settings**
|
||||
1. Choose to set any or all of the optional settings:
|
||||
|
||||
- **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are:
|
||||
|
||||
- **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps.
|
||||
|
||||
- **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps.
|
||||
|
||||
- **Revoke local encryption keys during the unenrollment process.** Determines whether to revoke a user's local encryption keys from a device when it's unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are:
|
||||
|
||||
- **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment.
|
||||
|
||||
- **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you're migrating between Mobile Device Management (MDM) solutions.
|
||||
|
||||
- **Allow Azure RMS.** Enables secure sharing of files by using removable media such as USB drives. For more information about how RMS works with WIP, see [Create a WIP policy using Intune](create-wip-policy-using-intune-azure.md). To confirm what templates your tenant has, run [Get-AadrmTemplate](/powershell/module/aadrm/get-aadrmtemplate) from the [AADRM PowerShell module](/azure/information-protection/administer-powershell). If you don't specify a template, WIP uses a key from a default RMS template that everyone in the tenant will have access to.
|
||||
|
||||
2. After you pick all of the settings you want to include, select **Summary**.
|
||||
|
||||
## Review your configuration choices in the Summary screen
|
||||
After you've finished configuring your policy, you can review all of your info on the **Summary** screen.
|
||||
|
||||
**To view the Summary screen**
|
||||
- Select the **Summary** button to review your policy choices, and then select **Next** to finish and to save your policy.
|
||||
|
||||
|
||||
|
||||
A progress bar appears, showing you progress for your policy. After it's done, select **Close** to return to the **Configuration Items** page.
|
||||
|
||||
## Deploy the WIP policy
|
||||
After you've created your WIP policy, you'll need to deploy it to your organization's devices. For more information about your deployment options, see the following articles:
|
||||
|
||||
- [Create configuration baselines in Configuration Manager](/mem/configmgr/compliance/deploy-use/create-configuration-baselines)
|
||||
|
||||
- [How to deploy configuration baselines in Configuration Manager](/mem/configmgr/compliance/deploy-use/deploy-configuration-baselines)
|
||||
|
||||
## Related articles
|
||||
|
||||
- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md)
|
||||
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
|
||||
|
||||
- [Limitations while using Windows Information Protection (WIP)](limitations-with-wip.md)
|
||||
@ -1,605 +0,0 @@
|
||||
---
|
||||
title: Create a WIP policy in Intune
|
||||
description: Learn how to use the Microsoft Intune admin center to create and deploy your Windows Information Protection (WIP) policy to protect data on your network.
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.reviewer: rafals
|
||||
ms.topic: how-to
|
||||
ms.date: 07/15/2022
|
||||
---
|
||||
|
||||
# Create a Windows Information Protection policy in Microsoft Intune
|
||||
|
||||
[!INCLUDE [Deprecate Windows Information Protection](includes/wip-deprecation.md)]
|
||||
<!-- 6010051 -->
|
||||
|
||||
_Applies to:_
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
Microsoft Intune has an easy way to create and deploy a Windows Information Protection (WIP) policy. You can choose which apps to protect, the level of protection, and how to find enterprise data on the network. The devices can be fully managed by Mobile Device Management (MDM), or managed by Mobile Application Management (MAM), where Intune manages only the apps on a user's personal device.
|
||||
|
||||
## Differences between MDM and MAM for WIP
|
||||
|
||||
You can create an app protection policy in Intune either with device enrollment for MDM or without device enrollment for MAM. The process to create either policy is similar, but there are important differences:
|
||||
|
||||
- MAM has more **Access** settings for Windows Hello for Business.
|
||||
- MAM can [selectively wipe company data](/intune/apps-selective-wipe) from a user's personal device.
|
||||
- MAM requires an [Microsoft Entra ID P1 or P2 license](/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses).
|
||||
- A Microsoft Entra ID P1 or P2 license is also required for WIP auto-recovery, where a device can re-enroll and regain access to protected data. WIP auto-recovery depends on Microsoft Entra registration to back up the encryption keys, which requires device auto-enrollment with MDM.
|
||||
- MAM supports only one user per device.
|
||||
- MAM can only manage [enlightened apps](enlightened-microsoft-apps-and-wip.md).
|
||||
- Only MDM can use [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp) policies.
|
||||
- If the same user and device are targeted for both MDM and MAM, the MDM policy will be applied to devices joined to Microsoft Entra ID. For personal devices that are workplace-joined (that is, added by using **Settings** > **Email & accounts** > **Add a work or school account**), the MAM-only policy will be preferred but it's possible to upgrade the device management to MDM in **Settings**. Windows Home edition only supports WIP for MAM-only; upgrading to MDM policy on Home edition will revoke WIP-protected data access.
|
||||
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Before you can create a WIP policy using Intune, you need to configure an MDM or MAM provider in Microsoft Entra ID. MAM requires an [Microsoft Entra ID P1 or P2 license](/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). A Microsoft Entra ID P1 or P2 license is also required for WIP auto-recovery, where a device can re-enroll and regain access to protected data. WIP auto-recovery relies on Microsoft Entra registration to back up the encryption keys, which requires device auto-enrollment with MDM.
|
||||
|
||||
## Configure the MDM or MAM provider
|
||||
|
||||
1. Sign in to the Azure portal.
|
||||
|
||||
2. Select **Microsoft Entra ID** > **Mobility (MDM and MAM)** > **Microsoft Intune**.
|
||||
|
||||
3. Select **Restore Default URLs** or enter the settings for MDM or MAM user scope and select **Save**:
|
||||
|
||||
|
||||
|
||||
## Create a WIP policy
|
||||
|
||||
1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
|
||||
2. Open Microsoft Intune and select **Apps** > **App protection policies** > **Create policy**.
|
||||
|
||||
|
||||
|
||||
3. In the **App policy** screen, select **Add a policy**, and then fill out the fields:
|
||||
|
||||
- **Name.** Type a name (required) for your new policy.
|
||||
|
||||
- **Description.** Type an optional description.
|
||||
|
||||
- **Platform.** Choose **Windows 10**.
|
||||
|
||||
- **Enrollment state.** Choose **Without enrollment** for MAM or **With enrollment** for MDM.
|
||||
|
||||
|
||||
|
||||
4. Select **Protected apps** and then select **Add apps**.
|
||||
|
||||
|
||||
|
||||
You can add these types of apps:
|
||||
|
||||
- [Recommended apps](#add-recommended-apps)
|
||||
- [Store apps](#add-store-apps)
|
||||
- [Desktop apps](#add-desktop-apps)
|
||||
|
||||
>[!NOTE]
|
||||
>An application might return access denied errors after removing it from the list of protected apps. Rather than remove it from the list, uninstall and reinstall the application or exempt it from WIP policy.
|
||||
|
||||
### Add recommended apps
|
||||
|
||||
Select **Recommended apps** and select each app you want to access your enterprise data or select them all, and select **OK**.
|
||||
|
||||
|
||||
|
||||
### Add Store apps
|
||||
|
||||
Select **Store apps**, type the app product name and publisher, and select **OK**. For example, to add the Power BI Mobile App from the Store, type the following:
|
||||
|
||||
- **Name**: Microsoft Power BI
|
||||
- **Publisher**: `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`
|
||||
- **Product Name**: `Microsoft.MicrosoftPowerBIForWindows`
|
||||
|
||||
|
||||
|
||||
To add multiple Store apps, select the ellipsis `…`.
|
||||
|
||||
If you don't know the Store app publisher or product name, you can find them by following these steps.
|
||||
|
||||
1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Power BI Mobile App*.
|
||||
|
||||
2. Copy the ID value from the app URL. For example, the Power BI Mobile App ID URL is `https://www.microsoft.com/store/p/microsoft-power-bi/9nblgggzlxn1`, and you'd copy the ID value, `9nblgggzlxn1`.
|
||||
|
||||
3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run `https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata`, where `9nblgggzlxn1` is replaced with your ID value.
|
||||
|
||||
The API runs and opens a text editor with the app details.
|
||||
|
||||
```json
|
||||
{
|
||||
"packageIdentityName": "Microsoft.MicrosoftPowerBIForWindows",
|
||||
"publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
|
||||
}
|
||||
```
|
||||
|
||||
4. Copy the `publisherCertificateName` value into the **Publisher** box and copy the `packageIdentityName` value into the **Name** box of Intune.
|
||||
|
||||
>[!Important]
|
||||
>The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that's using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.
|
||||
>
|
||||
> For example:
|
||||
>
|
||||
> ```json
|
||||
> {
|
||||
> "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
|
||||
> }
|
||||
|
||||
<!-- 01.06.2022 mandia: Commenting out, as these events are specific to Windows Phone.
|
||||
|
||||
> [!NOTE]
|
||||
> Your PC and phone must be on the same wireless network.
|
||||
|
||||
1. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**.
|
||||
|
||||
2. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**.
|
||||
|
||||
3. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate.
|
||||
|
||||
4. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step.
|
||||
|
||||
6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names.
|
||||
|
||||
7. Start the app for which you're looking for the publisher and product name values.
|
||||
|
||||
8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune.
|
||||
|
||||
>[!Important]
|
||||
>The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that's using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.
|
||||
>
|
||||
> For example:
|
||||
>
|
||||
> ```json
|
||||
> {
|
||||
> "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
|
||||
> }
|
||||
|
||||
-->
|
||||
|
||||
### Add Desktop apps
|
||||
|
||||
To add **Desktop apps**, complete the following fields, based on what results you want returned.
|
||||
|
||||
|Field|Manages|
|
||||
|--- |--- |
|
||||
|All fields marked as `*`|All files signed by any publisher. (Not recommended and may not work)|
|
||||
|Publisher only|If you only fill out this field, you'll get all files signed by the named publisher. This might be useful if your company is the publisher and signer of internal line-of-business apps.|
|
||||
|Publisher and Name only|If you only fill out these fields, you'll get all files for the specified product, signed by the named publisher.|
|
||||
|Publisher, Name, and File only|If you only fill out these fields, you'll get any version of the named file or package for the specified product, signed by the named publisher.|
|
||||
|Publisher, Name, File, and Min version only|If you only fill out these fields, you'll get the specified version or newer releases of the named file or package for the specified product, signed by the named publisher. This option is recommended for enlightened apps that weren't previously enlightened.|
|
||||
|Publisher, Name, File, and Max version only|If you only fill out these fields, you'll get the specified version or older releases of the named file or package for the specified product, signed by the named publisher.|
|
||||
|All fields completed|If you fill out all fields, you'll get the specified version of the named file or package for the specified product, signed by the named publisher.|
|
||||
|
||||
To add another Desktop app, select the ellipsis `…`. After you've entered the info into the fields, select **OK**.
|
||||
|
||||
|
||||
|
||||
If you're unsure about what to include for the publisher, you can run this PowerShell command:
|
||||
|
||||
```powershell
|
||||
Get-AppLockerFileInformation -Path "<path_of_the_exe>"
|
||||
```
|
||||
|
||||
Where `"<path_of_the_exe>"` goes to the location of the app on the device. For example:
|
||||
|
||||
```powershell
|
||||
Get-AppLockerFileInformation -Path "C:\Program Files\Windows NT\Accessories\wordpad.exe"
|
||||
```
|
||||
|
||||
In this example, you'd get the following info:
|
||||
|
||||
```console
|
||||
Path Publisher
|
||||
---- ---------
|
||||
%PROGRAMFILES%\WINDOWS NT\ACCESSORIES\WORDPAD.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US
|
||||
```
|
||||
|
||||
Where `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the **Publisher** name and `WORDPAD.EXE` is the **File** name.
|
||||
|
||||
Regarding to how to get the Product Name for the Apps you wish to Add, contact the Windows Support Team to request the guidelines
|
||||
|
||||
### Import a list of apps
|
||||
|
||||
This section covers two examples of using an AppLocker XML file to the **Protected apps** list. You'll use this option if you want to add multiple apps at the same time.
|
||||
|
||||
- [Create a Packaged App rule for Store apps](#create-a-packaged-app-rule-for-store-apps)
|
||||
- [Create an Executable rule for unsigned apps](#create-an-executable-rule-for-unsigned-apps)
|
||||
|
||||
For more info about AppLocker, see the [AppLocker](../../application-security/application-control/windows-defender-application-control/applocker/applocker-overview.md) content.
|
||||
|
||||
#### Create a Packaged App rule for Store apps
|
||||
|
||||
1. Open the Local Security Policy snap-in (SecPol.msc).
|
||||
|
||||
2. Expand **Application Control Policies**, expand **AppLocker**, and then select **Packaged App Rules**.
|
||||
|
||||
|
||||
|
||||
3. Right-click in the right side, and then select **Create New Rule**.
|
||||
|
||||
The **Create Packaged app Rules** wizard appears.
|
||||
|
||||
4. On the **Before You Begin** page, select **Next**.
|
||||
|
||||
|
||||
|
||||
5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then select **Next**.
|
||||
|
||||
|
||||
|
||||
6. On the **Publisher** page, choose **Select** from the **Use an installed packaged app as a reference** area.
|
||||
|
||||
|
||||
|
||||
7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then select **OK**. For this example, we're using Microsoft Dynamics 365.
|
||||
|
||||
|
||||
|
||||
8. On the updated **Publisher** page, select **Create**.
|
||||
|
||||
|
||||
|
||||
9. Select **No** in the dialog box that appears, asking if you want to create the default rules. Don't create default rules for your WIP policy.
|
||||
|
||||
|
||||
|
||||
9. Review the Local Security Policy snap-in to make sure your rule is correct.
|
||||
|
||||
|
||||
|
||||
10. On the left, right-click on **AppLocker**, and then select **Export policy**.
|
||||
|
||||
The **Export policy** box opens, letting you export and save your new policy as XML.
|
||||
|
||||
|
||||
|
||||
11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then select **Save**.
|
||||
|
||||
The policy is saved and you'll see a message that says one rule was exported from the policy.
|
||||
|
||||
**Example XML file**<br>
|
||||
This is the XML file that AppLocker creates for Microsoft Dynamics 365.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0"?>
|
||||
<AppLockerPolicy Version="1">
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Appx">
|
||||
<FilePublisherRule Action="Allow" UserOrGroupSid="S-1-1-0" Description="" Name="Microsoft.MicrosoftDynamicsCRMforWindows10, version 3.2.0.0 and above, from Microsoft Corporation" Id="3da34ed9-aec6-4239-88ba-0afdce252ab4">
|
||||
<Conditions>
|
||||
<FilePublisherCondition BinaryName="*" ProductName="Microsoft.MicrosoftDynamicsCRMforWindows10" PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US">
|
||||
<BinaryVersionRange HighSection="*" LowSection="3.2.0.0"/>
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
</RuleCollection>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Dll"/>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Exe"/>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Msi"/>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Script"/>
|
||||
</AppLockerPolicy>
|
||||
```
|
||||
|
||||
12. After you've created your XML file, you need to import it by using Microsoft Intune.
|
||||
|
||||
## Create an Executable rule for unsigned apps
|
||||
|
||||
The executable rule helps to create an AppLocker rule to sign any unsigned apps. It enables adding the file path or the app publisher contained in the file's digital signature needed for the WIP policy to be applied.
|
||||
|
||||
1. Open the Local Security Policy snap-in (SecPol.msc).
|
||||
|
||||
2. In the left pane, select **Application Control Policies** > **AppLocker** > **Executable Rules**.
|
||||
|
||||
3. Right-click **Executable Rules** > **Create New Rule**.
|
||||
|
||||
|
||||
|
||||
4. On the **Before You Begin** page, select **Next**.
|
||||
|
||||
5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then select **Next**.
|
||||
|
||||
6. On the **Conditions** page, select **Path** and then select **Next**.
|
||||
|
||||
|
||||
|
||||
7. Select **Browse Folders...** and select the path for the unsigned apps. For this example, we're using "C:\Program Files".
|
||||
|
||||
|
||||
|
||||
8. On the **Exceptions** page, add any exceptions and then select **Next**.
|
||||
|
||||
9. On the **Name** page, type a name and description for the rule and then select **Create**.
|
||||
|
||||
10. In the left pane, right-click **AppLocker** > **Export policy**.
|
||||
|
||||
11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then select **Save**.
|
||||
|
||||
The policy is saved and you'll see a message that says one rule was exported from the policy.
|
||||
|
||||
12. After you've created your XML file, you need to import it by using Microsoft Intune.
|
||||
|
||||
|
||||
**To import a list of protected apps using Microsoft Intune**
|
||||
|
||||
1. In **Protected apps**, select **Import apps**.
|
||||
|
||||
|
||||
|
||||
Then import your file.
|
||||
|
||||
|
||||
|
||||
2. Browse to your exported AppLocker policy file, and then select **Open**.
|
||||
|
||||
The file imports and the apps are added to your **Protected apps** list.
|
||||
|
||||
### Exempt apps from a WIP policy
|
||||
If your app is incompatible with WIP, but still needs to be used with enterprise data, then you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak.
|
||||
|
||||
1. In **Client apps - App protection policies**, select **Exempt apps**.
|
||||
|
||||
|
||||
|
||||
2. In **Exempt apps**, select **Add apps**.
|
||||
|
||||
When you exempt apps, they're allowed to bypass the WIP restrictions and access your corporate data.
|
||||
|
||||
3. Fill out the rest of the app info, based on the type of app you're adding:
|
||||
|
||||
- [Add Recommended apps](#add-recommended-apps)
|
||||
|
||||
- [Add Store apps](#add-store-apps)
|
||||
|
||||
- [Add Desktop apps](#add-desktop-apps)
|
||||
|
||||
- [Import apps](#import-a-list-of-apps)
|
||||
|
||||
4. Select **OK**.
|
||||
|
||||
## Manage the WIP protection mode for your enterprise data
|
||||
After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode.
|
||||
|
||||
We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, **Block**.
|
||||
|
||||
1. From **App protection policy**, select the name of your policy, and then select **Required settings**.
|
||||
|
||||
|
||||
|
||||
|Mode |Description |
|
||||
|-----|------------|
|
||||
|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.|
|
||||
|Allow Overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).|
|
||||
|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would have been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.|
|
||||
|Off |WIP is turned off and doesn't help to protect or audit your data.<br><br>After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Your previous decryption and policy info isn't automatically reapplied if you turn WIP protection back on. For more information, see [How to disable Windows Information Protection](how-to-disable-wip.md).|
|
||||
|
||||
2. Select **Save**.
|
||||
|
||||
## Define your enterprise-managed corporate identity
|
||||
Corporate identity, typically expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you've marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies.
|
||||
|
||||
Starting with Windows 10, version 1703, Intune automatically determines your corporate identity and adds it to the **Corporate identity** field.
|
||||
|
||||
**To change your corporate identity**
|
||||
|
||||
1. From **App policy**, select the name of your policy, and then select **Required settings**.
|
||||
|
||||
2. If the auto-defined identity isn't correct, you can change the info in the **Corporate identity** field.
|
||||
|
||||
|
||||
|
||||
3. To add domains, such your email domain names, select **Configure Advanced settings** > **Add network boundary** and select **Protected domains**.
|
||||
|
||||
|
||||
|
||||
## Choose where apps can access enterprise data
|
||||
After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. Every WIP policy should include your enterprise network locations.
|
||||
|
||||
There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise's range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT).
|
||||
|
||||
To define the network boundaries, select **App policy** > the name of your policy > **Advanced settings** > **Add network boundary**.
|
||||
|
||||
|
||||
|
||||
Select the type of network boundary to add from the **Boundary type** box. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the options covered in the following subsections, and then select **OK**.
|
||||
|
||||
### Cloud resources
|
||||
|
||||
Specify the cloud resources to be treated as corporate and protected by WIP.
|
||||
For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource.
|
||||
All traffic routed through your Internal proxy servers is considered enterprise.
|
||||
|
||||
Separate multiple resources with the "|" delimiter.
|
||||
For example:
|
||||
|
||||
```console
|
||||
URL <,proxy>|URL <,proxy>
|
||||
```
|
||||
|
||||
Personal applications can access a cloud resource that has a blank space or an invalid character, such as a trailing dot in the URL.
|
||||
|
||||
To add a subdomain for a cloud resource, use a period (.) instead of an asterisk (*). For example, to add all subdomains within Office.com, use ".office.com" (without the quotation marks).
|
||||
|
||||
In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can't tell whether it's attempting to connect to an enterprise cloud resource or to a personal site.
|
||||
In this case, Windows blocks the connection by default.
|
||||
To stop Windows from automatically blocking these connections, you can add the `/*AppCompat*/` string to the setting.
|
||||
For example:
|
||||
|
||||
```console
|
||||
URL <,proxy>|URL <,proxy>|/*AppCompat*/
|
||||
```
|
||||
|
||||
When you use this string, we recommend that you also turn on [Microsoft Entra Conditional Access](/azure/active-directory/active-directory-conditional-access), using the **Domain joined or marked as compliant** option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.
|
||||
|
||||
Value format with proxy:
|
||||
|
||||
```console
|
||||
contoso.sharepoint.com,contoso.internalproxy1.com|contoso.visualstudio.com,contoso.internalproxy2.com
|
||||
```
|
||||
|
||||
Value format without proxy:
|
||||
|
||||
```console
|
||||
contoso.sharepoint.com|contoso.visualstudio.com|contoso.onedrive.com,
|
||||
```
|
||||
|
||||
### Protected domains
|
||||
|
||||
Specify the domains used for identities in your environment.
|
||||
All traffic to the fully qualified domains appearing in this list will be protected.
|
||||
Separate multiple domains with the "|" delimiter.
|
||||
|
||||
```console
|
||||
exchange.contoso.com|contoso.com|region.contoso.com
|
||||
```
|
||||
|
||||
### Network domains
|
||||
|
||||
Specify the DNS suffixes used in your environment.
|
||||
All traffic to the fully qualified domains appearing in this list will be protected.
|
||||
Separate multiple resources with the "," delimiter.
|
||||
|
||||
```console
|
||||
corp.contoso.com,region.contoso.com
|
||||
```
|
||||
|
||||
### Proxy servers
|
||||
|
||||
Specify the proxy servers your devices will go through to reach your cloud resources.
|
||||
Using this server type indicates that the cloud resources you're connecting to are enterprise resources.
|
||||
|
||||
This list shouldn't include any servers listed in your Internal proxy servers list.
|
||||
Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.
|
||||
Separate multiple resources with the ";" delimiter.
|
||||
|
||||
```console
|
||||
proxy.contoso.com:80;proxy2.contoso.com:443
|
||||
```
|
||||
|
||||
### Internal proxy servers
|
||||
|
||||
Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you're connecting to are enterprise resources.
|
||||
|
||||
This list shouldn't include any servers listed in your Proxy servers list.
|
||||
Internal proxy servers must be used only for WIP-protected (enterprise) traffic.
|
||||
Separate multiple resources with the ";" delimiter.
|
||||
|
||||
```console
|
||||
contoso.internalproxy1.com;contoso.internalproxy2.com
|
||||
```
|
||||
|
||||
### IPv4 ranges
|
||||
|
||||
Specify the addresses for a valid IPv4 value range within your intranet.
|
||||
These addresses, used with your Network domain names, define your corporate network boundaries.
|
||||
Classless Inter-Domain Routing (CIDR) notation isn't supported.
|
||||
|
||||
Separate multiple ranges with the "," delimiter.
|
||||
|
||||
**Starting IPv4 Address:** 3.4.0.1<br/>
|
||||
**Ending IPv4 Address:** 3.4.255.254<br/>
|
||||
**Custom URI:** 3.4.0.1-3.4.255.254,<br/>
|
||||
10.0.0.1-10.255.255.254
|
||||
|
||||
### IPv6 ranges
|
||||
|
||||
Starting with Windows 10, version 1703, this field is optional.
|
||||
|
||||
Specify the addresses for a valid IPv6 value range within your intranet.
|
||||
These addresses, used with your network domain names, define your corporate network boundaries.
|
||||
Classless Inter-Domain Routing (CIDR) notation isn't supported.
|
||||
|
||||
Separate multiple ranges with the "," delimiter.
|
||||
|
||||
**Starting IPv6 Address:** `2a01:110::`</br>
|
||||
**Ending IPv6 Address:** `2a01:110:7fff:ffff:ffff:ffff:ffff:ffff`<br>
|
||||
**Custom URI:** `2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,'<br>'fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff`
|
||||
|
||||
### Neutral resources
|
||||
|
||||
Specify your authentication redirection endpoints for your company.
|
||||
These locations are considered enterprise or personal, based on the context of the connection before the redirection.
|
||||
Separate multiple resources with the "," delimiter.
|
||||
|
||||
```console
|
||||
sts.contoso.com,sts.contoso2.com
|
||||
```
|
||||
|
||||
Decide if you want Windows to look for more network settings:
|
||||
|
||||
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Turn on if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you turn this off, Windows will search for more proxy servers in your immediate network.
|
||||
|
||||
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Turn on if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you turn this off, Windows will search for more IP ranges on any domain-joined devices connected to your network.
|
||||
|
||||
|
||||
|
||||
## Upload your Data Recovery Agent (DRA) certificate
|
||||
After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees' local device drive. If somehow the employees' local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data.
|
||||
|
||||
>[!Important]
|
||||
>Using a DRA certificate isn't mandatory. However, we strongly recommend it. For more info about how to find and export your data recovery certificate, see [Data Recovery and Encrypting File System (EFS)](/previous-versions/tn-archive/cc512680(v=technet.10)). For more info about creating and verifying your EFS DRA certificate, see [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate).
|
||||
|
||||
**To upload your DRA certificate**
|
||||
1. From **App policy**, select the name of your policy, and then select **Advanced settings** from the menu that appears.
|
||||
|
||||
**Advanced settings** shows.
|
||||
|
||||
2. In the **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, select **Browse** to add a data recovery certificate for your policy.
|
||||
|
||||
|
||||
|
||||
## Choose your optional WIP-related settings
|
||||
After you've decided where your protected apps can access enterprise data on your network, you can choose optional settings.
|
||||
|
||||
|
||||
|
||||
**Revoke encryption keys on unenroll.** Determines whether to revoke a user's local encryption keys from a device when it's unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are:
|
||||
|
||||
- **On, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment.
|
||||
|
||||
- **Off.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you're migrating between Mobile Device Management (MDM) solutions.
|
||||
|
||||
**Show the enterprise data protection icon.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are:
|
||||
|
||||
- **On.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Also, for unenlightened but protected apps, the icon overlay also appears on the app tile and with Managed text on the app name in the **Start** menu.
|
||||
|
||||
- **Off, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but protected apps. Not configured is the default option.
|
||||
|
||||
**Use Azure RMS for WIP.** Determines whether WIP uses [Microsoft Azure Rights Management](/azure/information-protection/what-is-azure-rms) to apply EFS encryption to files that are copied from Windows 10 to USB or other removable drives so they can be securely shared with employees. In other words, WIP uses Azure Rights Management "machinery" to apply EFS encryption to files when they're copied to removable drives. You must already have Azure Rights Management set up. The EFS file encryption key is protected by the RMS template's license. Only users with permission to that template can read it from the removable drive. WIP can also integrate with Azure RMS by using the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings in the [EnterpriseDataProtection CSP](/windows/client-management/mdm/enterprisedataprotection-csp).
|
||||
|
||||
- **On.** Protects files that are copied to a removable drive. You can enter a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. The RMS template is only applied to the files on removable media, and is only used for access control—it doesn't actually apply Azure Information Protection to the files.
|
||||
|
||||
If you don't specify an [RMS template](/information-protection/deploy-use/configure-custom-templates), it's a regular EFS file using a default RMS template that all users can access.
|
||||
|
||||
- **Off, or not configured.** Stops WIP from encrypting Azure Rights Management files that are copied to a removable drive.
|
||||
|
||||
> [!NOTE]
|
||||
> Regardless of this setting, all files in OneDrive for Business will be encrypted, including moved Known Folders.
|
||||
|
||||
**Allow Windows Search Indexer to search encrypted files.** Determines whether to allow the Windows Search Indexer to index items that are encrypted, such as WIP protected files.
|
||||
|
||||
- **On.** Starts Windows Search Indexer to index encrypted files.
|
||||
|
||||
- **Off, or not configured.** Stops Windows Search Indexer from indexing encrypted files.
|
||||
|
||||
## Encrypted file extensions
|
||||
|
||||
You can restrict which files are protected by WIP when they're downloaded from an SMB share within your enterprise network locations. If this setting is configured, only files with the extensions in the list will be encrypted. If this setting is not specified, the existing auto-encryption behavior is applied.
|
||||
|
||||
|
||||
|
||||
## Related articles
|
||||
|
||||
- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md)
|
||||
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
|
||||
|
||||
- [What is Azure Rights Management?](/information-protection/understand-explore/what-is-azure-rms)
|
||||
|
||||
- [Create a Windows Information Protection (WIP) protection policy using Microsoft Intune](overview-create-wip-policy.md)
|
||||
|
||||
- [Intune MAM Without Enrollment](/archive/blogs/configmgrdogs/intune-mam-without-enrollment)
|
||||
|
||||
- [Azure RMS Documentation Update for May 2016](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/azure-rms-documentation-update-for-may-2016/)
|
||||
@ -1,36 +0,0 @@
|
||||
---
|
||||
title: Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune
|
||||
description: After you've created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices.
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 03/05/2019
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
After you've created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. Enrollment can be done for business or personal devices, allowing the devices to use your managed apps and to sync with your managed content and information.
|
||||
|
||||
## To deploy your WIP policy
|
||||
|
||||
1. On the **App protection policies** pane, click your newly created policy, click **Assignments**, and then select groups to include or exclude from the policy.
|
||||
|
||||
2. Choose the group you want your policy to apply to, and then click **Select** to deploy the policy.
|
||||
|
||||
The policy is deployed to the selected users' devices.
|
||||
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
|
||||
## Related topics
|
||||
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
|
||||
@ -1,111 +0,0 @@
|
||||
---
|
||||
title: List of enlightened Microsoft apps for use with Windows Information Protection (WIP)
|
||||
description: Learn the difference between enlightened and unenlightened apps. Find out which enlightened apps are provided by Microsoft. Learn how to allow-list them.
|
||||
ms.reviewer:
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 05/02/2019
|
||||
---
|
||||
|
||||
# List of enlightened Microsoft apps for use with Windows Information Protection (WIP)
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list.
|
||||
|
||||
## Enlightened versus unenlightened apps
|
||||
Apps can be enlightened or unenlightened:
|
||||
|
||||
- **Enlightened apps** can differentiate between corporate and personal data, correctly determining which to protect, based on your policies.
|
||||
|
||||
- **Unenlightened apps** consider all data corporate and encrypt everything. Typically, you can tell an unenlightened app because:
|
||||
|
||||
- Windows Desktop shows it as always running in enterprise mode.
|
||||
|
||||
- Windows **Save As** experiences only allow you to save your files as enterprise.
|
||||
|
||||
- **Windows Information Protection-work only apps** are unenlightened line-of-business apps that have been tested and deemed safe for use in an enterprise with WIP and Mobile App Management (MAM) solutions without device enrollment. Unenlightened apps that are targeted by WIP without enrollment run under personal mode.
|
||||
|
||||
## List of enlightened Microsoft apps
|
||||
Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following:
|
||||
|
||||
- Microsoft 3D Viewer
|
||||
|
||||
- Microsoft Edge
|
||||
|
||||
- Internet Explorer 11
|
||||
|
||||
- Microsoft People
|
||||
|
||||
- Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar
|
||||
|
||||
- Microsoft 365 Apps for enterprise apps, including Word, Excel, PowerPoint, OneNote, and Outlook
|
||||
|
||||
- OneDrive app
|
||||
|
||||
- OneDrive sync client (OneDrive.exe, the next generation sync client)
|
||||
|
||||
- Microsoft Photos
|
||||
|
||||
- Groove Music
|
||||
|
||||
- Notepad
|
||||
|
||||
- Microsoft Paint
|
||||
|
||||
- Microsoft Movies & TV
|
||||
|
||||
- Microsoft Messaging
|
||||
|
||||
- Microsoft Remote Desktop
|
||||
|
||||
- Microsoft To Do
|
||||
|
||||
> [!NOTE]
|
||||
> Microsoft Visio, Microsoft Office Access, Microsoft Project, and Microsoft Publisher are not enlightened apps and need to be exempted from Windows Information Protection policy. If they are allowed, there is a risk of data loss. For example, if a device is workplace-joined and managed and the user leaves the company, metadata files that the apps rely on remain encrypted and the apps stop functioning.
|
||||
|
||||
## List of WIP-work only apps from Microsoft
|
||||
Microsoft still has apps that are unenlightened, but which have been tested and deemed safe for use in an enterprise with Windows Information Protection and MAM solutions.
|
||||
|
||||
- Skype for Business
|
||||
|
||||
- Microsoft Teams (build 1.3.00.12058 and later)
|
||||
|
||||
## Adding enlightened Microsoft apps to the allowed apps list
|
||||
|
||||
> [!NOTE]
|
||||
> As of January 2019 it is no longer necessary to add Intune Company Portal as an exempt app since it is now included in the default list of protected apps.
|
||||
|
||||
You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and Microsoft Configuration Manager.
|
||||
|
||||
|
||||
| Product name | App info |
|
||||
|------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| Microsoft 3D Viewer | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Microsoft3DViewer<br>**App Type:** Universal app |
|
||||
| Microsoft Edge | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.MicrosoftEdge<br>**App Type:** Universal app |
|
||||
| Microsoft People | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.People<br>**App Type:** Universal app |
|
||||
| Word Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.Word<br>**App Type:** Universal app |
|
||||
| Excel Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.Excel<br>**App Type:** Universal app |
|
||||
| PowerPoint Mobile | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.PowerPoint<br>**App Type:** Universal app |
|
||||
| OneNote | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.OneNote<br>**App Type:** Universal app |
|
||||
| Outlook Mail and Calendar | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** microsoft.windowscommunicationsapps<br>**App Type:** Universal app |
|
||||
| Microsoft 365 Apps for enterprise and Office 2019 Professional Plus | Microsoft 365 Apps for enterprise and Office 2019 Professional Plus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](https://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for Windows Information Protection.<br>We don't recommend setting up Office by using individual paths or publisher rules. |
|
||||
| Microsoft Photos | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Windows.Photos<br>**App Type:** Universal app |
|
||||
| Groove Music | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.ZuneMusic<br>**App Type:** Universal app |
|
||||
| Microsoft Movies & TV | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.ZuneVideo<br>**App Type:** Universal app |
|
||||
| Microsoft Messaging | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Messaging<br>**App Type:** Universal app |
|
||||
| IE11 | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** iexplore.exe<br>**App Type:** Desktop app |
|
||||
| OneDrive Sync Client | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** onedrive.exe<br>**App Type:** Desktop app |
|
||||
| OneDrive app | **Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Microsoftskydrive<br><b>Product Version:</b>Product version: 17.21.0.0 (and later)<br>**App Type:** Universal app |
|
||||
| Notepad | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** notepad.exe<br>**App Type:** Desktop app |
|
||||
| Microsoft Paint | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** mspaint.exe<br>**App Type:** Desktop app |
|
||||
| Microsoft Remote Desktop | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** mstsc.exe<br>**App Type:** Desktop app |
|
||||
| Microsoft MAPI Repair Tool | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** fixmapi.exe<br>**App Type:** Desktop app |
|
||||
| Microsoft To Do | **Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Todos<br>**App Type:** Store app |
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,28 +0,0 @@
|
||||
---
|
||||
title: General guidance and best practices for Windows Information Protection (WIP)
|
||||
description: Find resources about apps that can work with Windows Information Protection (WIP) to protect data. Enlightened apps can tell corporate and personal data apart.
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/26/2019
|
||||
---
|
||||
|
||||
# General guidance and best practices for Windows Information Protection (WIP)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
This section includes info about the enlightened Microsoft apps, including how to add them to your allowed apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with Windows Information Protection (WIP).
|
||||
|
||||
## In this section
|
||||
|
||||
|Topic |Description |
|
||||
|------|------------|
|
||||
|[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. |
|
||||
|[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |Learn the difference between enlightened and unenlightened app behaviors. |
|
||||
|[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |Recommended additions for the Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). |
|
||||
|[Using Outlook on the web with Windows Information Protection (WIP)](using-owa-with-wip.md) |Options for using Outlook on the web with Windows Information Protection (WIP). |
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,124 +0,0 @@
|
||||
---
|
||||
title: How to disable Windows Information Protection (WIP)
|
||||
description: How to disable Windows Information Protection (WIP) in Microsoft Intune or Microsoft Configuration Manager.
|
||||
ms.date: 07/21/2022
|
||||
ms.topic: how-to
|
||||
author: lizgt2000
|
||||
ms.author: lizlong
|
||||
ms.reviewer: aaroncz
|
||||
manager: aaroncz
|
||||
---
|
||||
|
||||
# How to disable Windows Information Protection (WIP)
|
||||
|
||||
[!INCLUDE [wip-deprecation](includes/wip-deprecation.md)]
|
||||
<!-- 6010051 -->
|
||||
|
||||
_Applies to:_
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
## Use Intune to disable WIP
|
||||
|
||||
To disable Windows Information Protection (WIP) using Intune, you have the following options:
|
||||
|
||||
### Option 1 - Unassign the WIP policy (preferred)
|
||||
|
||||
When you unassign an existing policy, it removes the intent to deploy WIP from those devices. When that intent is removed, the device removes protection for files and the configuration for WIP. For more information, see [Assign user and device profiles in Microsoft Intune](/mem/intune/configuration/device-profile-assign).
|
||||
|
||||
### Option 2 - Change current WIP policy to off
|
||||
|
||||
If you're currently deploying a WIP policy for enrolled or unenrolled devices, you switch the WIP policy to Off. When devices check in after this change, the devices will proceed to unprotect files previously protected by WIP.
|
||||
|
||||
1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
1. Open Microsoft Intune and select **Apps** > **App protection policies**.
|
||||
1. Select the existing policy to turn off, and then select the **Properties**.
|
||||
1. Edit **Required settings**.
|
||||
:::image type="content" alt-text="Intune App Protection policy properties, required settings, with WIP mode Off." source="images/intune-edit-app-protection-policy-mode-off.png":::
|
||||
1. Set **Windows Information Protection mode** to off.
|
||||
1. After making this change, select **Review and Save**.
|
||||
1. Select **Save**.
|
||||
|
||||
> [!NOTE]
|
||||
> **Another option is to create a disable policy that sets WIP to Off.**
|
||||
>
|
||||
> You can create a separate disable policy for WIP (both enrolled and unenrolled) and deploy that to a new group. You then can stage the transition to this disabled state. Move devices from the existing group to the new group. This process slowly migrates devices instead of all at once.
|
||||
|
||||
### Revoke local encryption keys during the unenrollment process
|
||||
|
||||
Determine whether to revoke a user's local encryption keys from a device when it's unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are:
|
||||
|
||||
- Yes, or not configured. Revokes local encryption keys from a device during unenrollment.
|
||||
- No (recommended). Stop local encryption keys from being revoked from a device during unenrollment.
|
||||
|
||||
## Use Configuration Manager to disable WIP
|
||||
|
||||
To disable Windows Information Protection (WIP) using Configuration Manager, create a new configuration item that turns off WIP. Configure that new object for your environment to match the existing policy, except for disabling WIP. Then deploy the new policy, and move devices into the new collection.
|
||||
|
||||
> [!WARNING]
|
||||
> Don't just delete your existing WIP policy. If you delete the old policy, Configuration Manager stops sending further WIP policy updates, but also leaves WIP enforced on the devices. To remove WIP from your managed devices, follow the steps in this section to create a new policy to turn off WIP.
|
||||
|
||||
### Create a WIP policy
|
||||
|
||||
To disable WIP for your organization, first create a configuration item.
|
||||
|
||||
1. Open the Configuration Manager console, select the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node.
|
||||
|
||||
2. Select the **Create Configuration Item** button.
|
||||
The **Create Configuration Item Wizard** starts.
|
||||
|
||||
|
||||
|
||||
3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes.
|
||||
|
||||
4. In the **Specify the type of configuration item you want to create** area, select **Windows 10 or later** for devices managed with the Configuration Manager client, and then select **Next**.
|
||||
|
||||
5. On the **Supported Platforms** screen, select the **Windows 10** box, and then select **Next**.
|
||||
|
||||
6. On the **Device Settings** screen, select **Windows Information Protection**, and then select **Next**.
|
||||
|
||||
The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization. The following sections provide details on the required settings on this page.
|
||||
|
||||
> [!TIP]
|
||||
> For more information on filling out the required fields, see [Create and deploy a Windows Information Protection (WIP) policy using Microsoft Configuration Manager](/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr).
|
||||
|
||||
#### Turn off WIP
|
||||
|
||||
Of the four options to specify the restriction mode, select **Off** to turn off Windows Information Protection.
|
||||
|
||||
:::image type="content" alt-text="Create Configuration Item wizard, choose your WIP-protection level." source="images/wip-configmgr-disable-wip.png":::
|
||||
|
||||
#### Specify the corporate identity
|
||||
|
||||
Paste the value of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`.
|
||||
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> This corporate identity value must match the string in the original policy. Copy and paste the string from your original policy that enables WIP.
|
||||
|
||||
#### Specify the corporate network definition
|
||||
|
||||
For the **Corporate network definition**, select **Add** to specify the necessary network locations. The **Add or edit corporate network definition** box appears. Add the required fields.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> These corporate network definitions must match the original policy. Copy and paste the strings from your original policy that enables WIP.
|
||||
|
||||
#### Specify the data recovery agent certificate
|
||||
|
||||
In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, select **Browse** to add a data recovery certificate for your policy. This certificate should be the same as the original policy that enables WIP.
|
||||
|
||||
|
||||
|
||||
### Deploy the WIP policy
|
||||
|
||||
After you've created the new policy to turn off WIP, deploy it to your organization's devices. For more information about deployment options, see the following articles:
|
||||
|
||||
- [Create a configuration baseline that includes the new configuration item](/mem/configmgr/compliance/deploy-use/create-configuration-baselines).
|
||||
|
||||
- [Create a new collection](/mem/configmgr/core/clients/manage/collections/create-collections).
|
||||
|
||||
- [Deploy the baseline to the collection](/mem/configmgr/compliance/deploy-use/deploy-configuration-baselines).
|
||||
|
||||
- Move devices from the old collection to new collection.
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 46 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 13 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 9.3 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 6.9 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 108 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 53 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 5.4 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 18 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 26 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 27 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 43 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 59 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 66 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 65 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 52 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 9.5 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 9.5 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 50 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 41 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 45 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 50 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 48 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 90 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 58 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 10 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 3.2 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 4.6 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 51 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 42 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 3.8 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 25 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 44 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 10 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 44 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 121 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 66 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 52 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.4 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 51 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 2.8 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 44 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 46 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 46 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 49 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 26 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 23 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 256 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 250 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 13 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 5.7 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 43 KiB |
@ -1,152 +0,0 @@
|
||||
---
|
||||
title: Limitations while using Windows Information Protection (WIP)
|
||||
description: This section includes info about the common problems you might encounter while using Windows Information Protection (WIP).
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.reviewer: rafals
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/05/2019
|
||||
---
|
||||
|
||||
# Limitations while using Windows Information Protection (WIP)
|
||||
|
||||
_Applies to:_
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
This following list provides info about the most common problems you might encounter while running Windows Information Protection in your organization.
|
||||
|
||||
- **Limitation**: Your enterprise data on USB drives might be tied to the device it was protected on, based on your Azure RMS configuration.
|
||||
- **How it appears**:
|
||||
- If you're using Azure RMS: Authenticated users can open enterprise data on USB drives, on computers running Windows 10, version 1703.
|
||||
- If you're not using Azure RMS: Data in the new location remains encrypted, but becomes inaccessible on other devices and for other users. For example, the file won't open or the file opens, but doesn't contain readable text.
|
||||
|
||||
- **Workaround**: Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.
|
||||
|
||||
We strongly recommend educating employees about how to limit or eliminate the need for this decryption.
|
||||
|
||||
- **Limitation**: Direct Access is incompatible with Windows Information Protection.
|
||||
- **How it appears**: Direct Access might experience problems with how Windows Information Protection enforces app behavior and data movement because of how WIP determines what is and isn't a corporate network resource.
|
||||
- **Workaround**: We recommend that you use VPN for client access to your intranet resources.
|
||||
|
||||
> [!NOTE]
|
||||
> VPN is optional and isn't required by Windows Information Protection.
|
||||
|
||||
- **Limitation**: **NetworkIsolation** Group Policy setting takes precedence over MDM Policy settings.
|
||||
- **How it appears**: The **NetworkIsolation** Group Policy setting can configure network settings that can also be configured by using MDM. WIP relies on these policies being correctly configured.
|
||||
- **Workaround**: If you use both Group Policy and MDM to configure your **NetworkIsolation** settings, you must make sure that those same settings are deployed to your organization using both Group Policy and MDM.
|
||||
|
||||
- **Limitation**: Cortana can potentially allow data leakage if it's on the allowed apps list.
|
||||
- **How it appears**: If Cortana is on the allowed list, some files might become unexpectedly encrypted after an employee performs a search using Cortana. Your employees will still be able to use Cortana to search and provide results on enterprise documents and locations, but results might be sent to Microsoft.
|
||||
- **Workaround**: We don't recommend adding Cortana to your allowed apps list. However, if you wish to use Cortana and don't mind whether the results potentially go to Microsoft, you can make Cortana an Exempt app.
|
||||
|
||||
<a name="single-user"></a>
|
||||
|
||||
- **Limitation**: Windows Information Protection is designed for use by a single user per device.
|
||||
- **How it appears**: A secondary user on a device might experience app compatibility issues when unenlightened apps start to automatically encrypt for all users. Additionally, only the initial, enrolled user's content can be revoked during the unenrollment process.
|
||||
- **Workaround**: Have only one user per managed device.
|
||||
- If this scenario occurs, it may be possible to mitigate. Once protection is disabled, a second user can remove protection by changing the file ownership. Although the protection is in place, the file remains accessible to the user.
|
||||
|
||||
- **Limitation**: Installers copied from an enterprise network file share might not work properly.
|
||||
- **How it appears**: An app might fail to properly install because it can't read a necessary configuration or data file, such as a .cab or .xml file needed for installation, which was protected by the copy action.
|
||||
- **Workaround**: To fix this, you can:
|
||||
- Start the installer directly from the file share.
|
||||
|
||||
OR
|
||||
|
||||
- Decrypt the locally copied files needed by the installer.
|
||||
|
||||
OR
|
||||
|
||||
- Mark the file share with the installation media as "personal". To do this, you'll need to set the Enterprise IP ranges as **Authoritative** and then exclude the IP address of the file server, or you'll need to put the file server on the Enterprise Proxy Server list.
|
||||
|
||||
- **Limitation**: Changing your primary Corporate Identity isn't supported.
|
||||
- **How it appears**: You might experience various instabilities, including but not limited to network and file access failures, and potentially granting incorrect access.
|
||||
- **Workaround**: Turn off Windows Information Protection for all devices before changing the primary Corporate Identity (first entry in the list), restarting, and finally redeploying.
|
||||
|
||||
- **Limitation**: Redirected folders with Client-Side Caching are not compatible with Windows Information Protection.
|
||||
- **How it appears**: Apps might encounter access errors while attempting to read a cached, offline file.
|
||||
- **Workaround**: Migrate to use another file synchronization method, such as Work Folders or OneDrive for Business.
|
||||
|
||||
> [!NOTE]
|
||||
> For more info about Work Folders and Offline Files, see the [Work Folders and Offline Files support for Windows Information Protection blog](https://blogs.technet.microsoft.com/filecab/2016/08/29/work-folders-and-offline-files-support-for-windows-information-protection/). If you're having trouble opening files offline while using Offline Files and Windows Information Protection, see [Can't open files offline when you use Offline Files and Windows Information Protection](/troubleshoot/windows-client/networking/error-open-files-offline-offline-files-wip).
|
||||
|
||||
- **Limitation**: An unmanaged device can use Remote Desktop Protocol (RDP) to connect to a WIP-managed device.
|
||||
- **How it appears**:
|
||||
- Data copied from the WIP-managed device is marked as **Work**.
|
||||
- Data copied to the WIP-managed device is not marked as **Work**.
|
||||
- Local **Work** data copied to the WIP-managed device remains **Work** data.
|
||||
- **Work** data that is copied between two apps in the same session remains ** data.
|
||||
|
||||
- **Workaround**: Disable RDP to prevent access because there is no way to restrict access to only devices managed by Windows Information Protection. RDP is disabled by default.
|
||||
|
||||
- **Limitation**: You can't upload an enterprise file to a personal location using Microsoft Edge or Internet Explorer.
|
||||
- **How it appears**: A message appears stating that the content is marked as **Work** and the user isn't given an option to override to **Personal**.
|
||||
- **Workaround**: Open File Explorer and change the file ownership to **Personal** before you upload.
|
||||
|
||||
- **Limitation**: ActiveX controls should be used with caution.
|
||||
- **How it appears**: Webpages that use ActiveX controls can potentially communicate with other outside processes that aren't protected by using Windows Information Protection.
|
||||
- **Workaround**: We recommend that you switch to using Microsoft Edge, the more secure and safer browser that prevents the use of ActiveX controls. We also recommend that you limit the usage of Internet Explorer 11 to only those line-of-business apps that require legacy technology.
|
||||
|
||||
For more info, see [Out-of-date ActiveX control blocking](/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking).
|
||||
|
||||
- **Limitation**: Resilient File System (ReFS) isn't currently supported with Windows Information Protection.
|
||||
- **How it appears**:Trying to save or transfer Windows Information Protection files to ReFS will fail.
|
||||
- **Workaround**: Format drive for NTFS, or use a different drive.
|
||||
|
||||
- **Limitation**: Windows Information Protection isn't turned on if any of the following folders have the **MakeFolderAvailableOfflineDisabled** option set to **False**:
|
||||
- AppDataRoaming
|
||||
- Desktop
|
||||
- StartMenu
|
||||
- Documents
|
||||
- Pictures
|
||||
- Music
|
||||
- Videos
|
||||
- Favorites
|
||||
- Contacts
|
||||
- Downloads
|
||||
- Links
|
||||
- Searches
|
||||
- SavedGames
|
||||
|
||||
<br/>
|
||||
|
||||
- **How it appears**: Windows Information Protection isn't turned on for employees in your organization. Error code 0x807c0008 will result if Windows Information Protection is deployed by using Microsoft Configuration Manager.
|
||||
- **Workaround**: Don't set the **MakeFolderAvailableOfflineDisabled** option to **False** for any of the specified folders. You can configure this parameter, as described [Disable Offline Files on individual redirected folders](/windows-server/storage/folder-redirection/disable-offline-files-on-folders).
|
||||
|
||||
If you currently use redirected folders, we recommend that you migrate to a file synchronization solution that supports Windows Information Protection, such as Work Folders or OneDrive for Business. Additionally, if you apply redirected folders after Windows Information Protection is already in place, you might be unable to open your files offline.
|
||||
|
||||
For more info about these potential access errors, see [Can't open files offline when you use Offline Files and Windows Information Protection](/troubleshoot/windows-client/networking/error-open-files-offline-offline-files-wip).
|
||||
|
||||
- **Limitation**: Only enlightened apps can be managed without device enrollment
|
||||
- **How it appears**: If a user enrolls a device for Mobile Application Management (MAM) without device enrollment, only enlightened apps will be managed. This is by design to prevent personal files from being unintentionally encrypted by unenlighted apps.
|
||||
|
||||
Unenlighted apps that need to access work using MAM need to be re-compiled as LOB apps or managed by using MDM with device enrollment.
|
||||
|
||||
- **Workaround**: If all apps need to be managed, enroll the device for MDM.
|
||||
|
||||
- **Limitation**: By design, files in the Windows directory (%windir% or C:/Windows) cannot be encrypted because they need to be accessed by any user. If a file in the Windows directory gets encrypted by one user, other users can't access it.
|
||||
- **How it appears**: Any attempt to encrypt a file in the Windows directory will return a file access denied error. But if you copy or drag and drop an encrypted file to the Windows directory, it will retain encryption to honor the intent of the owner.
|
||||
- **Workaround**: If you need to save an encrypted file in the Windows directory, create and encrypt the file in a different directory and copy it.
|
||||
|
||||
- **Limitation**: OneNote notebooks on OneDrive for Business must be properly configured to work with Windows Information Protection.
|
||||
- **How it appears**: OneNote might encounter errors syncing a OneDrive for Business notebook and suggest changing the file ownership to Personal. Attempting to view the notebook in OneNote Online in the browser will show an error and unable to view it.
|
||||
- **Workaround**: OneNote notebooks that are newly copied into the OneDrive for Business folder from File Explorer should get fixed automatically. To do this, follow these steps:
|
||||
|
||||
1. Close the notebook in OneNote.
|
||||
2. Move the notebook folder via File Explorer out of the OneDrive for Business folder to another location, such as the Desktop.
|
||||
3. Copy the notebook folder and Paste it back into the OneDrive for Business folder.
|
||||
|
||||
Wait a few minutes to allow OneDrive to finish syncing & upgrading the notebook, and the folder should automatically convert to an Internet Shortcut. Opening the shortcut will open the notebook in the browser, which can then be opened in the OneNote client by using the "Open in app" button.
|
||||
|
||||
- **Limitation**: Microsoft Office Outlook offline data files (PST and OST files) are not marked as **Work** files, and are therefore not protected.
|
||||
- **How it appears**: If Microsoft Office Outlook is set to work in cached mode (default setting), or if some emails are stored in a local PST file, the data is unprotected.
|
||||
- **Workaround**: It is recommended to use Microsoft Office Outlook in Online mode, or to use encryption to protect OST and PST files manually.
|
||||
|
||||
> [!NOTE]
|
||||
>
|
||||
> - When corporate data is written to disk, Windows Information Protection uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity. One caveat to keep in mind is that the Preview Pane in File Explorer will not work for encrypted files.
|
||||
>
|
||||
> - Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to our content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,29 +0,0 @@
|
||||
---
|
||||
title: Mandatory tasks and settings required to turn on Windows Information Protection (WIP)
|
||||
description: Review all of the tasks required for Windows to turn on Windows Information Protection (WIP), formerly enterprise data protection (EDP), in your enterprise.
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 05/25/2022
|
||||
---
|
||||
|
||||
# Mandatory tasks and settings required to turn on Windows Information Protection (WIP)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
This list provides all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise.
|
||||
|
||||
|Task|Description|
|
||||
|----|-----------|
|
||||
|Add at least one app of each type (Store and Desktop) to the **Protected apps** list in your WIP policy.|You must have at least one Store app and one Desktop app added to your **Protected apps** list. For more info about where this area is and how to add apps, see the **Add apps to your Protected apps list** section of the policy creation topics. |
|
||||
|Choose your Windows Information Protection protection level.|You must choose the level of protection you want to apply to your WIP-protected content, including **Allow Overrides**, **Silent**, or **Block**. For more info about where this area is and how to decide on your protection level, see the [Manage Windows Information Protection mode for your enterprise data](create-wip-policy-using-configmgr.md#manage-the-wip-protection-level-for-your-enterprise-data) section of the policy creation topics. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).|
|
||||
|Specify your corporate identity.|This field is automatically filled out for you by Microsoft Intune. However, you must manually correct it if it's incorrect or if you need to add additional domains. For more info about where this area is and what it means, see the **Define your enterprise-managed corporate identity** section of the policy creation topics.
|
||||
|Specify your network domain names.|Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the DNS suffixes used in your environment. All traffic to the fully qualified domains appearing in this list will be protected. For more info about where this area is and how to add your suffixes, see the table that appears in the **Choose where apps can access enterprise data** section of the policy creation topics.|
|
||||
|Specify your enterprise IPv4 or IPv6 ranges.|Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the addresses for a valid IPv4 or IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. For more info about where this area is and what it means, see the table that appears in the **Define your enterprise-managed corporate identity** section of the policy creation topics.|
|
||||
|Include your Data Recovery Agent (DRA) certificate.|Starting with Windows 10, version 1703, this field is optional. But we strongly recommend that you add a certificate.<br><br>This certificate makes sure that any of your WIP-encrypted data can be decrypted, even if the security keys are lost. For more info about where this area is and what it means, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) topic.|
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,24 +0,0 @@
|
||||
---
|
||||
title: Create a Windows Information Protection (WIP) policy using Microsoft Configuration Manager
|
||||
description: Microsoft Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/26/2019
|
||||
---
|
||||
|
||||
# Create a Windows Information Protection (WIP) policy using Microsoft Configuration Manager
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
Microsoft Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy. It lets you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.
|
||||
|
||||
## In this section
|
||||
|
||||
|Article |Description |
|
||||
|------|------------|
|
||||
|[Create and deploy a Windows Information Protection (WIP) policy using Microsoft Configuration Manager](create-wip-policy-using-configmgr.md) |Microsoft Configuration Manager helps you create and deploy your WIP policy. And, lets you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. |
|
||||
|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. |
|
||||
|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). |
|
||||
@ -1,24 +0,0 @@
|
||||
---
|
||||
title: Create a Windows Information Protection (WIP) policy using Microsoft Intune
|
||||
description: Microsoft Intune helps you create and deploy your enterprise data protection (WIP) policy.
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 03/11/2019
|
||||
---
|
||||
|
||||
# Create a Windows Information Protection (WIP) policy using Microsoft Intune
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
Microsoft Intune helps you create and deploy your enterprise data protection (WIP) policy. It also lets you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.
|
||||
|
||||
## In this section
|
||||
|
||||
|Article |Description |
|
||||
|------|------------|
|
||||
|[Create a Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune](create-wip-policy-using-intune-azure.md)|Details about how to use Microsoft Intune to create and deploy your WIP policy with MDM (Mobile Device Management), including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. |
|
||||
|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. |
|
||||
|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). |
|
||||
@ -1,151 +0,0 @@
|
||||
---
|
||||
title: Protect your enterprise data using Windows Information Protection
|
||||
description: Learn how to prevent accidental enterprise data leaks through apps and services, such as email, social media, and the public cloud.
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.reviewer: rafals
|
||||
ms.topic: overview
|
||||
ms.date: 07/15/2022
|
||||
---
|
||||
|
||||
# Protect your enterprise data using Windows Information Protection (WIP)
|
||||
|
||||
[!INCLUDE [Deprecate Windows Information Protection](includes/wip-deprecation.md)]
|
||||
<!-- 6010051 -->
|
||||
|
||||
_Applies to:_
|
||||
|
||||
- Windows 10
|
||||
- Windows 11
|
||||
|
||||
With the increase of employee-owned devices in the enterprise, there's also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise's control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage.
|
||||
|
||||
Windows Information Protection (WIP), previously known as enterprise data protection (EDP), helps to protect against this potential data leakage without otherwise interfering with the employee experience. WIP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. Azure Rights Management, another data protection technology, also works alongside WIP. It extend data protection for data that leaves the device, such as when email attachments are sent from an enterprise aware version of a rights management mail client.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>While Windows Information Protection can stop accidental data leaks from honest employees, it is not intended to stop malicious insiders from removing enterprise data. For more information about the benefits WIP provides, see [Why use WIP?](#why-use-wip) later in this topic.
|
||||
|
||||
## Video: Protect enterprise data from being accidentally copied to the wrong place
|
||||
|
||||
> [!Video https://www.microsoft.com/videoplayer/embed/RE2IGhh]
|
||||
|
||||
## Prerequisites
|
||||
You'll need this software to run Windows Information Protection in your enterprise:
|
||||
|
||||
|Operating system | Management solution |
|
||||
|-----------------|---------------------|
|
||||
|Windows 10, version 1607 or later | Microsoft Intune<br><br>-OR-<br><br>Microsoft Configuration Manager<br><br>-OR-<br><br>Your current company-wide third party mobile device management (MDM) solution. For info about third party MDM solutions, see the documentation that came with your product. If your third party MDM doesn't have UI support for the policies, refer to the [EnterpriseDataProtection CSP](/windows/client-management/mdm/enterprisedataprotection-csp) documentation.|
|
||||
|
||||
## What is enterprise data control?
|
||||
Effective collaboration means that you need to share data with others in your enterprise. This sharing can be from one extreme where everyone has access to everything without any security. Another extreme is when people can't share anything and it's all highly secured. Most enterprises fall somewhere in between the two extremes, where success is balanced between providing the necessary access with the potential for improper data disclosure.
|
||||
|
||||
As an admin, you can address the question of who gets access to your data by using access controls, such as employee credentials. However, just because someone has the right to access your data doesn't guarantee that the data will remain within the secured locations of the enterprise. So, access controls are a great start, they're not enough.
|
||||
|
||||
In the end, all of these security measures have one thing in common: employees will tolerate only so much inconvenience before looking for ways around the security restrictions. For example, if you don't allow employees to share files through a protected system, employees will turn to an outside app that more than likely lacks security controls.
|
||||
|
||||
### Using data loss prevention systems
|
||||
To help address this security insufficiency, companies developed data loss prevention (also known as DLP) systems. Data loss prevention systems require:
|
||||
- **A set of rules about how the system can identify and categorize the data that needs to be protected.** For example, a rule set might contain a rule that identifies credit card numbers and another rule that identifies Social Security numbers.
|
||||
|
||||
- **A way to scan company data to see whether it matches any of your defined rules.** Currently, Microsoft Exchange Server and Exchange Online provide this service for email in transit, while Microsoft SharePoint and SharePoint Online provide this service for content stored in document libraries.
|
||||
|
||||
- **The ability to specify what happens when data matches a rule, including whether employees can bypass enforcement.** For example, in Microsoft SharePoint and SharePoint Online, the Microsoft Purview Data Loss Prevention system lets you warn your employees that shared data includes sensitive info, and to share it anyway (with an optional audit log entry).
|
||||
|
||||
Unfortunately, data loss prevention systems have their own problems. For example, the less detailed the rule set, the more false positives are created. This behavior can lead employees to believe that the rules slow down their work and need to be bypassed in order to remain productive, potentially leading to data being incorrectly blocked or improperly released. Another major problem is that data loss prevention systems must be widely implemented to be effective. For example, if your company uses a data loss prevention system for email, but not for file shares or document storage, you might find that your data leaks through the unprotected channels. Perhaps the biggest problem with data loss prevention systems is that it provides a jarring experience that interrupts the employees' natural workflow. It can stop some operations (such as sending a message with an attachment that the system tags as sensitive) while allowing others, often according to subtle rules that the employee doesn't see and can't understand.
|
||||
|
||||
### Using information rights management systems
|
||||
To help address the potential data loss prevention system problems, companies developed information rights management (also known as IRM) systems. Information rights management systems embed protection directly into documents, so that when an employee creates a document, he or she determines what kind of protection to apply. For example, an employee can choose to stop the document from being forwarded, printed, shared outside of the organization, and so on.
|
||||
|
||||
After the type of protection is set, the creating app encrypts the document so that only authorized people can open it, and even then, only in compatible apps. After an employee opens the document, the app becomes responsible for enforcing the specified protections. Because protection travels with the document, if an authorized person sends it to an unauthorized person, the unauthorized person won't be able to read or change it. However, for this to work effectively information rights management systems require you to deploy and set up both a server and client environment. And, because only compatible clients can work with protected documents, an employees' work might be unexpectedly interrupted if he or she attempts to use a non-compatible app.
|
||||
|
||||
### And what about when an employee leaves the company or unenrolls a device?
|
||||
Finally, there's the risk of data leaking from your company when an employee leaves or unenrolls a device. Previously, you would erase all of the corporate data from the device, along with any other personal data on the device.
|
||||
|
||||
## Benefits of WIP
|
||||
Windows Information Protection provides:
|
||||
- Obvious separation between personal and corporate data, without requiring employees to switch environments or apps.
|
||||
|
||||
- Additional data protection for existing line-of-business apps without a need to update the apps.
|
||||
|
||||
- Ability to wipe corporate data from Intune MDM enrolled devices while leaving personal data alone.
|
||||
|
||||
- Use of audit reports for tracking issues and remedial actions.
|
||||
|
||||
- Integration with your existing management system (Microsoft Intune, Microsoft Configuration Manager, or your current mobile device management (MDM) system) to configure, deploy, and manage Windows Information Protection for your company.
|
||||
|
||||
## Why use WIP?
|
||||
Windows Information Protection is the mobile application management (MAM) mechanism on Windows 10. WIP gives you a new way to manage data policy enforcement for apps and documents on Windows 10 desktop operating systems, along with the ability to remove access to enterprise data from both enterprise and personal devices (after enrollment in an enterprise management solution, like Intune).
|
||||
|
||||
- **Change the way you think about data policy enforcement.** As an enterprise admin, you need to maintain compliance in your data policy and data access. Windows Information Protection helps protect enterprise on both corporate and employee-owned devices, even when the employee isn't using the device. When employees create content on an enterprise-protected device, they can choose to save it as a work document. If it's a work document, it becomes locally maintained as enterprise data.
|
||||
|
||||
- **Manage your enterprise documents, apps, and encryption modes.**
|
||||
|
||||
- **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using a WIP-protected device, WIP encrypts the data on the device.
|
||||
|
||||
- **Using protected apps.** Managed apps (apps that you've included on the **Protected apps** list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but makes a mistake and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn't paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem.
|
||||
|
||||
- **Managed apps and restrictions.** With WIP you can control which apps can access and use your enterprise data. After adding an app to your protected apps list, the app is trusted with enterprise data. All apps not on this list are stopped from accessing your enterprise data, depending on your WIP management-mode.
|
||||
|
||||
You don't have to modify line-of-business apps that never touch personal data to list them as protected apps; just include them in the protected apps list.
|
||||
|
||||
- **Deciding your level of data access.** WIP lets you block, allow overrides, or audit employees' data sharing actions. Hiding overrides stops the action immediately. Allowing overrides lets the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without stopping anything that the employee could have overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your protected apps list. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).
|
||||
|
||||
|
||||
- **Data encryption at rest.** Windows Information Protection helps protect enterprise data on local files and on removable media.
|
||||
|
||||
Apps such as Microsoft Word work with WIP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens WIP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies Windows Information Protection to the new document.
|
||||
|
||||
- **Helping prevent accidental data disclosure to public spaces.** Windows Information Protection helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn't on your protected apps list, employees won't be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your protected apps list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the business cloud, while maintaining the encryption locally.
|
||||
|
||||
- **Helping prevent accidental data disclosure to removable media.** Windows Information Protection helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn't.
|
||||
|
||||
- **Remove access to enterprise data from enterprise-protected devices.** Windows Information Protection gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or if a device is stolen. After determining that the data access needs to be removed, you can use Microsoft Intune to unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable.
|
||||
|
||||
>[!NOTE]
|
||||
>For management of Surface devices it is recommended that you use the Current Branch of Microsoft Configuration Manager.<br>Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device.
|
||||
|
||||
## How WIP works
|
||||
Windows Information Protection helps address your everyday challenges in the enterprise. Including:
|
||||
|
||||
- Helping to prevent enterprise data leaks, even on employee-owned devices that can't be locked down.
|
||||
|
||||
- Reducing employee frustrations because of restrictive data management policies on enterprise-owned devices.
|
||||
|
||||
- Helping to maintain the ownership and control of your enterprise data.
|
||||
|
||||
- Helping control the network and data access and data sharing for apps that aren't enterprise aware
|
||||
|
||||
### Enterprise scenarios
|
||||
Windows Information Protection currently addresses these enterprise scenarios:
|
||||
- You can encrypt enterprise data on employee-owned and corporate-owned devices.
|
||||
|
||||
- You can remotely wipe enterprise data off managed computers, including employee-owned computers, without affecting the personal data.
|
||||
|
||||
- You can protect specific apps that can access enterprise data that are clearly recognizable to employees. You can also stop non-protected apps from accessing enterprise data.
|
||||
|
||||
- Your employees won't have their work otherwise interrupted while switching between personal and enterprise apps while the enterprise policies are in place. Switching environments or signing in multiple times isn't required.
|
||||
|
||||
### <a href="" id="bkmk-modes"></a>WIP-protection modes
|
||||
Enterprise data is automatically encrypted after it's loaded on a device from an enterprise source or if an employee marks the data as corporate. Then, when the enterprise data is written to disk, Windows Information Protection uses the Windows-provided Encrypting File System (EFS) to protect it and associate it with your enterprise identity.
|
||||
|
||||
Your Windows Information Protection policy includes a list of trusted apps that are protected to access and process corporate data. This list of apps is implemented through the [AppLocker](/windows/device-security/applocker/applocker-overview) functionality, controlling what apps are allowed to run and letting the Windows operating system know that the apps can edit corporate data. Apps included on this list don't have to be modified to open corporate data because their presence on the list allows Windows to determine whether to grant them access. However, new for Windows 10, app developers can use a new set of application programming interfaces (APIs) to create *enlightened* apps that can use and edit both enterprise and personal data. A huge benefit to working with enlightened apps is that dual-use apps, like Microsoft Word, can be used with less concern about encrypting personal data by mistake because the APIs allow the app to determine whether data is owned by the enterprise or if it's personally owned.
|
||||
|
||||
>[!NOTE]
|
||||
>For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).
|
||||
|
||||
You can set your Windows Information Protection policy to use 1 of 4 protection and management modes:
|
||||
|
||||
|Mode|Description|
|
||||
|----|-----------|
|
||||
|Block |Windows Information Protection looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization's network.|
|
||||
|Allow overrides |Windows Information Protection looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log.|
|
||||
|Silent |Windows Information Protection runs silently, logging inappropriate data sharing, without stopping anything that would have been prompted for employee interaction while in Allow overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.|
|
||||
|Off |Windows Information Protection is turned off and doesn't help to protect or audit your data.<p>After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Your previous decryption and policy info isn't automatically reapplied if you turn Windows Information Protection back on. |
|
||||
|
||||
## Turn off WIP
|
||||
You can turn off all Windows Information Protection and restrictions, decrypting all devices managed by WIP and reverting to where you were pre-WIP, with no data loss. However, this isn't recommended. If you choose to turn off WIP, you can always turn it back on, but your decryption and policy info won't be automatically reapplied.
|
||||
|
||||
## Next steps
|
||||
|
||||
After you decide to use WIP in your environment, [create a Windows Information Protection (WIP) policy](overview-create-wip-policy.md).
|
||||
@ -1,50 +0,0 @@
|
||||
---
|
||||
title: Recommended URLs for Windows Information Protection
|
||||
description: Recommended URLs to add to your Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP).
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 03/25/2019
|
||||
---
|
||||
|
||||
# Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare).
|
||||
|
||||
We recommend that you add the following URLs to the Enterprise Cloud Resources and Neutral Resources network settings when you create a Windows Information Protection policy. If you are using Intune, the SharePoint entries may be added automatically.
|
||||
|
||||
## Recommended Enterprise Cloud Resources
|
||||
|
||||
This table includes the recommended URLs to add to your Enterprise Cloud Resources network setting, based on the apps you use in your organization.
|
||||
|
||||
|If your organization uses... |Add these entries to your Enterprise Cloud Resources network setting<br>(Replace "contoso" with your domain name(s)|
|
||||
|-----------------------------|---------------------------------------------------------------------|
|
||||
|Sharepoint Online |- `contoso.sharepoint.com`<br/>- `contoso-my.sharepoint.com`<br/>- `contoso-files.sharepoint.com` |
|
||||
|Viva Engage |- `www.yammer.com`<br/>- `yammer.com`<br/>- `persona.yammer.com` |
|
||||
|Outlook Web Access (OWA) |- `outlook.office.com`<br/>- `outlook.office365.com`<br/>- `attachments.office.net` |
|
||||
|Microsoft Dynamics |`contoso.crm.dynamics.com` |
|
||||
|Visual Studio Online |`contoso.visualstudio.com` |
|
||||
|Power BI |`contoso.powerbi.com` |
|
||||
|Microsoft Teams |`teams.microsoft.com` |
|
||||
|Other Office 365 services |- `tasks.office.com`<br/>- `protection.office.com`<br/>- `meet.lync.com`<br/>- `project.microsoft.com` |
|
||||
|
||||
You can add other work-only apps to the Cloud Resource list, or you can create a packaged app rule for the .exe file to protect every file the app creates or modifies. Depending on how the app is accessed, you might want to add both.
|
||||
|
||||
For Office 365 endpoints, see [Office 365 URLs and IP address ranges](/office365/enterprise/urls-and-ip-address-ranges).
|
||||
Office 365 endpoints are updated monthly.
|
||||
Allow the domains listed in section number 46 "Allow Required" and add also add the apps.
|
||||
Note that apps from officeapps.live.com can also store personal data.
|
||||
|
||||
When multiple files are selected from SharePoint Online or OneDrive, the files are aggregated and the URL can change. In this case, add an entry for a second-level domain and use a wildcard such as .svc.ms.
|
||||
|
||||
|
||||
## Recommended Neutral Resources
|
||||
We recommended adding these URLs if you use the Neutral Resources network setting with Windows Information Protection (WIP).
|
||||
|
||||
- `login.microsoftonline.com`
|
||||
- `login.windows.net`
|
||||
@ -1,149 +0,0 @@
|
||||
---
|
||||
title: Testing scenarios for Windows Information Protection (WIP)
|
||||
description: A list of suggested testing scenarios that you can use to test Windows Information Protection (WIP) in your company.
|
||||
ms.reviewer:
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 03/05/2019
|
||||
---
|
||||
|
||||
# Testing scenarios for Windows Information Protection (WIP)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
We've come up with a list of suggested testing scenarios that you can use to test Windows Information Protection (WIP) in your company.
|
||||
|
||||
## Testing scenarios
|
||||
You can try any of the processes included in these scenarios, but you should focus on the ones that you might encounter in your organization.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>If any of these scenarios does not work, first take note of whether WIP has been revoked. If it has, unenlightened apps will have to be uninstalled and re-installed since their settings files will remain encrypted.
|
||||
|
||||
- **Encrypt and decrypt files using File Explorer**:
|
||||
|
||||
1. Open File Explorer, right-click a work document, and then click **Work** from the **File Ownership** menu.
|
||||
|
||||
Make sure the file is encrypted by right-clicking the file again, clicking **Advanced** from the **General** tab, and then clicking **Details** from the **Compress or Encrypt attributes** area. The file should show up under the heading, **This enterprise domain can remove or revoke access:** `*<your_enterprise_identity>*`. For example, `contoso.com`.
|
||||
|
||||
2. In File Explorer, right-click the same document, and then click **Personal** from the **File Ownership** menu.
|
||||
|
||||
Make sure the file is decrypted by right-clicking the file again, clicking **Advanced** from the **General** tab, and then verifying that the **Details** button is unavailable.
|
||||
|
||||
- **Create work documents in enterprise-allowed apps**: Start an unenlightened but allowed app, such as a line-of-business app, and then create a new document, saving your changes.
|
||||
|
||||
Make sure the document is encrypted to your Enterprise Identity. This might take a few minutes and require you to close and re-open the file.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Certain file types like `.exe` and `.dll`, along with certain file paths, such as `%windir%` and `%programfiles%` are excluded from automatic encryption.
|
||||
|
||||
For more info about your Enterprise Identity and adding apps to your allowed apps list, see either [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune-azure.md) or [Create a Windows Information Protection (WIP) policy using Microsoft Configuration Manager](create-wip-policy-using-configmgr.md), based on your deployment system.
|
||||
|
||||
- **Block enterprise data from non-enterprise apps**:
|
||||
|
||||
1. Start an app that doesn't appear on your allowed apps list, and then try to open a work-encrypted file.
|
||||
|
||||
The app shouldn't be able to access the file.
|
||||
|
||||
2. Try double-clicking or tapping on the work-encrypted file. If your default app association is an app not on your allowed apps list, you should get an **Access Denied** error message.
|
||||
|
||||
- **Copy and paste from enterprise apps to non-enterprise apps**:
|
||||
|
||||
1. Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list.
|
||||
|
||||
You should see a WIP-related warning box, asking you to click either **Change to personal** or **Keep at work**.
|
||||
|
||||
2. Click **Keep at work**. The content isn't pasted into the non-enterprise app.
|
||||
3. Repeat Step 1, but this time select **Change to personal** and try to paste the content again.
|
||||
|
||||
The content is pasted into the non-enterprise app.
|
||||
|
||||
4. Try copying and pasting content between apps on your allowed apps list. The content should copy and paste between apps without any warning messages.
|
||||
|
||||
- **Drag and drop from enterprise apps to non-enterprise apps**:
|
||||
|
||||
1. Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list.
|
||||
|
||||
You should see a WIP-related warning box, asking you to click either **Keep at work** or **Change to personal**.
|
||||
|
||||
2. Click **Keep at work**. The content isn't dropped into the non-enterprise app.
|
||||
3. Repeat Step 1, but this time select **Change to personal** and try to drop the content again.
|
||||
|
||||
The content is dropped into the non-enterprise app.
|
||||
|
||||
4. Try dragging and dropping content between apps on your allowed apps list. The content should move between the apps without any warning messages.
|
||||
|
||||
- **Share between enterprise apps and non-enterprise apps**:
|
||||
|
||||
1. Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook.
|
||||
|
||||
You should see a WIP-related warning box, asking you to click either **Keep at work** or **Change to personal**.
|
||||
|
||||
2. Click **Keep at work**. The content isn't shared into Facebook.
|
||||
3. Repeat Step 1, but this time select **Change to personal** and try to share the content again.
|
||||
|
||||
The content is shared into Facebook.
|
||||
|
||||
4. Try sharing content between apps on your allowed apps list. The content should share between the apps without any warning messages.
|
||||
|
||||
- **Verify that Windows system components can use WIP**:
|
||||
|
||||
1. Start Windows Journal and Internet Explorer 11, creating, editing, and saving files in both apps.
|
||||
|
||||
Make sure that all of the files you worked with are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted.
|
||||
|
||||
2. Open File Explorer and make sure your modified files are appearing with a **Lock** icon.
|
||||
3. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.
|
||||
|
||||
> [!NOTE]
|
||||
> Most Windows-signed components like File Explorer (when running in the user's context), should have access to enterprise data.
|
||||
>
|
||||
> A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.
|
||||
|
||||
- **Use WIP on NTFS, FAT, and exFAT systems**:
|
||||
|
||||
1. Start an app that uses the FAT or exFAT file system (for example an SD card or USB flash drive), and appears on your allowed apps list.
|
||||
2. Create, edit, write, save, copy, and move files. Basic file and folder operations like copy, move, rename, delete, and so on, should work properly on encrypted files.
|
||||
|
||||
- **Verify your shared files can use WIP**:
|
||||
|
||||
1. Download a file from a protected file share, making sure the file is encrypted by locating the **Briefcase** icon next to the file name.
|
||||
2. Open the same file, make a change, save it and then try to upload it back to the file share. Again, this should work without any warnings.
|
||||
3. Open an app that doesn't appear on your allowed apps list and attempt to access a file on the WIP-enabled file share.
|
||||
|
||||
The app shouldn't be able to access the file share.
|
||||
|
||||
- **Verify your cloud resources can use WIP**:
|
||||
|
||||
1. Add both Internet Explorer 11 and Microsoft Edge to your allowed apps list.
|
||||
2. Open SharePoint (or another cloud resource that's part of your policy) and access a WIP-enabled resource by using both IE11 and Microsoft Edge.
|
||||
|
||||
Both browsers should respect the enterprise and personal boundary.
|
||||
|
||||
3. Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource.
|
||||
|
||||
IE11 shouldn't be able to access the sites.
|
||||
|
||||
> [!NOTE]
|
||||
> Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as **Work**.
|
||||
|
||||
- **Verify your Virtual Private Network (VPN) can be auto-triggered**:
|
||||
|
||||
1. Set up your VPN network to start based on the **WIPModeID** setting. For specific info, see [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune-azure.md).
|
||||
2. Start an app from your allowed apps list. The VPN network should automatically start.
|
||||
3. Disconnect from your network and then start an app that isn't on your allowed apps list.
|
||||
|
||||
The VPN shouldn't start and the app shouldn't be able to access your enterprise network.
|
||||
|
||||
- **Unenroll client devices from WIP**: Unenroll a device from WIP by going to **Settings**, click **Accounts**, click **Work**, click the name of the device you want to unenroll, and then click **Remove**.
|
||||
|
||||
The device should be removed and all of the enterprise content for that managed account should be gone.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> On client devices, the data isn't removed and can be recovered. So, you must make sure the content is marked as **Revoked** and that access is denied for the employee.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,27 +0,0 @@
|
||||
---
|
||||
title: Using Outlook on the web with WIP
|
||||
description: Options for using Outlook on the web with Windows Information Protection (WIP).
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/26/2019
|
||||
---
|
||||
|
||||
# Using Outlook on the web with Windows Information Protection (WIP)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare).
|
||||
|
||||
Because Outlook on the web can be used both personally and as part of your organization, you have the following options to configure it with Windows Information Protection (WIP):
|
||||
|
||||
|Option |Outlook on the web behavior |
|
||||
|-------|-------------|
|
||||
|Disable Outlook on the web. Employees can only use Microsoft Outlook 2016 or the Mail for Windows 10 app. | Disabled. |
|
||||
|Don't configure outlook.office.com in any of your networking settings. |All mailboxes are automatically marked as personal. This means employees attempting to copy work content into Outlook on the web receive prompts and that files downloaded from Outlook on the web aren't automatically protected as corporate data. |
|
||||
|Add outlook.office.com and outlook.office365.com to the Cloud resources network element in your WIP policy. |All mailboxes are automatically marked as corporate. This means any personal inboxes hosted on Office 365 are also automatically marked as corporate data. |
|
||||
|
||||
>[!NOTE]
|
||||
>These limitations don't apply to Outlook 2016, the Mail for Windows 10 app, or the Calendar for Windows 10 app. These apps will work properly, marking an employee's mailbox as corporate data, regardless of how you've configured outlook.office.com in your network settings.
|
||||
@ -1,47 +0,0 @@
|
||||
---
|
||||
title: Determine the Enterprise Context of an app running in Windows Information Protection (WIP)
|
||||
description: Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP).
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/26/2019
|
||||
---
|
||||
|
||||
# Determine the Enterprise Context of an app running in Windows Information Protection (WIP)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
|
||||
>Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/WindowsForBusiness/Compare).
|
||||
|
||||
Use Task Manager to check the context of your apps while running in Windows Information Protection (WIP) to make sure that your organization's policies are applied and running correctly.
|
||||
|
||||
## Viewing the Enterprise Context column in Task Manager
|
||||
You need to add the Enterprise Context column to the **Details** tab of the Task Manager.
|
||||
|
||||
1. Make sure that you have an active Windows Information Protection policy deployed and turned on in your organization.
|
||||
|
||||
2. Open the Task Manager (taskmgr.exe), click the **Details** tab, right-click in the column heading area, and click **Select columns**.
|
||||
|
||||
The **Select columns** box appears.
|
||||
|
||||
|
||||
|
||||
3. Scroll down and check the **Enterprise Context** option, and then click **OK** to close the box.
|
||||
|
||||
The **Enterprise Context** column should now be available in Task Manager.
|
||||
|
||||
|
||||
|
||||
## Review the Enterprise Context
|
||||
The **Enterprise Context** column shows you what each app can do with your enterprise data:
|
||||
|
||||
- **Domain.** Shows the employee's work domain (such as, corp.contoso.com). This app is considered work-related and can freely touch and open work data and resources.
|
||||
|
||||
- **Personal.** Shows the text, *Personal*. This app is considered non-work-related and can't touch any work data or resources.
|
||||
|
||||
- **Exempt.** Shows the text, *Exempt*. Windows Information Protection policies don't apply to these apps (such as, system components).
|
||||
|
||||
> [!Important]
|
||||
> Enlightened apps can change between Work and Personal, depending on the data being touched. For example, Microsoft Word 2016 shows as **Personal** when an employee opens a personal letter, but changes to **Work** when that same employee opens the company financials.
|
||||
@ -1,104 +0,0 @@
|
||||
---
|
||||
title: Fine-tune Windows Information Policy (WIP) with WIP Learning
|
||||
description: How to access the WIP Learning report to monitor and apply Windows Information Protection in your company.
|
||||
author: aczechowski
|
||||
ms.author: aaroncz
|
||||
manager: aaroncz
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/26/2019
|
||||
---
|
||||
|
||||
# Fine-tune Windows Information Protection (WIP) with WIP Learning
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1703 and later
|
||||
|
||||
With WIP Learning, you can intelligently tune which apps and websites are included in your WIP policy to help reduce disruptive prompts and keep it accurate and relevant. WIP Learning generates two reports: The **App learning report** and the **Website learning report**. Both reports can be accessed from Microsoft Azure Intune.
|
||||
|
||||
The **App learning report** monitors your apps, not in policy, that attempt to access work data. You can identify these apps using the report and add them to your WIP policies to avoid productivity disruption before fully enforcing WIP with ["Block"](protect-enterprise-data-using-wip.md#bkmk-modes) mode. Frequent monitoring of the report will help you continuously identify access attempts so you can update your policy accordingly.
|
||||
|
||||
In the **Website learning report**, you can view a summary of the devices that have shared work data with websites. You can use this information to determine which websites should be added to group and user WIP policies. The summary shows which website URLs are accessed by WIP-enabled apps so you can decide which ones are cloud or personal, and add them to the resource list.
|
||||
|
||||
## Access the WIP Learning reports
|
||||
|
||||
1. Sign in to the [Microsoft Intune admin center](https://go.microsoft.com/fwlink/?linkid=2109431).
|
||||
|
||||
1. Select **Apps** > **Monitor** > **App protection status** > **Reports**.
|
||||
|
||||
|
||||
|
||||
1. Select either **App learning report for Windows Information Protection** or **Website learning report for Windows Information Protection**.
|
||||
|
||||
|
||||
|
||||
Once you have the apps and websites showing up in the WIP Learning logging reports, you can decide whether to add them to your app protection policies.
|
||||
|
||||
## Use the WIP section of Device Health
|
||||
|
||||
You can use Device Health to adjust your WIP protection policy. See [Using Device Health](/windows/deployment/update/device-health-using#windows-information-protection) to learn more.
|
||||
|
||||
If you want to configure your environment for Windows Analytics: Device Health, see [Get Started with Device Health](/windows/deployment/update/device-health-get-started) for more information.
|
||||
|
||||
Once you have WIP policies in place, by using the WIP section of Device Health, you can:
|
||||
|
||||
- Reduce disruptive prompts by adding rules to allow data sharing from approved apps.
|
||||
- Tune WIP rules by confirming that certain apps are allowed or denied by current policy.
|
||||
|
||||
## Use Device Health and Intune to adjust WIP protection policy
|
||||
|
||||
The information needed for the following steps can be found using Device Health, which you will first have to set up. Learn more about how you can [Monitor the health of devices with Device Health](/windows/deployment/update/device-health-monitor).
|
||||
|
||||
1. In **Device Health** click the app you want to add to your policy and copy the **WipAppId**.
|
||||
|
||||
For example, if the app is Google Chrome, the WipAppId is:
|
||||
|
||||
`O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US\GOOGLE CHROME\CHROME.EXE\74.0.3729.108`
|
||||
|
||||
In the steps below, you separate the WipAppId by back slashes into the **PUBLISHER**, **PRODUCT NAME**, and **FILE** fields.
|
||||
|
||||
2. In Intune, click **App protection policies** and then choose the app policy you want to add an application to.
|
||||
|
||||
3. Click **Protected apps**, and then click **Add Apps**.
|
||||
|
||||
4. In the **Recommended apps** drop down menu, choose either **Store apps** or **Desktop apps**, depending on the app you've chosen (for example, an executable (EXE) is a desktop app).
|
||||
|
||||
|
||||
|
||||
5. In **NAME** (optional), type the name of the app, and then in **PUBLISHER** (required), paste the publisher information that you copied in step 1 above.
|
||||
|
||||
For example, if the WipAppId is
|
||||
|
||||
`O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US\GOOGLE CHROME\CHROME.EXE\74.0.3729.108`
|
||||
|
||||
the text before the first back slash is the publisher:
|
||||
|
||||
`O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US`
|
||||
|
||||
|
||||
|
||||
6. Type the name of the product in **PRODUCT NAME** (required) (this will probably be the same as what you typed for **NAME**).
|
||||
|
||||
For example, if the WipAppId is
|
||||
|
||||
`O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US\GOOGLE CHROME\CHROME.EXE\74.0.3729.108`
|
||||
|
||||
the text between the first and second back slashes is the product name:
|
||||
|
||||
`GOOGLE CHROME`
|
||||
|
||||
7. Copy the name of the executable (for example, snippingtool.exe) and paste it in **FILE** (required).
|
||||
|
||||
For example, if the WipAppId is
|
||||
|
||||
`O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US\GOOGLE CHROME\CHROME.EXE\74.0.3729.108`
|
||||
|
||||
the text between the second and third back slashes is the file:
|
||||
|
||||
`CHROME.EXE`
|
||||
|
||||
8. Type the version number of the app into **MIN VERSION** in Intune (alternately, you can specify the max version, but one or the other is required), and then select the **ACTION**: **Allow** or **Deny**
|
||||
|
||||
When working with WIP-enabled apps and WIP-unknown apps, it is recommended that you start with **Silent** or **Allow overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Block**. For more information about WIP modes, see: [Protect enterprise data using WIP: WIP-modes](protect-enterprise-data-using-wip.md#bkmk-modes)
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -8,51 +8,4 @@ items:
|
||||
- name: Email Encryption (S/MIME)
|
||||
href: configure-s-mime.md
|
||||
- name: Windows Information Protection (WIP)
|
||||
href: ../../information-protection/windows-information-protection/protect-enterprise-data-using-wip.md
|
||||
items:
|
||||
- name: Create a WIP policy using Microsoft Intune
|
||||
href: ../../information-protection/windows-information-protection/overview-create-wip-policy.md
|
||||
items:
|
||||
- name: Create a WIP policy in Microsoft Intune
|
||||
href: ../../information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md
|
||||
items:
|
||||
- name: Deploy your WIP policy in Microsoft Intune
|
||||
href: ../../information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md
|
||||
- name: Associate and deploy a VPN policy for WIP in Microsoft Intune
|
||||
href: ../../information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md
|
||||
- name: Create and verify an EFS Data Recovery Agent (DRA) certificate
|
||||
href: ../../information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
|
||||
- name: Determine the enterprise context of an app running in WIP
|
||||
href: ../../information-protection/windows-information-protection/wip-app-enterprise-context.md
|
||||
- name: Create a WIP policy using Microsoft Configuration Manager
|
||||
href: ../../information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md
|
||||
items:
|
||||
- name: Create and deploy a WIP policy in Configuration Manager
|
||||
href: ../../information-protection/windows-information-protection/create-wip-policy-using-configmgr.md
|
||||
- name: Create and verify an EFS Data Recovery Agent (DRA) certificate
|
||||
href: ../../information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md
|
||||
- name: Determine the enterprise context of an app running in WIP
|
||||
href: ../../information-protection/windows-information-protection/wip-app-enterprise-context.md
|
||||
- name: Mandatory tasks and settings required to turn on WIP
|
||||
href: ../../information-protection/windows-information-protection/mandatory-settings-for-wip.md
|
||||
- name: Testing scenarios for WIP
|
||||
href: ../../information-protection/windows-information-protection/testing-scenarios-for-wip.md
|
||||
- name: Limitations while using WIP
|
||||
href: ../../information-protection/windows-information-protection/limitations-with-wip.md
|
||||
- name: How to collect WIP audit event logs
|
||||
href: ../../information-protection/windows-information-protection/collect-wip-audit-event-logs.md
|
||||
- name: General guidance and best practices for WIP
|
||||
href: ../../information-protection/windows-information-protection/guidance-and-best-practices-wip.md
|
||||
items:
|
||||
- name: Enlightened apps for use with WIP
|
||||
href: ../../information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md
|
||||
- name: Unenlightened and enlightened app behavior while using WIP
|
||||
href: ../../information-protection/windows-information-protection/app-behavior-with-wip.md
|
||||
- name: Recommended Enterprise Cloud Resources and Neutral Resources network settings with WIP
|
||||
href: ../../information-protection/windows-information-protection/recommended-network-definitions-for-wip.md
|
||||
- name: Using Outlook Web Access with WIP
|
||||
href: ../../information-protection/windows-information-protection/using-owa-with-wip.md
|
||||
- name: Fine-tune WIP Learning
|
||||
href: ../../information-protection/windows-information-protection/wip-learning.md
|
||||
- name: Disable WIP
|
||||
href: ../../information-protection/windows-information-protection/how-to-disable-wip.md
|
||||
href: /previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip
|
||||
|
||||
@ -6,7 +6,7 @@ ms.service: windows-client
|
||||
ms.subservice: itpro-fundamentals
|
||||
ms.localizationpriority: medium
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
ms.author: mstewart
|
||||
manager: aaroncz
|
||||
ms.topic: reference
|
||||
ms.collection:
|
||||
@ -49,9 +49,9 @@ The features in this article are no longer being actively developed, and might b
|
||||
|---|---|---|
|
||||
| Paint 3D <!--8995017--> | Paint 3D is deprecated and will be removed from the Microsoft Store on November 4, 2024. To view and edit 2D images, you can use [Paint](https://apps.microsoft.com/detail/9pcfs5b6t72h) or [Photos](https://apps.microsoft.com/detail/9wzdncrfjbh4). For viewing 3D content, you can use [3D Viewer](https://apps.microsoft.com/detail/9nblggh42ths). For more information, see [Resources for deprecated features](deprecated-features-resources.md#paint-3d). | August 2024 |
|
||||
| Adobe Type1 fonts <!--9183716-->| Adobe PostScript Type1 fonts are deprecated and support will be removed in a future release of Windows. </br></br> In January 2023, Adobe announced the [end of support for PostScript Type1 fonts](https://helpx.adobe.com/fonts/kb/postscript-type-1-fonts-end-of-support.html) for their latest software offerings. Remove any dependencies on this font type by selecting a supported font type. To display currently installed fonts, go to **Settings** > **Personalization** > **Fonts**. Application developers and content owners should test their apps and data files with the Adobe Type1 fonts removed. For more information, contact the application vendor or Adobe. | August 2024 |
|
||||
| DirectAccess <!--8713507-->| DirectAccess is deprecated and will be removed in a future release of Windows. We recommend [migrating from DirectAccess to Always On VPN](/windows-server/remote/remote-access/da-always-on-vpn-migration/da-always-on-migration-overview). | June 2024 |
|
||||
| DirectAccess <!--8713507-->| DirectAccess is deprecated and will be removed in a future release of Windows. We recommend [migrating from DirectAccess to Always On VPN](/windows-server/remote/remote-access/da-always-on-vpn-migration/da-always-on-migration-overview). | June 2024 |
|
||||
| NTLM <!--8396018-->| All versions of [NTLM](/windows/win32/secauthn/microsoft-ntlm), including LANMAN, NTLMv1, and NTLMv2, are no longer under active feature development and are deprecated. Use of NTLM will continue to work in the next release of Windows Server and the next annual release of Windows. Calls to NTLM should be replaced by calls to Negotiate, which will try to authenticate with Kerberos and only fall back to NTLM when necessary. For more information, see [Resources for deprecated features](deprecated-features-resources.md). | June 2024 |
|
||||
| Driver Verifier GUI (verifiergui.exe) <!--8995057--> | Driver Verifier GUI, verifiergui.exe, is deprecated and will be removed in a future version of Windows. You can use the [Verifier Command Line](/windows-hardware/drivers/devtest/verifier-command-line) (verifier.exe) instead of the Driver Verifier GUI.| May 2024 |
|
||||
| Driver Verifier GUI (verifiergui.exe) <!--8995057--> | Driver Verifier GUI, verifiergui.exe, is deprecated and will be removed in a future version of Windows. You can use the [Verifier Command Line](/windows-hardware/drivers/devtest/verifier-command-line) (verifier.exe) instead of the Driver Verifier GUI.| May 2024 |
|
||||
| NPLogonNotify and NPPasswordChangeNotify APIs <!--8787264--> | Starting in Windows 11, version 24H2, the inclusion of password payload in MPR notifications is set to disabled by default through group policy in [NPLogonNotify](/windows/win32/api/npapi/nf-npapi-nplogonnotify) and [NPPasswordChangeNotify](/windows/win32/api/npapi/nf-npapi-nppasswordchangenotify) APIs. The APIs may be removed in a future release. The primary reason for disabling this feature is to enhance security. When enabled, these APIs allow the caller to retrieve a user's password, presenting potential risks for password exposure and harvesting by malicious users. To include password payload in MPR notifications, set the [EnableMPRNotifications](/windows/client-management/mdm/policy-csp-windowslogon#enablemprnotifications) policy to `enabled`.| March 2024 |
|
||||
| TLS server authentication certificates using RSA keys with key lengths shorter than 2048 bits <!--8644149-->| Support for certificates using RSA keys with key lengths shorter than 2048 bits will be deprecated. Internet standards and regulatory bodies disallowed the use of 1024-bit keys in 2013, recommending specifically that RSA keys should have a key length of 2048 bits or longer. For more information, see [Transitioning of Cryptographic Algorithms and Key Sizes - Discussion Paper (nist.gov)](https://csrc.nist.gov/CSRC/media/Projects/Key-Management/documents/transitions/Transitioning_CryptoAlgos_070209.pdf). This deprecation focuses on ensuring that all RSA certificates used for TLS server authentication must have key lengths greater than or equal to 2048 bits to be considered valid by Windows. </br></br> TLS certificates issued by enterprise or test certification authorities (CA) aren't impacted with this change. However, we recommend that they be updated to RSA keys greater than or equal to 2048 bits as a security best practice. This change is necessary to preserve security of Windows customers using certificates for authentication and cryptographic purposes.| March 2024|
|
||||
| Test Base <!--8790681--> | [Test Base for Microsoft 365](/microsoft-365/test-base/overview), an Azure cloud service for application testing, is deprecated. The service will be retired in the future and will be no longer available for use after retirement. | March 2024 |
|
||||
@ -74,7 +74,7 @@ The features in this article are no longer being actively developed, and might b
|
||||
| Microsoft Support Diagnostic Tool (MSDT) <!--6968128--> | [MSDT](/windows-server/administration/windows-commands/msdt) is deprecated and will be removed in a future release of Windows. MSDT is used to gather diagnostic data for analysis by support professionals. For more information, see [Resources for deprecated features](deprecated-features-resources.md) | January 2023 |
|
||||
| Universal Windows Platform (UWP) Applications for 32-bit Arm <!--7116112-->| This change is applicable only to devices with an Arm processor, for example Snapdragon processors from Qualcomm. If you have a PC built with a processor from Intel or AMD, this content isn't applicable. If you aren't sure which type of processor you have, check **Settings** > **System** > **About**.</br> </br> Support for 32-bit Arm versions of applications will be removed in a future release of Windows 11. After this change, for the small number of applications affected, app features might be different and you might notice a difference in performance. For more technical details about this change, see [Update app architecture from Arm32 to Arm64](/windows/arm/arm32-to-arm64). | January 2023 |
|
||||
| Update Compliance <!--7260188-->| [Update Compliance](/windows/deployment/update/update-compliance-monitor), a cloud-based service for the Windows client, is no longer being developed. This service was replaced with [Windows Update for Business reports](/windows/deployment/update/wufb-reports-overview), which provides reporting on client compliance with Microsoft updates from the Azure portal. | November 2022|
|
||||
| Windows Information Protection <!-- 6010051 --> | [Windows Information Protection](/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip) will no longer be developed in future versions of Windows. For more information, see [Announcing sunset of Windows Information Protection (WIP)](https://go.microsoft.com/fwlink/?linkid=2202124).<br> <br>For your data protection needs, Microsoft recommends that you use [Microsoft Purview Information Protection](/microsoft-365/compliance/information-protection) and [Microsoft Purview Data Loss Prevention](/microsoft-365/compliance/dlp-learn-about-dlp). | July 2022 |
|
||||
| Windows Information Protection <!-- 6010051 --> | [Windows Information Protection](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip) will no longer be developed in future versions of Windows. For more information, see [Announcing sunset of Windows Information Protection (WIP)](https://go.microsoft.com/fwlink/?linkid=2202124).<br> <br>For your data protection needs, Microsoft recommends that you use [Microsoft Purview Information Protection](/microsoft-365/compliance/information-protection) and [Microsoft Purview Data Loss Prevention](/microsoft-365/compliance/dlp-learn-about-dlp). | July 2022 |
|
||||
| BitLocker To Go Reader | **Note: BitLocker to Go as a feature is still supported.**<br>Reading of BitLocker-protected removable drives ([BitLocker To Go](/windows/security/information-protection/bitlocker/bitlocker-to-go-faq)) from Windows XP or Windows Vista in later operating systems is deprecated and might be removed in a future release of Windows client.<br>The following items might not be available in a future release of Windows client:<br>- ADMX policy: **Allow access to BitLocker-protected removable data drives from earlier versions of Windows**<br>- Command line parameter: [`manage-bde -DiscoveryVolumeType`](/windows-server/administration/windows-commands/manage-bde-on) (-dv)<br>- Catalog file: **c:\windows\BitLockerDiscoveryVolumeContents**<br>- BitLocker 2 Go Reader app: **bitlockertogo.exe** and associated files | 21H1 |
|
||||
| Personalization roaming | Roaming of Personalization settings (including wallpaper, slideshow, accent colors, and lock screen images) is no longer being developed and might be removed in a future release. | 21H1 |
|
||||
| Windows Management Instrumentation command-line (WMIC) utility. | The WMIC utility is deprecated in Windows 10, version 21H1 and the 21H1 General Availability Channel release of Windows Server. This utility is superseded by [Windows PowerShell for WMI](/powershell/scripting/learn/ps101/07-working-with-wmi). Note: This deprecation applies to only the [command-line management utility](/windows/win32/wmisdk/wmic). WMI itself isn't affected. </br> </br> **[Update - January 2024]**: Currently, WMIC is a Feature on Demand (FoD) that's [preinstalled by default](/windows-hardware/manufacture/desktop/features-on-demand-non-language-fod#wmic) in Windows 11, versions 23H2 and 22H2. In the next release of Windows, the WMIC FoD will be disabled by default. | 21H1 |
|
||||
|
||||
@ -82,10 +82,7 @@ With the increase of employee-owned devices in the enterprise, there's also an i
|
||||
|
||||
Windows Information Protection (WIP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. WIP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps.
|
||||
|
||||
- [Create a Windows Information Protection (WIP) policy](/windows/security/information-protection/windows-information-protection/overview-create-wip-policy)
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](/windows/security/information-protection/windows-information-protection/guidance-and-best-practices-wip)
|
||||
|
||||
[Learn more about Windows Information Protection (WIP)](/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip)
|
||||
[Learn more about Windows Information Protection (WIP)](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip).
|
||||
|
||||
### Windows Defender
|
||||
|
||||
@ -107,7 +104,7 @@ With the growing threat from more sophisticated targeted attacks, a new security
|
||||
### VPN security
|
||||
|
||||
- The VPN client can integrate with the Conditional Access Framework, a cloud-based policy engine built into Microsoft Entra ID, to provide a device compliance option for remote clients.
|
||||
- The VPN client can integrate with Windows Information Protection (WIP) policy to provide extra security. [Learn more about Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip), previously known as Enterprise Data Protection.
|
||||
- The VPN client can integrate with Windows Information Protection (WIP) policy to provide extra security. [Learn more about Windows Information Protection](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip), previously known as Enterprise Data Protection.
|
||||
- New VPNv2 configuration service provider (CSP) adds configuration settings. For details, see [VPNv2 CSP](/windows/client-management/mdm/vpnv2-csp)
|
||||
- Microsoft Intune: *VPN* profile template includes support for native VPN plug-ins. For more information, see [Create VPN profiles to connect to VPN servers in Intune](/mem/intune/configuration/vpn-settings-configure).
|
||||
|
||||
|
||||
@ -158,9 +158,9 @@ Improvements have been added to Windows Information Protection and BitLocker.
|
||||
|
||||
Windows Information Protection is now designed to work with Microsoft Office and Azure Information Protection.
|
||||
|
||||
Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. For more info, see [Create a Windows Information Protection (WIP) policy using Microsoft Intune](/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure) and [Associate and deploy your Windows Information Protection (WIP) and VPN policies by using Microsoft Intune](/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure).
|
||||
Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network. For more info, see [Create a Windows Information Protection (WIP) policy using Microsoft Intune](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure) and [Associate and deploy your Windows Information Protection (WIP) and VPN policies by using Microsoft Intune](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure).
|
||||
|
||||
You can also now collect your audit event logs by using the Reporting configuration service provider (CSP) or the Windows Event Forwarding (for Windows desktop domain-joined devices). For more information, see [How to collect Windows Information Protection (WIP) audit event logs](/windows/security/information-protection/windows-information-protection/collect-wip-audit-event-logs).
|
||||
You can also now collect your audit event logs by using the Reporting configuration service provider (CSP) or the Windows Event Forwarding (for Windows desktop domain-joined devices). For more information, see [How to collect Windows Information Protection (WIP) audit event logs](/previous-versions/windows/it-pro/windows-10/security/information-protection/windows-information-protection/collect-wip-audit-event-logs).
|
||||
|
||||
This release enables support for WIP with Files on Demand, allows file encryption while the file is open in another app, and improves performance. For more information, see [OneDrive files on-demand for the enterprise](https://techcommunity.microsoft.com/t5/microsoft-onedrive-blog/onedrive-files-on-demand-for-the-enterprise/ba-p/117234).
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user