mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-15 06:47:21 +00:00
Merge pull request #3243 from MicrosoftDocs/FromPrivateRepo
From private repo
This commit is contained in:
huypub
GitHub
commit
6507a00d19
@ -11,7 +11,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 03/25/2019
|
||||
ms.date: 04/11/2019
|
||||
---
|
||||
|
||||
# Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune
|
||||
@ -23,12 +23,19 @@ ms.date: 03/25/2019
|
||||
|
||||
Microsoft Intune has an easy way to create and deploy a Windows Information Protection (WIP) policy. You can choose which apps to protect, the level of protection, and how to find enterprise data on the network. The devices can be fully managed by Mobile Device Management (MDM), or managed by Mobile Application Management (MAM), where Intune only manages the apps on a user's personal device.
|
||||
|
||||
>[!NOTE]
|
||||
>If the same user and device are targeted for both MDM and MAM, the MDM policy will be applied to devices joined to Azure AD. For personal devices that are workplace-joined (that is, added by using **Settings** > **Email & accounts** > **Add a work or school account**). the MAM-only policy will be preferred but it's possible to upgrade the device management to MDM in **Settings**. Windows Home edition only supports WIP for MAM-only; upgrading to MDM policy on Home edition will revoke WIP-protected data access. MAM supports only one user per device.
|
||||
## Differences between MDM and MAM for WIP
|
||||
|
||||
- If the same user and device are targeted for both MDM and MAM, the MDM policy will be applied to devices joined to Azure AD. For personal devices that are workplace-joined (that is, added by using **Settings** > **Email & accounts** > **Add a work or school account**), the MAM-only policy will be preferred but it's possible to upgrade the device management to MDM in **Settings**. Windows Home edition only supports WIP for MAM-only; upgrading to MDM policy on Home edition will revoke WIP-protected data access.
|
||||
- MAM supports only one user per device.
|
||||
- MAM can only manage [enlightened apps](enlightened-microsoft-apps-and-wip.md)
|
||||
- MAM has additional **Access** settings for Windows Hello for Business
|
||||
- MAM can [selectively wipe company data](https://docs.microsoft.com/intune/apps-selective-wipe) from a user's personal device
|
||||
- MAM requires an [Azure Active Direcory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses)
|
||||
- An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery depends on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Before you can create a WIP policy using Intune, you need to configure an MDM or MAM provider in Azure Active Directory (Azure AD). MAM requires an [Azure Active Direcory (Azure AD) Premium license](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis#what-are-the-azure-ad-licenses). An Azure AD Premium license is also required for WIP auto-recovery, where a device can re-enroll and re-gain access to protected data. WIP auto-recovery depends on Azure AD registration to back up the encryption keys, which requires device auto-enrollment with MDM.
|
||||
Before you can create a WIP policy using Intune, you need to configure an MDM or MAM provider in Azure Active Directory (Azure AD).
|
||||
|
||||
## Configure the MDM or MAM provider
|
||||
|
||||
@ -602,6 +609,70 @@ Optionally, if you don’t want everyone in your organization to be able to shar
|
||||
>[!NOTE]
|
||||
>For more info about setting the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp) topic. For more info about setting up and using a custom template, see [Configuring custom templates for the Azure Rights Management service](https://docs.microsoft.com/information-protection/deploy-use/configure-custom-templates) topic.
|
||||
|
||||
### Configure Windows Hello for Business for MAM
|
||||
If you created a WIP policy for MAM, you can turn on Windows Hello for Business, letting your employees use it as a sign-in method for their devices.
|
||||
|
||||
**To turn on and configure Windows Hello for Business**
|
||||
|
||||
1. From the **Client apps - App protection policies** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears.
|
||||
|
||||
The **Advanced settings** blade appears.
|
||||
|
||||
2. Choose to turn on and configure the Windows Hello for Business settings:
|
||||
|
||||
|
||||
|
||||
- **Use Windows Hello for Business as a method for signing into Windows.** Turns on Windows Hello for Business. The options are:
|
||||
|
||||
- **On.** Turns on Windows Hello For Business for anyone assigned to this policy.
|
||||
|
||||
- **Off.** Turns off Windows Hello for Business.
|
||||
|
||||
- **Set the minimum number of characters required for the PIN.** Enter a numerical value (4-127 characters) for how many characters must be used to create a valid PIN. Default is 4 characters.
|
||||
|
||||
- **Configure the use of uppercase letters in the Windows Hello for Business PIN.** Lets you decide whether uppercase letters can be used in a valid PIN. The options are:
|
||||
|
||||
- **Allow the use of uppercase letters in PIN.** Lets an employee use uppercase letters in a valid PIN.
|
||||
|
||||
- **Require the use of at least one uppercase letter in PIN.** Requires an employee to use at least 1 uppercase letter in a valid PIN.
|
||||
|
||||
- **Do not allow the use of uppercase letters in PIN.** Prevents an employee from using uppercase letters in a valid PIN.
|
||||
|
||||
- **Configure the use of lowercase letters in the Windows Hello for Business PIN.** Lets you decide whether lowercase letters can be used in a valid PIN. The options are:
|
||||
|
||||
- **Allow the use of lowercase letters in PIN.** Lets an employee use lowercase letters in a valid PIN.
|
||||
|
||||
- **Require the use of at least one lowercase letter in PIN.** Requires an employee to use at least 1 lowercase letter in a valid PIN.
|
||||
|
||||
- **Do not allow the use of lowercase letters in PIN.** Prevents an employee from using lowercase letters in a valid PIN.
|
||||
|
||||
- **Configure the use of special characters in the Windows Hello for Business PIN.** Lets you decide whether special characters can be used in a valid PIN. The options are:
|
||||
|
||||
- **Allow the use of special characters in PIN.** Lets an employee use special characters in a valid PIN.
|
||||
|
||||
- **Require the use of at least one special character in PIN.** Requires an employee to use at least 1 special character in a valid PIN.
|
||||
|
||||
- **Do not allow the use of special characters in PIN.** Prevents an employee from using special characters in a valid PIN.
|
||||
|
||||
- **Specify the period of time (in days) that a PIN can be used before the system requires the user to change it.** Enter a numerical value (0-730 days) for how many days can pass before a PIN must be changed. If you enter a value of 0, the PIN never expires.
|
||||
|
||||
- **Specify the number of past PINs that can be associated to a user account that can't be reused.** Enter a numerical value (0-50 days) for how many days can pass before an employee can reuse a previous PIN. If you enter a value of 0, a PINs can be reused immediately and past PINs aren't stored.
|
||||
|
||||
>[!NOTE]
|
||||
>PIN history is not preserved through a PIN reset.
|
||||
|
||||
- **Number of authentication failures allowed before the device will be wiped.** Enter a numerical value for how many times the PIN can be incorrectly entered before wiping the device of corporate data. If you enter a value of 0, the device is never wiped, regardless of the number of incorrect PIN entries.<p>This setting has different behavior for mobile devices and desktops.
|
||||
|
||||
- **On mobile devices.** When an employee reaches the value set here, the device is wiped of corporate data.
|
||||
|
||||
- **On desktop devices.** When an employee reaches the value set here, the desktop is put into BitLocker recovery mode, instead of being wiped. You must have BitLocker installed on the device or this setting is ignored.
|
||||
|
||||
- **Maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked.** Enter a numerical value for how many days can pass before a PIN must be changed. If you enter a value of 0, the device never becomes PIN or password locked while idle.
|
||||
|
||||
>[!NOTE]
|
||||
>You can set this value to be anything; however, it can't be longer than the time specified by the **Settings** app. If you exceed the maximum timeout value, this setting is ignored.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md)
|
||||
|
||||
@ -13,7 +13,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 02/26/2019
|
||||
ms.date: 04/11/2019
|
||||
---
|
||||
|
||||
# How Windows Information Protection (WIP) protects a file that has a sensitivity label
|
||||
@ -34,8 +34,6 @@ Microsoft information protection technologies include:
|
||||
|
||||
- [Windows Information Protection (WIP)](protect-enterprise-data-using-wip.md) is built in to Windows 10 and protects local data at rest on endpoint devices, and manages apps to protect local data in use. Data that leaves the endpoint device, such as email attachment, is not protected by WIP.
|
||||
|
||||
- [Office 365 Information Protection](https://docs.microsoft.com/office365/securitycompliance/office-365-info-protection-for-gdpr-overview) is a solution to classify, protect, and monitor personal data in Office 365.
|
||||
|
||||
- [Azure Information Protection](https://docs.microsoft.com/azure/information-protection/what-is-information-protection) is a cloud-based solution that can be purchased either standalone or as part of Microsoft 365 Enterprise. It helps an organization classify and protect its documents and emails by applying labels. Azure Information Protection is applied directly to content, and roams with the content as it's moved between locations and cloud services.
|
||||
|
||||
- [Microsoft Cloud App Security](https://docs.microsoft.com/cloud-app-security/what-is-cloud-app-security) is a cloud access security broker (CASB) solution that allows you to discover, classify, protect, and monitor user data in first-party and third-party Software-as-a-Service (SaaS) apps used by your organization.
|
||||
|
||||
@ -1018,23 +1018,17 @@
|
||||
###### [Synchronize directory service data](security-policy-settings/synchronize-directory-service-data.md)
|
||||
###### [Take ownership of files or other objects](security-policy-settings/take-ownership-of-files-or-other-objects.md)
|
||||
|
||||
### [Windows security guidance for enterprises](windows-security-configuration-framework/windows-security-compliance.md)
|
||||
|
||||
### [Windows security compliance](windows-security-configuration-framework/windows-security-compliance.md)
|
||||
#### [Windows security baselines](windows-security-configuration-framework/windows-security-baselines.md)
|
||||
##### [Security Compliance Toolkit](windows-security-configuration-framework/security-compliance-toolkit-10.md)
|
||||
##### [Get support](windows-security-configuration-framework/get-support-for-security-baselines.md)
|
||||
#### [Windows SECCON framework](windows-security-configuration-framework/windows-security-configuration-framework.md)
|
||||
##### [SECCON 1 enterprise administrator security](windows-security-configuration-framework/level-1-enterprise-administrator-security.md)
|
||||
##### [SECCON 2 enterprise dev/ops security](windows-security-configuration-framework/level-2-enterprise-devops-security.md)
|
||||
##### [SECCON 3 enterprise VIP security](windows-security-configuration-framework/level-3-enterprise-vip-security.md)
|
||||
##### [SECCON 4 enterprise high security](windows-security-configuration-framework/level-4-enterprise-high-security.md)
|
||||
##### [SECCON 5 enterprise security](windows-security-configuration-framework/level-5-enterprise-security.md)
|
||||
####Windows Security Blog Posts
|
||||
##### [Sticking with Well-Known and Proven Solutions](windows-security-configuration-framework/windows-security-blog/sticking-with-well-known-and-proven-solutions.md)
|
||||
##### [Why We’re Not Recommending "FIPS Mode" Anymore](windows-security-configuration-framework/windows-security-blog/why-were-not-recommending-fips-mode-anymore.md)
|
||||
##### [Configuring Account Lockout](windows-security-configuration-framework/windows-security-blog/configuring-account-lockout.md)
|
||||
##### [Blocking Remote Use of Local Accounts](windows-security-configuration-framework/windows-security-blog/blocking-remote-use-of-local-accounts.md)
|
||||
##### [Dropping the “Untrusted Font Blocking” setting](windows-security-configuration-framework/windows-security-blog/dropping-the-untrusted-font-blocking-setting.md)
|
||||
#### [Windows security configuration framework](windows-security-configuration-framework/windows-security-configuration-framework.md)
|
||||
##### [Level 5 enterprise security](windows-security-configuration-framework/level-5-enterprise-security.md)
|
||||
##### [Level 4 enterprise high security](windows-security-configuration-framework/level-4-enterprise-high-security.md)
|
||||
##### [Level 3 enterprise VIP security](windows-security-configuration-framework/level-3-enterprise-vip-security.md)
|
||||
##### [Level 2 enterprise dev/ops workstation](windows-security-configuration-framework/level-2-enterprise-devops-security.md)
|
||||
##### [Level 1 enterprise administrator workstation](windows-security-configuration-framework/level-1-enterprise-administrator-security.md)
|
||||
|
||||
### [MBSA removal and alternatives](mbsa-removal-and-guidance.md)
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 122 KiB After Width: | Height: | Size: 62 KiB |
@ -12,7 +12,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 10/16/2017
|
||||
ms.date: 04/10/2019
|
||||
---
|
||||
|
||||
# AppLocker
|
||||
@ -92,7 +92,7 @@ AppLocker is included with enterprise-level editions of Windows. You can author
|
||||
|
||||
### Using AppLocker on Server Core
|
||||
|
||||
AppLocker on Server Core installations is not supported.
|
||||
AppLocker on Server Core installations is not supported. This applies to all versions of Windows Server.
|
||||
|
||||
### Virtualization considerations
|
||||
|
||||
|
||||
@ -42,6 +42,8 @@ To effectively build queries that span multiple tables, you need to understand t
|
||||
| AdditionalFields | string | Additional information about the event in JSON array format |
|
||||
| AlertId | string | Unique identifier for the alert |
|
||||
| AppGuardContainerId | string | Identifier for the virtualized container used by Application Guard to isolate browser activity |
|
||||
| Category | string | Type of threat indicator or breach activity identified by the alert |
|
||||
| ClientVersion | string | Version of the endpoint agent or sensor running on the machine |
|
||||
| ComputerName | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| ConnectedNetworks | string | Networks that the adapter is connected to. Each JSON array contains the network name, category (public, private or domain), a description, and a flag indicating if it’s connected publicly to the internet. |
|
||||
| DefaultGateways | string | Default gateway addresses in JSON array format |
|
||||
@ -89,6 +91,7 @@ To effectively build queries that span multiple tables, you need to understand t
|
||||
| OSArchitecture | string | Architecture of the operating system running on the machine |
|
||||
| OSBuild | string | Build version of the operating system running on the machine |
|
||||
| OSPlatform | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. |
|
||||
| OsVersion | string | Version of the operating system running on the machine |
|
||||
| PreviousRegistryKey | string | Original registry key of the registry value before it was modified |
|
||||
| PreviousRegistryValueData | string | Original data of the registry value before it was modified |
|
||||
| PreviousRegistryValueName | string | Original name of the registry value before it was modified |
|
||||
@ -110,8 +113,10 @@ To effectively build queries that span multiple tables, you need to understand t
|
||||
| RemotePort | int | TCP port on the remote device that was being connected to |
|
||||
| RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to |
|
||||
| ReportId | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the ComputerName and EventTime columns. |
|
||||
| Severity | string | Indicates the potential impact (high, medium, or low) of the threat indicator or breach activity identified by the alert |
|
||||
| SHA1 | string | SHA-1 of the file that the recorded action was applied to |
|
||||
| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. |
|
||||
| RegistryMachineTag | string | Machine tag added through the registry |
|
||||
| Table | string | Table that contains the details of the event |
|
||||
| TunnelingType | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH |
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user