{
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
}
+
+**To find the publisher and product name values for apps installed on Windows 10 mobile phones**
+1. If you need to add mobile apps that aren't distributed through the Microsoft Store for Business, you must use the **Windows Device Portal** feature.
+
+ >[!NOTE]
+ >Your PC and phone must be on the same wireless network.
+
+2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**.
+
+3. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**.
+
+4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate.
+
+5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step.
+
+6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names.
+
+7. Start the app for which you're looking for the publisher and product name values.
+
+8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune.
+
+ >[!Important]
+ >The JSON file might also return a windowsPhoneLegacyId value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as windowsPhoneLegacyId, and set the **Publisher Name** as CN= followed by the windowsPhoneLegacyId.{
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
}
+
+### Add a Desktop app to your Allowed apps list
+For this example, we’re going to add WordPad, a Desktop app, to the **Allowed apps** list.
+
+**To add a Desktop app**
+1. From the **Mobile apps - App protection policies** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears.
+
+ The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy.
+
+2. From the **Allowed apps** blade, click **Add apps**.
+
+3. On the **Add apps** blade, click **Desktop apps** from the dropdown list.
+
+ The blade changes to show boxes for you to add the following, based on the results you want returned:
+
+ | Field | +Manages | +
|---|---|
| All fields marked as “*” | +All files signed by any publisher. (Not recommended) | +
| Name | +A friendly name for your app. You can't use this field by itself. However, you can use it in conjunction with any of the other fields. | +
| Publisher (required) only | +Filling out this field, gives you all files signed by the named publisher. This might be useful if your company is the publisher and signer of internal line-of-business apps. This is a required field and must be filled out whether by itself or in conjunction with other fields. |
+
| Publisher (required) and Product name only | +If you only fill out these fields, you’ll get all files for the specified product, signed by the named publisher. | +
| Publisher (required), Product name, and File only | +If you only fill out these fields, you’ll get any version of the named file or package for the specified product, signed by the named publisher. | +
| Publisher (required), Product name, File, and Min version only | +If you only fill out these fields, you’ll get the specified version or newer releases of the named file or package for the specified product, signed by the named publisher. This option is recommended for enlightened apps that weren't previously enlightened. |
+
| Publisher (required), Product name, File, and Max version only | +If you only fill out these fields, you’ll get the specified version or older releases of the named file or package for the specified product, signed by the named publisher. | +
| All fields completed | +If you fill out all fields, you’ll get the specified version of the named file or package for the specified product, signed by the named publisher. | +
| Boundary type | +Value format | +Description | +
|---|---|---|
| Cloud Resources | +With proxy: contoso.sharepoint.com,contoso.internalproxy1.com| contoso.visualstudio.com,contoso.internalproxy2.com Without proxy: contoso.sharepoint.com|contoso.visualstudio.com |
+ Specify the cloud resources to be treated as corporate and protected by WIP. For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise. If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: URL <,proxy>|URL <,proxy>.Important In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the /*AppCompat*/ string to the setting. For example: URL <,proxy>|URL <,proxy>|/*AppCompat*/.When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access. |
+
| Network domain names | +corp.contoso.com,region.contoso.com | +Starting with Windows 10, version 1703, this field is optional. Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. If you have multiple resources, you must separate them using the "," delimiter. |
+
| Proxy servers | +proxy.contoso.com:80;proxy2.contoso.com:443 | +Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources. This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic. If you have multiple resources, you must separate them using the ";" delimiter. |
+
| Internal proxy servers | +contoso.internalproxy1.com;contoso.internalproxy2.com | +Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources. This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic. If you have multiple resources, you must separate them using the ";" delimiter. |
+
| IPv4 ranges | +**Starting IPv4 Address:** 3.4.0.1 **Ending IPv4 Address:** 3.4.255.254 **Custom URI:** 3.4.0.1-3.4.255.254, 10.0.0.1-10.255.255.254 |
+ Starting with Windows 10, version 1703, this field is optional. Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. If you have multiple ranges, you must separate them using the "," delimiter. |
+
| IPv6 ranges | +**Starting IPv6 Address:** 2a01:110:: **Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff **Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff, fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff |
+ Starting with Windows 10, version 1703, this field is optional. Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. If you have multiple ranges, you must separate them using the "," delimiter. |
+
| Neutral resources | +sts.contoso.com,sts.contoso2.com | +Specify your authentication redirection endpoints for your company. These locations are considered enterprise or personal, based on the context of the connection before the redirection. If you have multiple resources, you must separate them using the "," delimiter. |
+
This setting has different behavior for mobile devices and desktops. + + - **On mobile devices.** When an employee reaches the value set here, the device is wiped of corporate data. + + - **On desktop devices.** When an employee reaches the value set here, the desktop is put into BitLocker recovery mode, instead of being wiped. You must have BitLocker installed on the device or this setting is ignored. + + - **Maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked.** Enter a numerical value for how many days can pass before a PIN must be changed. If you enter a value of 0, the device never becomes PIN or password locked while idle. + + >[!NOTE] + >You can set this value to be anything; however, it can't be longer than the time specified by the **Settings** app. If you exceed the maximum timeout value, this setting is ignored. + + +## Deploy your policy +After you’ve created your policy, you'll need to deploy it to your employees. MAM is deployed to users and not devices. + +**To deploy your policy** + +1. On the **Mobile apps - App protection policies** pane, click your newly-created policy, click **Assignments** from the menu that appears, and then click **Select groups**. + + A list of user groups, made up of all of the security groups in your Azure Active Directory, appear in the **Add user group** pane. + +2. Choose the group you want your policy to apply to, and then click **Select** to deploy the policy. + + The policy is deployed to the selected group. + +  + +## Related topics + +- [Implement server-side support for mobile application management on Windows](https://docs.microsoft.com/en-us/windows/client-management/mdm/implement-server-side-mobile-application-management) + +- [Microsoft Intune - Mobile Application Management (MAM) standalone blog post](https://blogs.technet.microsoft.com/cbernier/2016/01/05/microsoft-intune-mobile-application-management-mam-standalone/) + +- [MAM-supported apps](https://www.microsoft.com/en-us/cloud-platform/microsoft-intune-apps) + +- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md) + +- [Deploy your Windows Information Protection (WIP) policy](deploy-wip-policy-using-intune.md) + +- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md) \ No newline at end of file diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-access-options.png b/windows/threat-protection/windows-information-protection/images/wip-azure-access-options.png new file mode 100644 index 0000000000..e759e45f28 Binary files /dev/null and b/windows/threat-protection/windows-information-protection/images/wip-azure-access-options.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-add-desktop-apps.png b/windows/threat-protection/windows-information-protection/images/wip-azure-add-desktop-apps.png index f2aafb0c41..1d1aff1a0c 100644 Binary files a/windows/threat-protection/windows-information-protection/images/wip-azure-add-desktop-apps.png and b/windows/threat-protection/windows-information-protection/images/wip-azure-add-desktop-apps.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-add-policy.png b/windows/threat-protection/windows-information-protection/images/wip-azure-add-policy.png new file mode 100644 index 0000000000..8b81622c1a Binary files /dev/null and b/windows/threat-protection/windows-information-protection/images/wip-azure-add-policy.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-add-store-apps.png b/windows/threat-protection/windows-information-protection/images/wip-azure-add-store-apps.png index de20f46e37..b31efa417c 100644 Binary files a/windows/threat-protection/windows-information-protection/images/wip-azure-add-store-apps.png and b/windows/threat-protection/windows-information-protection/images/wip-azure-add-store-apps.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-add-user-groups.png b/windows/threat-protection/windows-information-protection/images/wip-azure-add-user-groups.png index ab17d13baf..08afdf96b5 100644 Binary files a/windows/threat-protection/windows-information-protection/images/wip-azure-add-user-groups.png and b/windows/threat-protection/windows-information-protection/images/wip-azure-add-user-groups.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-efsdra.png b/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-efsdra.png index 71594dd252..59e2071bd8 100644 Binary files a/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-efsdra.png and b/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-efsdra.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-network-autodetect.png b/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-network-autodetect.png index 3b709bbc46..517c4a4ad3 100644 Binary files a/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-network-autodetect.png and b/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-network-autodetect.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-network.png b/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-network.png index 7daf9d9760..ff743d4e05 100644 Binary files a/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-network.png and b/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-network.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-optional.png b/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-optional.png index 9f1bc57abc..7775888473 100644 Binary files a/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-optional.png and b/windows/threat-protection/windows-information-protection/images/wip-azure-advanced-settings-optional.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-allowed-apps-with-apps.png b/windows/threat-protection/windows-information-protection/images/wip-azure-allowed-apps-with-apps.png index a72f225ec1..05398cb29d 100644 Binary files a/windows/threat-protection/windows-information-protection/images/wip-azure-allowed-apps-with-apps.png and b/windows/threat-protection/windows-information-protection/images/wip-azure-allowed-apps-with-apps.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-portal-addpolicy-mam.png b/windows/threat-protection/windows-information-protection/images/wip-azure-portal-addpolicy-mam.png new file mode 100644 index 0000000000..3142b31f51 Binary files /dev/null and b/windows/threat-protection/windows-information-protection/images/wip-azure-portal-addpolicy-mam.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-portal-start-mam.png b/windows/threat-protection/windows-information-protection/images/wip-azure-portal-start-mam.png new file mode 100644 index 0000000000..aa0184a2c6 Binary files /dev/null and b/windows/threat-protection/windows-information-protection/images/wip-azure-portal-start-mam.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-required-settings-corp-identity.png b/windows/threat-protection/windows-information-protection/images/wip-azure-required-settings-corp-identity.png index c2274ee1e8..7332236129 100644 Binary files a/windows/threat-protection/windows-information-protection/images/wip-azure-required-settings-corp-identity.png and b/windows/threat-protection/windows-information-protection/images/wip-azure-required-settings-corp-identity.png differ diff --git a/windows/threat-protection/windows-information-protection/images/wip-azure-required-settings-protection-mode.png b/windows/threat-protection/windows-information-protection/images/wip-azure-required-settings-protection-mode.png index a1e3ed0c57..d2aa8feb83 100644 Binary files a/windows/threat-protection/windows-information-protection/images/wip-azure-required-settings-protection-mode.png and b/windows/threat-protection/windows-information-protection/images/wip-azure-required-settings-protection-mode.png differ diff --git a/windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md b/windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md new file mode 100644 index 0000000000..015b3ebccd --- /dev/null +++ b/windows/threat-protection/windows-information-protection/overview-create-wip-policy-sccm.md @@ -0,0 +1,26 @@ +--- +title: Create a Windows Information Protection (WIP) policy using System Center Configuration Manager (Windows 10) +description: System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +author: eross-msft +ms.localizationpriority: medium +--- + +# Create a Windows Information Protection (WIP) policy using System Center Configuration Manager +**Applies to:** + +- Windows 10, version 1607 and later +- Windows 10 Mobile, version 1607 and later + +System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. + +## In this section +|Topic |Description | +|------|------------| +|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |System Center Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | +|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. | +|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). | \ No newline at end of file diff --git a/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md b/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md index 6dcd047747..1f70f60d1c 100644 --- a/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md +++ b/windows/threat-protection/windows-information-protection/overview-create-wip-policy.md @@ -1,5 +1,5 @@ --- -title: Create a Windows Information Protection (WIP) policy (Windows 10) +title: Create a Windows Information Protection (WIP) policy using Microsoft Intune (Windows 10) description: Microsoft Intune and System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 ms.prod: w10 @@ -10,22 +10,19 @@ author: eross-msft ms.localizationpriority: medium --- -# Create a Windows Information Protection (WIP) policy +# Create a Windows Information Protection (WIP) policy using Microsoft Intune **Applies to:** - Windows 10, version 1607 and later - Windows 10 Mobile, version 1607 and later -Microsoft Intune and System Center Configuration Manager helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +Microsoft Intune helps you create and deploy your enterprise data protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. ## In this section |Topic |Description | |------|------------| +|[Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune](create-wip-policy-using-intune-azure.md)|Details about how to use the Azure portal for Microsoft Intune to create and deploy your WIP policy with MDM, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | +|[Create a Windows Information Protection (WIP) policy with MAM using the Azure portal for Microsoft Intune](create-wip-policy-using-mam-intune-azure.md)|Details about how to use the Azure portal for Microsoft Intune to create your WIP policy with MDM, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.| |[Create a Windows Information Protection (WIP) policy using the classic console for Microsoft Intune](create-wip-policy-using-intune.md) |Details about how to use the classic console for Microsoft Intune to create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | -|[Create a Windows Information Protection (WIP) with enrollment policy using the Azure portal for Microsoft Intune](create-wip-policy-using-intune-azure.md)|Details about how to use the Azure portal for Microsoft Intune to create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | -|[Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) |System Center Configuration Manager helps you create and deploy your WIP policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. | |[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |Steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. | -|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). | - ->[!NOTE] ->Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file +|[Determine the Enterprise Context of an app running in Windows Information Protection (WIP)](wip-app-enterprise-context.md) |Use the Task Manager to determine whether an app is considered work, personal or exempt by Windows Information Protection (WIP). | \ No newline at end of file