mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 06:13:41 +00:00
restart re-org
This commit is contained in:
Justin Hall
@ -1,60 +0,0 @@
|
||||
---
|
||||
title: How hardware-based containers help protect Windows 10 (Windows 10)
|
||||
description: Windows 10 uses containers to isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised.
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: justinha
|
||||
ms.date: 06/29/2017
|
||||
---
|
||||
|
||||
# How hardware-based containers help protect Windows 10
|
||||
|
||||
Windows 10 uses containers to isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised.
|
||||
Windows 10 protects critical resources, such as the Windows authentication stack, single sign-on tokens, Windows Hello biometric stack, and Virtual Trusted Platform Module, by using a container type called Windows Defender System Guard.
|
||||
|
||||
Protecting system services and data with Windows Defender System Guard is an important first step, but is just the beginning of what we need to do as it doesn’t protect the rest of the operating system, information on the device, other apps, or the network.
|
||||
Since systems are generally compromised through the application layer, and often though browsers, Windows 10 includes Windows Defender Application Guard to isolate Microsoft Edge from the operating system, information on the device, and the network.
|
||||
With this, Windows can start to protect the broader range of resources.
|
||||
|
||||
The following diagram shows Windows Defender System Guard and Windows Defender Application Guard in relation to the Windows 10 operating system.
|
||||
|
||||
|
||||
|
||||
## What security threats do containers protect against
|
||||
|
||||
Exploiting zero days and vulnerabilities are an increasing threat that attackers are attempting to take advantage of.
|
||||
The following diagram shows the traditional Windows software stack: a kernel with an app platform, and an app running on top of it.
|
||||
Let’s look at how an attacker might elevate privileges and move down the stack.
|
||||
|
||||
|
||||
|
||||
In desktop operating systems, those apps typically run under the context of the user’s privileges.
|
||||
If the app was malicious, it would have access to all the files in the file system, all the settings that you as a user Standard user have access to, and so on.
|
||||
|
||||
A different type of app may run under the context of an Administrator.
|
||||
If attackers exploit a vulnerability in that app, they could gain Administrator privileges.
|
||||
Then they can start turning off defenses.
|
||||
|
||||
They can poke down a little bit lower in the stack and maybe elevate to System, which is greater than Administrator.
|
||||
Or if they can exploit the kernel mode, they can turn on and turn off all defenses, while at the same time making the computer look healthy.
|
||||
SecOps tools could report the computer as healthy when in fact it’s completely under the control of someone else.
|
||||
|
||||
One way to address this threat is to use a sandbox, as smartphones do.
|
||||
That puts a layer between the app layer and the Windows platform services.
|
||||
Universal Windows Platform (UWP) applications work this way.
|
||||
But what if a vulnerability in the sandbox exists?
|
||||
The attacker can escape and take control of the system.
|
||||
|
||||
## How containers help protect Windows 10
|
||||
|
||||
Windows 10 addresses this by using virtualization based security to isolate more and more components out of Windows (left side) over time and moving those components into a separate, isolated hardware container.
|
||||
The container helps prevent zero days and vulnerabilities from allowing an attacker to take control of a device.
|
||||
|
||||
Anything that's running in that container on the right side will be safe, even from Windows, even if the kernel's compromised.
|
||||
Anything that's running in that container will also be secure against a compromised app.
|
||||
Initially, Windows Defender System Guard will protect things like authentication and other system services and data that needs to resist malware, and more things will be protected over time.
|
||||
|
||||
|
||||
@ -1,130 +0,0 @@
|
||||
---
|
||||
title: Secure the Windows 10 boot process
|
||||
description: This article describes how Windows 10 security features helps protect your PC from malware, including rootkits and other applications
|
||||
keywords: trusted boot, windows 10 boot proces
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: Explore
|
||||
ms.pagetype: security
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: medium
|
||||
author: brianlic-msft
|
||||
ms.date: 10/13/2017
|
||||
---
|
||||
|
||||
# Secure the Windows 10 boot process
|
||||
|
||||
**Applies to:**
|
||||
- Windows 10
|
||||
- Windows 8.1
|
||||
|
||||
The Windows operating system has many features to help protect you from malware, and it does an amazingly good job. Except for apps that businesses develop and use internally, all Microsoft Store apps must meet a series of requirements to be certified and included in the Microsoft Store. This certification process examines several criteria, including security, and is an effective means of preventing malware from entering the Microsoft Store. Even if a malicious app does get through, the Windows 10 operating system includes a series of security features that can mitigate the impact. For instance, Microsoft Store apps are sandboxed and lack the privileges necessary to access user data or change system settings.
|
||||
|
||||
Windows 10 has multiple levels of protection for desktop apps and data, too. Windows Defender uses signatures to detect and quarantine apps that are known to be malicious. The SmartScreen Filter warns users before allowing them to run an untrustworthy app, even if it’s recognized as malware. Before an app can change system settings, the user would have to grant the app administrative privileges by using User Account Control.
|
||||
|
||||
Those are just some of the ways that Windows 10 protects you from malware. However, those security features protect you only after Windows 10 starts. Modern malware—and bootkits specifically—are capable of starting before Windows, completely bypassing operating system security, and remaining completely hidden.
|
||||
|
||||
When you run Windows 10 on a PC or any PC that supports Unified Extensible Firmware Interface (UEFI), Trusted Boot protects your PC from malware from the moment you power on your PC until your anti-malware starts. In the unlikely event that malware does infect a PC, it can’t remain hidden; Trusted Boot can prove the system’s integrity to your infrastructure in a way that malware can’t disguise. Even on PCs without UEFI, Windows 10 provides even better startup security than previous versions of Windows.
|
||||
|
||||
First, let’s examine what rootkits are and how they work. Then, we’ll show you how Windows 10 can protect you.
|
||||
|
||||
|
||||
## The threat: rootkits
|
||||
|
||||
*Rootkits* are a sophisticated and dangerous type of malware that run in kernel mode, using the same privileges as the operating system. Because rootkits have the same rights as the operating system and start before it, they can completely hide themselves and other applications. Often, rootkits are part of an entire suite of malware that can bypass local logins, record passwords and keystrokes, transfer private files, and capture cryptographic data.
|
||||
|
||||
Different types of rootkits load during different phases of the startup process:
|
||||
|
||||
- **Firmware rootkits.** These kits overwrite the firmware of the PC’s basic input/output system or other hardware so the rootkit can start before Windows.
|
||||
- **Bootkits.** These kits replace the operating system’s bootloader (the small piece of software that starts the operating system) so that the PC loads the bootkit before the operating system.
|
||||
- **Kernel rootkits.** These kits replace a portion of the operating system kernel so the rootkit can start automatically when the operating system loads.
|
||||
- **Driver rootkits.** These kits pretend to be one of the trusted drivers that Windows uses to communicate with the PC hardware.
|
||||
|
||||
## The countermeasures
|
||||
Windows 10 supports four features to help prevent rootkits and bootkits from loading during the startup process:
|
||||
- **Secure Boot.** PCs with UEFI firmware and a Trusted Platform Module (TPM) can be configured to load only trusted operating system bootloaders.
|
||||
- **Trusted Boot.** Windows checks the integrity of every component of the startup process before loading it.
|
||||
- **Early Launch Anti-Malware (ELAM).** ELAM tests all drivers before they load and prevents unapproved drivers from loading.
|
||||
- **Measured Boot.** The PC’s firmware logs the boot process, and Windows can send it to a trusted server that can objectively assess the PC’s health.
|
||||
|
||||
Figure 1 shows the Windows 10 startup process.
|
||||
|
||||
|
||||
.png)
|
||||
|
||||
**Figure 1. Secure Boot, Trusted Boot, and Measured Boot block malware at every stage**
|
||||
|
||||
Secure Boot and Measured Boot are only possible on PCs with UEFI 2.3.1 and a TPM chip. Fortunately, all Windows 10 PCs that meet Windows Hardware Compatibility Program requirements have these components, and many PCs designed for earlier versions of Windows have them as well.
|
||||
|
||||
The sections that follow describe Secure Boot, Trusted Boot, ELAM, and Measured Boot.
|
||||
|
||||
## Secure Boot
|
||||
When a PC starts, it first finds the operating system bootloader. PCs without Secure Boot simply run whatever bootloader is on the PC’s hard drive. There’s no way for the PC to tell whether it’s a trusted operating system or a rootkit.
|
||||
|
||||
When a PC equipped with UEFI starts, the PC first verifies that the firmware is digitally signed, reducing the risk of firmware rootkits. If Secure Boot is enabled, the firmware examines the bootloader’s digital signature to verify that it hasn’t been modified. If the bootloader is intact, the firmware starts the bootloader only if one of the following conditions is true:
|
||||
|
||||
- **The bootloader was signed using a trusted certificate.** In the case of PCs certified for Windows 10, the Microsoft® certificate is trusted.
|
||||
- **The user has manually approved the bootloader’s digital signature.** This allows the user to load non-Microsoft operating systems.
|
||||
|
||||
All x86-based Certified For Windows 10 PCs must meet several requirements related to Secure Boot:
|
||||
|
||||
- They must have Secure Boot enabled by default.
|
||||
- They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed).
|
||||
- They must allow the user to configure Secure Boot to trust other bootloaders.
|
||||
- They must allow the user to completely disable Secure Boot.
|
||||
|
||||
These requirements help protect you from rootkits while allowing you to run any operating system you want. You have three options for running non-Microsoft operating systems:
|
||||
|
||||
- **Use an operating system with a certified bootloader.** Because all Certified For Windows 10 PCs must trust Microsoft’s certificate, Microsoft offers a service to analyze and sign any non-Microsoft bootloader so that it will be trusted by all Certified For Windows 10 PCs. In fact, an [open source bootloader](http://mjg59.dreamwidth.org/20303.html) capable of loading Linux is already available. To begin the process of obtaining a certificate, go to <http://sysdev.microsoft.com>.
|
||||
- **Configure UEFI to trust your custom bootloader.** All Certified For Windows 10 PCs allow you to trust a non-certified bootloader by adding a signature to the UEFI database, allowing you to run any operating system, including homemade operating systems.
|
||||
- **Turn off Secure Boot.** All Certified For Windows 10 PCs allow you to turn off Secure Boot so that you can run any software. This does not help protect you from bootkits, however.
|
||||
|
||||
To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings. For more information about Secure Boot, read the blog, [Protecting the pre-OS environment with UEFI](http://blogs.msdn.com/b/b8/archive/2011/09/22/protecting-the-pre-os-environment-with-uefi.aspx).
|
||||
|
||||
Like most mobile devices, ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot cannot be turned off, and you cannot load a different operating system. Fortunately, there is a large market of ARM devices designed to run other operating systems.
|
||||
|
||||
## Trusted Boot
|
||||
Trusted Boot takes over where Secure Boot leaves off. The bootloader verifies the digital signature of the Windows 10 kernel before loading it. The Windows 10 kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM. If a file has been modified, the bootloader detects the problem and refuses to load the corrupted component. Often, Windows 10 can automatically repair the corrupted component, restoring the integrity of Windows and allowing the PC to start normally.
|
||||
|
||||
## Early Launch Anti-Malware
|
||||
Because Secure Boot has protected the bootloader and Trusted Boot has protected the Windows kernel, the next opportunity for malware to start is by infecting a non-Microsoft boot driver. Traditional anti-malware apps don’t start until after the boot drivers have been loaded, giving a rootkit disguised as a driver the opportunity to work.
|
||||
|
||||
Early Launch Anti-Malware (ELAM) can load a Microsoft or non-Microsoft anti-malware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the operating system hasn’t started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: examine every boot driver and determine whether it is on the list of trusted drivers. If it’s not trusted, Windows won’t load it.
|
||||
|
||||
An ELAM driver isn’t a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows 10) supports ELAM, as does [Microsoft System Center 2012 Endpoint Protection](https://www.microsoft.com/en-us/server-cloud/system-center/endpoint-protection-2012.aspx) and several non-Microsoft anti-malware apps.
|
||||
|
||||
## Measured Boot
|
||||
If a PC in your organization does become infected with a rootkit, you need to know about it. Enterprise anti-malware apps can report malware infections to the IT department, but that doesn’t work with rootkits that hide their presence. In other words, you can’t trust the client to tell you whether it’s healthy.
|
||||
|
||||
As a result, PCs infected with rootkits appear to be healthy, even with anti-malware running. Infected PCs continue to connect to the enterprise network, giving the rootkit access to vast amounts of confidential data and potentially allowing the rootkit to spread across the internal network.
|
||||
|
||||
Working with the TPM and non-Microsoft software, Measured Boot in Windows 10 allows a trusted server on the network to verify the integrity of the Windows startup process. Measured Boot uses the following process:
|
||||
|
||||
1. The PC’s UEFI firmware stores in the TPM a hash of the firmware, bootloader, boot drivers, and everything that will be loaded before the anti-malware app.
|
||||
2. At the end of the startup process, Windows starts the non-Microsoft remote attestation client. The trusted attestation server sends the client a unique key.
|
||||
3. The TPM uses the unique key to digitally sign the log recorded by the UEFI.
|
||||
4. The client sends the log to the server, possibly with other security information.
|
||||
|
||||
Depending on the implementation and configuration, the server can now determine whether the client is healthy and grant the client access to either a limited quarantine network or to the full network.
|
||||
|
||||
Figure 2 illustrates the Measured Boot and remote attestation process.
|
||||
|
||||
|
||||
.png)
|
||||
|
||||
|
||||
**Figure 2. Measured Boot proves the PC’s health to a remote server**
|
||||
|
||||
|
||||
Windows 10 includes the application programming interfaces to support Measured Boot, but you’ll need non-Microsoft tools to implement a remote attestation client and trusted attestation server to take advantage of it. For an example of such a tool, download the [TPM Platform Crypto-Provider Toolkit](http://research.microsoft.com/en-us/downloads/74c45746-24ad-4cb7-ba4b-0c6df2f92d5d/) from Microsoft Research or Microsoft Enterprise Security MVP Dan Griffin’s [Measured Boot Tool](http://mbt.codeplex.com/).
|
||||
|
||||
Measured Boot uses the power of UEFI, TPM, and Windows 10 to give you a way to confidently assess the trustworthiness of a client PC across the network.
|
||||
|
||||
## Summary
|
||||
Secure Boot, Trusted Boot, and Measured Boot create an architecture that is fundamentally resistant to bootkits and rootkits. In Windows 10, these features have the potential to eliminate kernel-level malware from your network. This is the most ground-breaking anti-malware solution that Windows has ever had; it’s leaps and bounds ahead of everything else. With Windows 10, you can truly trust the integrity of your operating system.
|
||||
|
||||
For more information:
|
||||
|
||||
- Watch a [video demonstration of Secure Boot](https://technet.microsoft.com/en-us/windows/jj737995.aspx)
|
||||
|
||||
## Additional resources
|
||||
- [Windows 10 Enterprise Evaluation](https://technet.microsoft.com/evalcenter/hh699156.aspx?ocid=wc-tn-wctc)
|
||||
@ -1,136 +0,0 @@
|
||||
---
|
||||
title: Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) (Windows 10)
|
||||
description: How unenlightened and enlightened apps might behave, based on Windows Information Protection (WIP) networking policies, app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames.
|
||||
keywords: WIP, Enterprise Data Protection, EDP, Windows Information Protection, unenlightened apps, enlightened apps
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.pagetype: security
|
||||
ms.sitesec: library
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2017
|
||||
---
|
||||
|
||||
# Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later
|
||||
|
||||
Windows Information Protection (WIP) classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data is encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or people will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default.
|
||||
|
||||
To avoid the automatic encryption of data, developers can enlighten apps by adding and compiling code using the Windows Information Protection application programming interfaces. The most likely candidates for enlightenment are apps that:
|
||||
|
||||
- Don’t use common controls for saving files.
|
||||
- Don’t use common controls for text boxes.
|
||||
- Simultaneously work on personal and corporate data (for example, contact apps that display personal and corporate data in a single view or a browser that displays personal and corporate web pages on tabs within a single instance).
|
||||
|
||||
We strongly suggest that the only unenlightened apps you add to your allowed apps list are Line-of-Business (LOB) apps.
|
||||
|
||||
>[!Note]
|
||||
>For more info about creating enlightened apps, see the [Windows Information Protection (WIP)](https://msdn.microsoft.com/en-us/windows/uwp/enterprise/wip-hub) topic in the Windows Dev Center.
|
||||
|
||||
## Unenlightened app behavior
|
||||
This table includes info about how unenlightened apps might behave, based on your Windows Information Protection (WIP) networking policies, your app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>App rule setting</th>
|
||||
<th align="center" colspan="2">Networking policy configuration</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<th> </th>
|
||||
<th align="center">Name-based policies, without the /*AppCompat*/ string</th>
|
||||
<th align="center">Name-based policies, using the /*AppCompat*/ string or proxy-based policies</th>
|
||||
</tr>
|
||||
<tr align="left">
|
||||
<td><strong>Not required.</strong> App connects to enterprise cloud resources directly, using an IP address.</td>
|
||||
<td>
|
||||
<ul>
|
||||
<li>App is entirely blocked from both personal and enterprise cloud resources.</li>
|
||||
<li>No encryption is applied.</li>
|
||||
<li>App can’t access local Work files.</li>
|
||||
</ul>
|
||||
</td>
|
||||
<td>
|
||||
<ul>
|
||||
<li>App can access both personal and enterprise cloud resources. However, you might encounter apps using policies that restrict access to enterprise cloud resources.</li>
|
||||
<li>No encryption is applied.</li>
|
||||
<li>App can’t access local Work files.</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr align="left">
|
||||
<td><strong>Not required.</strong> App connects to enterprise cloud resources, using a hostname.</td>
|
||||
<td colspan="2">
|
||||
<ul>
|
||||
<li>App is blocked from accessing enterprise cloud resources, but can access other network resources.</li>
|
||||
<li>No encryption is applied.</li>
|
||||
<li>App can’t access local Work files.</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr align="left">
|
||||
<td><strong>Allow.</strong> App connects to enterprise cloud resources, using an IP address or a hostname.</td>
|
||||
<td colspan="2">
|
||||
<ul>
|
||||
<li>App can access both personal and enterprise cloud resources.</li>
|
||||
<li>Auto-encryption is applied.</li>
|
||||
<li>App can access local Work files.</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr align="left" colspan="2">
|
||||
<td><strong>Exempt.</strong> App connects to enterprise cloud resources, using an IP address or a hostname.</td>
|
||||
<td colspan="2">
|
||||
<ul>
|
||||
<li>App can access both personal and enterprise cloud resources.</li>
|
||||
<li>No encryption is applied.</li>
|
||||
<li>App can access local Work files.</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
## Enlightened app behavior
|
||||
This table includes info about how enlightened apps might behave, based on your Windows Information Protection (WIP) networking policies, your app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>App rule setting</th>
|
||||
<th>Networking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Not required.</strong> App connects to enterprise cloud resources, using an IP address or a hostname.</td>
|
||||
<td>
|
||||
<ul>
|
||||
<li>App is blocked from accessing enterprise cloud resources, but can access other network resources.</li>
|
||||
<li>No encryption is applied.</li>
|
||||
<li>App can't access local Work files.</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Allow.</strong> App connects to enterprise cloud resources, using an IP address or a hostname.</td>
|
||||
<td>
|
||||
<ul>
|
||||
<li>App can access both personal and enterprise cloud resources.</li>
|
||||
<li>App protects work data and leaves personal data unprotected.</li>
|
||||
<li>App can access local Work files.</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Exempt.</strong> App connects to enterprise cloud resources, using an IP address or a hostname.</td>
|
||||
<td>
|
||||
<ul>
|
||||
<li>App can access both personal and enterprise cloud resources.</li>
|
||||
<li>App protects work data and leaves personal data unprotected.</li>
|
||||
<li>App can access local Work files.</li>
|
||||
</ul>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,173 +0,0 @@
|
||||
---
|
||||
title: How to collect Windows Information Protection (WIP) audit event logs (Windows 10)
|
||||
description: How to collect and understand your Windows Information Protection audit event logs by using the Reporting configuration service provider (CSP) or the Windows Event Forwarding (for Windows desktop domain-joined devices only).
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2017
|
||||
---
|
||||
|
||||
# How to collect Windows Information Protection (WIP) audit event logs
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later
|
||||
|
||||
Windows Information Protection (WIP) creates audit events in the following situations:
|
||||
|
||||
- If an employee changes the File ownership for a file from **Work** to **Personal**.
|
||||
|
||||
- If data is marked as **Work**, but shared to a personal app or webpage. For example, through copying and pasting, dragging and dropping, sharing a contact, uploading to a personal webpage, or if the user grants a personal app provides temporary access to a work file.
|
||||
|
||||
- If an app has custom audit events.
|
||||
|
||||
## Collect WIP audit logs by using the Reporting configuration service provider (CSP)
|
||||
Collect the WIP audit logs from your employee’s devices by following the guidance provided by the [Reporting configuration service provider (CSP)](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/reporting-csp) documentation. This topic provides info about the actual audit events.
|
||||
|
||||
>[!Note]
|
||||
>The **Data** element in the response includes the requested audit logs in an XML-encoded format.
|
||||
|
||||
### User element and attributes
|
||||
This table includes all available attributes for the **User** element.
|
||||
|
||||
|Attribute |Value type |Description |
|
||||
|----------|-----------|------------|
|
||||
|UserID |String |The security identifier (SID) of the user corresponding to this audit report. |
|
||||
|EnterpriseID |String |The enterprise ID corresponding to this audit report. |
|
||||
|
||||
### Log element and attributes
|
||||
This table includes all available attributes/elements for the **Log** element. The response can contain zero (0) or more **Log** elements.
|
||||
|
||||
|Attribute/Element |Value type |Description |
|
||||
|----------|-----------|------------|
|
||||
|ProviderType |String |This is always **EDPAudit**. |
|
||||
|LogType |String |Includes:<ul><li>**DataCopied.** Work data is copied or shared to a personal location.</li><li>**ProtectionRemoved.** WIP protection is removed from a Work-defined file.</li><li>**ApplicationGenerated.** A custom audit log provided by an app.</li></ul>|
|
||||
|TimeStamp |Int |Uses the [FILETIME structure](https://msdn.microsoft.com/library/windows/desktop/ms724284(v=vs.85).aspx) to represent the time that the event happened. |
|
||||
|Policy |String |How the work data was shared to the personal location:<ul><li>**CopyPaste.** Work data was pasted into a personal location or app.</li><li>**ProtectionRemoved.** Work data was changed to be unprotected.</li><li>**DragDrop.** Work data was dropped into a personal location or app.</li><li>**Share.** Work data was shared with a personal location or app.</li><li>**NULL.** Any other way work data could be made personal beyond the options above. For example, when a work file is opened using a personal application (also known as, temporary access).</li></ul> |
|
||||
|Justification |String |Not implemented. This will always be either blank or NULL.<br><br>**Note**<br>Reserved for future use to collect the user justification for changing from **Work** to **Personal**. |
|
||||
|Object |String |A description of the shared work data. For example, if an employee opens a work file by using a personal app, this would be the file path. |
|
||||
|DataInfo |String |Any additional info about how the work file changed:<ul><li>**A file path.** If an employee uploads a work file to a personal website by using Microsoft Edge or Internet Explorer, the file path is included here.</li><li>**Clipboard data types.** If an employee pastes work data into a personal app, the list of clipboard data types provided by the work app are included here. For more info, see the [Examples](#examples) section of this topic.</li></ul> |
|
||||
|Action |Int |Provides info about what happened when the work data was shared to personal, including:<ul><li>**1.** File decrypt.</li><li>**2.** Copy to location.</li><li>**3.** Send to recipient.</li><li>**4.** Other.</li></ul> |
|
||||
|FilePath |String |The file path to the file specified in the audit event. For example, the location of a file that’s been decrypted by an employee or uploaded to a personal website. |
|
||||
|SourceApplicationName |String |The source app or website. For the source app, this is the AppLocker identity. For the source website, this is the hostname. |
|
||||
|SourceName |String |A string provided by the app that’s logging the event. It’s intended to describe the source of the work data. |
|
||||
|DestinationEnterpriseID |String |The enterprise ID value for the app or website where the employee is sharing the data.<br><br>**NULL**, **Personal**, or **blank** means there’s no enterprise ID because the work data was shared to a personal location. Because we don’t currently support multiple enrollments, you’ll always see one of these values. |
|
||||
|DestinationApplicationName |String |The destination app or website. For the destination app, this is the AppLocker identity. For the destination website, this is the hostname. |
|
||||
|DestinationName |String |A string provided by the app that’s logging the event. It’s intended to describe the destination of the work data. |
|
||||
|Application |String |The AppLocker identity for the app where the audit event happened. |
|
||||
|
||||
### Examples
|
||||
Here are a few examples of responses from the Reporting CSP.
|
||||
|
||||
#### File ownership on a file is changed from work to personal
|
||||
```
|
||||
<SyncML><SyncHdr/><SyncBody><Status><CmdID>1</CmdID><MsgRef>1</MsgRef><CmdRef>0</CmdRef><Cmd>SyncHdr</Cmd><Data>200</Data></Status><Status><CmdID>2</CmdID><MsgRef>1</MsgRef><CmdRef>2</CmdRef><Cmd>Replace</Cmd><Data>200</Data></Status><Status><CmdID>3</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Cmd>Get</Cmd><Data>200</Data></Status><Results><CmdID>4</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Item><Source><LocURI>./Vendor/MSFT/Reporting/EnterpriseDataProtection/RetrieveByTimeRange/Logs</LocURI></Source><Meta><Format xmlns="syncml:metinf">xml</Format></Meta><Data><?xml version="1.0" encoding="utf-8"?>
|
||||
<Reporting Version="com.contoso/2.0/MDM/Reporting">
|
||||
<User UserID="S-1-12-1-1111111111-1111111111-1111111111-1111111111" EnterpriseID="corp.contoso.com">
|
||||
<Log ProviderType="EDPAudit" LogType="ProtectionRemoved" TimeStamp="131357166318347527">
|
||||
<Policy>Protection removed</Policy>
|
||||
<Justification>NULL</Justification>
|
||||
<FilePath>C:\Users\TestUser\Desktop\tmp\demo\Work document.docx</FilePath>
|
||||
</Log>
|
||||
</User>
|
||||
</Reporting></Data></Item></Results><Final/></SyncBody></SyncML>
|
||||
```
|
||||
|
||||
#### A work file is uploaded to a personal webpage in Edge
|
||||
```
|
||||
<SyncML><SyncHdr/><SyncBody><Status><CmdID>1</CmdID><MsgRef>1</MsgRef><CmdRef>0</CmdRef><Cmd>SyncHdr</Cmd><Data>200</Data></Status><Status><CmdID>2</CmdID><MsgRef>1</MsgRef><CmdRef>2</CmdRef><Cmd>Replace</Cmd><Data>200</Data></Status><Status><CmdID>3</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Cmd>Get</Cmd><Data>200</Data></Status><Results><CmdID>4</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Item><Source><LocURI>./Vendor/MSFT/Reporting/EnterpriseDataProtection/RetrieveByTimeRange/Logs</LocURI></Source><Meta><Format xmlns="syncml:metinf">xml</Format></Meta><Data><?xml version="1.0" encoding="utf-8"?>
|
||||
<Reporting Version="com.contoso/2.0/MDM/Reporting">
|
||||
<User UserID="S-1-12-1-1111111111-1111111111-1111111111-1111111111" EnterpriseID="corp.contoso.com">
|
||||
<Log ProviderType="EDPAudit" LogType="DataCopied" TimeStamp="131357192409318534">
|
||||
<Policy>CopyPaste</Policy>
|
||||
<Justification>NULL</Justification>
|
||||
<SourceApplicationName>NULL</SourceApplicationName>
|
||||
<DestinationEnterpriseID>NULL</DestinationEnterpriseID>
|
||||
<DestinationApplicationName>mail.contoso.com</DestinationApplicationName>
|
||||
<DataInfo>C:\Users\TestUser\Desktop\tmp\demo\Work document.docx</DataInfo>
|
||||
</Log>
|
||||
</User>
|
||||
</Reporting></Data></Item></Results><Final/></SyncBody></SyncML>
|
||||
```
|
||||
|
||||
#### Work data is pasted into a personal webpage
|
||||
```
|
||||
<SyncML><SyncHdr/><SyncBody><Status><CmdID>1</CmdID><MsgRef>1</MsgRef><CmdRef>0</CmdRef><Cmd>SyncHdr</Cmd><Data>200</Data></Status><Status><CmdID>2</CmdID><MsgRef>1</MsgRef><CmdRef>2</CmdRef><Cmd>Replace</Cmd><Data>200</Data></Status><Status><CmdID>3</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Cmd>Get</Cmd><Data>200</Data></Status><Results><CmdID>4</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Item><Source><LocURI>./Vendor/MSFT/Reporting/EnterpriseDataProtection/RetrieveByTimeRange/Logs</LocURI></Source><Meta><Format xmlns="syncml:metinf">xml</Format></Meta><Data><?xml version="1.0" encoding="utf-8"?>
|
||||
<Reporting Version="com.contoso/2.0/MDM/Reporting">
|
||||
<User UserID="S-1-12-1-1111111111-1111111111-1111111111-1111111111" EnterpriseID="corp.contoso.com">
|
||||
<Log ProviderType="EDPAudit" LogType="DataCopied" TimeStamp="131357193734179782">
|
||||
<Policy>CopyPaste</Policy>
|
||||
<Justification>NULL</Justification>
|
||||
<SourceApplicationName>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT OFFICE 2016\WINWORD.EXE\16.0.8027.1000</SourceApplicationName>
|
||||
<DestinationEnterpriseID>NULL</DestinationEnterpriseID>
|
||||
<DestinationApplicationName>mail.contoso.com</DestinationApplicationName>
|
||||
<DataInfo>EnterpriseDataProtectionId|Object Descriptor|Rich Text Format|HTML Format|AnsiText|Text|EnhancedMetafile|Embed Source|Link Source|Link Source Descriptor|ObjectLink|Hyperlink</DataInfo>
|
||||
</Log>
|
||||
</User>
|
||||
</Reporting></Data></Item></Results><Final/></SyncBody></SyncML>
|
||||
```
|
||||
|
||||
#### A work file is opened with a personal application
|
||||
```
|
||||
<SyncML><SyncHdr/><SyncBody><Status><CmdID>1</CmdID><MsgRef>1</MsgRef><CmdRef>0</CmdRef><Cmd>SyncHdr</Cmd><Data>200</Data></Status><Status><CmdID>2</CmdID><MsgRef>1</MsgRef><CmdRef>2</CmdRef><Cmd>Replace</Cmd><Data>200</Data></Status><Status><CmdID>3</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Cmd>Get</Cmd><Data>200</Data></Status><Results><CmdID>4</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Item><Source><LocURI>./Vendor/MSFT/Reporting/EnterpriseDataProtection/RetrieveByTimeRange/Logs</LocURI></Source><Meta><Format xmlns="syncml:metinf">xml</Format></Meta><Data><?xml version="1.0" encoding="utf-8"?>
|
||||
<Reporting Version="com.contoso/2.0/MDM/Reporting">
|
||||
<User UserID="S-1-12-1-1111111111-1111111111-1111111111-1111111111" EnterpriseID="corp.contoso.com">
|
||||
<Log ProviderType="EDPAudit" LogType="ApplicationGenerated" TimeStamp="131357194991209469">
|
||||
<Policy>NULL</Policy>
|
||||
<Justification></Justification>
|
||||
<Object>C:\Users\TestUser\Desktop\tmp\demo\Work document.docx</Object>
|
||||
<Action>1</Action>
|
||||
<SourceName>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT® WINDOWS® OPERATING SYSTEM\WORDPAD.EXE\10.0.15063.2</SourceName>
|
||||
<DestinationEnterpriseID>Personal</DestinationEnterpriseID>
|
||||
<DestinationName>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT® WINDOWS® OPERATING SYSTEM\WORDPAD.EXE\10.0.15063.2</DestinationName>
|
||||
<Application>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT® WINDOWS® OPERATING SYSTEM\WORDPAD.EXE\10.0.15063.2</Application>
|
||||
</Log>
|
||||
</User>
|
||||
</Reporting></Data></Item></Results><Final/></SyncBody></SyncML>
|
||||
```
|
||||
|
||||
#### Work data is pasted into a personal application
|
||||
```
|
||||
<SyncML><SyncHdr/><SyncBody><Status><CmdID>1</CmdID><MsgRef>1</MsgRef><CmdRef>0</CmdRef><Cmd>SyncHdr</Cmd><Data>200</Data></Status><Status><CmdID>2</CmdID><MsgRef>1</MsgRef><CmdRef>2</CmdRef><Cmd>Replace</Cmd><Data>200</Data></Status><Status><CmdID>3</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Cmd>Get</Cmd><Data>200</Data></Status><Results><CmdID>4</CmdID><MsgRef>1</MsgRef><CmdRef>4</CmdRef><Item><Source><LocURI>./Vendor/MSFT/Reporting/EnterpriseDataProtection/RetrieveByTimeRange/Logs</LocURI></Source><Meta><Format xmlns="syncml:metinf">xml</Format></Meta><Data><?xml version="1.0" encoding="utf-8"?>
|
||||
<Reporting Version="com.contoso/2.0/MDM/Reporting">
|
||||
<User UserID="S-1-12-1-1111111111-1111111111-1111111111-1111111111" EnterpriseID="corp.contoso.com">
|
||||
<Log ProviderType="EDPAudit" LogType="DataCopied" TimeStamp="131357196076537270">
|
||||
<Policy>CopyPaste</Policy>
|
||||
<Justification>NULL</Justification>
|
||||
<SourceApplicationName>O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\MICROSOFT OFFICE 2016\WINWORD.EXE\16.0.8027.1000</SourceApplicationName>
|
||||
<DestinationEnterpriseID>NULL</DestinationEnterpriseID>
|
||||
<DestinationApplicationName></DestinationApplicationName>
|
||||
<DataInfo>EnterpriseDataProtectionId|Object Descriptor|Rich Text Format|HTML Format|AnsiText|Text|EnhancedMetafile|Embed Source|Link Source|Link Source Descriptor|ObjectLink|Hyperlink</DataInfo>
|
||||
</Log>
|
||||
</User>
|
||||
</Reporting></Data></Item></Results><Final/></SyncBody></SyncML>
|
||||
```
|
||||
|
||||
## Collect WIP audit logs by using Windows Event Forwarding (for Windows desktop domain-joined devices only)
|
||||
Use Windows Event Forwarding to collect and aggregate your WIP audit events. You can view your audit events in the Event Viewer.
|
||||
|
||||
>[!NOTE]
|
||||
>Windows 10 Mobile requires you to use the [Reporting CSP process](#collect-wip-audit-logs-by-using-the-reporting-configuration-service-provider-csp) instead.
|
||||
|
||||
**To view the WIP events in the Event Viewer**
|
||||
1. Open Event Viewer.
|
||||
|
||||
2. In the console tree under **Application and Services Logs\Microsoft\Windows**, click **EDP-Audit-Regular** and **EDP-Audit-TCB**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,172 +0,0 @@
|
||||
---
|
||||
title: Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate (Windows 10)
|
||||
description: Follow these steps to create, verify, and perform a quick recovery by using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate.
|
||||
keywords: Windows Information Protection, WIP, EDP, Enterprise Data Protection
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/31/2017
|
||||
---
|
||||
|
||||
# Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later
|
||||
|
||||
If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you.
|
||||
|
||||
The recovery process included in this topic only works for desktop devices. WIP deletes the data on Windows 10 Mobile devices.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. For more info about when to use a PKI and the general strategy you should use to deploy DRA certificates, see the [Security Watch Deploying EFS: Part 1](https://technet.microsoft.com/magazine/2007.02.securitywatch.aspx) article on TechNet. For more general info about EFS protection, see [Protecting Data by Using EFS to Encrypt Hard Drives](https://msdn.microsoft.com/library/cc875821.aspx).<br><br>If your DRA certificate has expired, you won’t be able to encrypt your files with it. To fix this, you'll need to create a new certificate, using the steps in this topic, and then deploy it through policy.
|
||||
|
||||
**To manually create an EFS DRA certificate**
|
||||
|
||||
1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate.
|
||||
|
||||
2. Run this command:
|
||||
|
||||
<code>cipher /r:<i>EFSRA</i></code>
|
||||
|
||||
Where *EFSRA* is the name of the .cer and .pfx files that you want to create.
|
||||
|
||||
3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file.
|
||||
|
||||
The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1.
|
||||
|
||||
>[!Important]
|
||||
>Because the private keys in your DRA .pfx files can be used to decrypt any WIP file, you must protect them accordingly. We highly recommend storing these files offline, keeping copies on a smart card with strong protection for normal use and master copies in a secured physical location.
|
||||
|
||||
4. Add your EFS DRA certificate to your WIP policy using a deployment tool, such as Microsoft Intune or System Center Configuration Manager.
|
||||
|
||||
>[!Note]
|
||||
>To add your EFS DRA certificate to your policy by using Microsoft Intune, see the [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md) topic. To add your EFS DRA certificate to your policy by using System Center Configuration Manager, see the [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md) topic.
|
||||
|
||||
**To verify your data recovery certificate is correctly set up on a WIP client computer**
|
||||
|
||||
1. Find or create a file that's encrypted using Windows Information Protection. For example, you could open an app on your allowed app list, and then create and save a file so it’s encrypted by WIP.
|
||||
|
||||
2. Open an app on your protected app list, and then create and save a file so that it’s encrypted by WIP.
|
||||
|
||||
3. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command:
|
||||
|
||||
<code>cipher /c <i>filename</i></code>
|
||||
|
||||
Where *filename* is the name of the file you created in Step 1.
|
||||
|
||||
4. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list.
|
||||
|
||||
**To recover your data using the EFS DRA certificate in a test environment**
|
||||
|
||||
1. Copy your WIP-encrypted file to a location where you have admin access.
|
||||
|
||||
2. Install the EFSDRA.pfx file, using its password.
|
||||
|
||||
3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command:
|
||||
|
||||
<code>cipher /d <i>encryptedfile.extension</i></code>
|
||||
|
||||
Where *encryptedfile.extension* is the name of your encrypted file. For example, corporatedata.docx.
|
||||
|
||||
**To quickly recover WIP-protected desktop data after unenrollment**
|
||||
|
||||
It's possible that you might revoke data from an unenrolled device only to later want to restore it all. This can happen in the case of a missing device being returned or if an unenrolled employee enrolls again. If the employee enrolls again using the original user profile, and the revoked key store is still on the device, all of the revoked data can be restored at once, by following these steps.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>To maintain control over your enterprise data, and to be able to revoke again in the future, you must only perform this process after the employee has re-enrolled the device.
|
||||
|
||||
1. Have your employee sign in to the unenrolled device, open a command prompt, and type:
|
||||
|
||||
<code>Robocopy “%localappdata%\Microsoft\EDP\Recovery” “<i>new_location</i>” /EFSRAW</code>
|
||||
|
||||
Where ”*new_location*" is in a different directory. This can be on the employee’s device or on a Windows 8 or Windows Server 2012 or newer server file share that can be accessed while you're logged in as a data recovery agent.
|
||||
|
||||
2. Sign in to a different device with administrator credentials that have access to your organization's DRA certificate, and perform the file decryption and recovery by typing:
|
||||
|
||||
<code>cipher.exe /D "<i>new_location</i>"</code>
|
||||
|
||||
3. Have your employee sign in to the unenrolled device, and type:
|
||||
|
||||
<code>Robocopy "<i>new_location</i>" “%localappdata%\Microsoft\EDP\Recovery\Input”</code>
|
||||
|
||||
4. Ask the employee to lock and unlock the device.
|
||||
|
||||
The Windows Credential service automatically recovers the employee’s previously revoked keys from the <code>Recovery\Input</code> location.
|
||||
|
||||
**To quickly recover WIP-protected desktop data in a cloud-based environment**
|
||||
|
||||
If you use a cloud environment in your organization, you may still want to restore an employee's data after revocation. While much of the process is the same as when you're not in a cloud environment, there are a couple of differences.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>To maintain control over your enterprise data, and to be able to revoke again in the future, you must only perform this process after the employee has re-enrolled the device.
|
||||
|
||||
1. Have your employee sign in to the device that has revoked data for you to restore, open the **Run** command (Windows logo key + R), and type one of the following commands:
|
||||
|
||||
- If the keys are still stored within the employee's profile, type: <code>Robocopy “%localappdata%\Microsoft\EDP\Recovery” “<i>new_location</i>” * /EFSRAW</code>
|
||||
|
||||
-or-
|
||||
|
||||
- If the employee performed a clean installation over the operating system and you need to recover the keys from the System Volume folder, type: <code>Robocopy “<i>drive_letter:</i>\System Volume Information\EDP\Recovery\” "<i>new_location</i>” * /EFSRAW></code>
|
||||
|
||||
>[!Important]
|
||||
>The “*new_location*” must be in a different directory, either on the employee’s device or on a Windows 8 or Windows Server 2012 or newer server file share, which can be accessed while you're logged in as a data recovery agent.
|
||||
|
||||
2. Sign in to a different device with administrator credentials that have access to your organization's DRA certificate private key, and perform the file decryption and recovery by typing:
|
||||
|
||||
<code>cipher.exe /D “<i>new_location</i>”</code>
|
||||
|
||||
3. Have your employee sign in to the device again, open the **Run** command, and type:
|
||||
|
||||
<code>Robocopy “<i>new_location</i>” “%localappdata%\Microsoft\EDP\Recovery\Input”</code>
|
||||
|
||||
4. Ask the employee to lock and unlock the device.
|
||||
|
||||
The Windows Credential service automatically recovers the employee’s previously revoked keys from the <code>Recovery\Input</code> location. All your company’s previously revoked files should be accessible to the employee again.
|
||||
|
||||
## Auto-recovery of encryption keys
|
||||
Starting with Windows 10, version 1709, WIP includes a data recovery feature that lets your employees auto-recover access to work files if the encryption key is lost and the files are no longer accessible. This typically happens if an employee reimages the operating system partition, removing the WIP key info, or if a device is reported as lost and you mistakenly target the wrong device for unenrollment.
|
||||
|
||||
To help make sure employees can always access files, WIP creates an auto-recovery key that’s backed up to their Azure Active Directory (Azure AD) identity.
|
||||
|
||||
The employee experience is based on sign in with an Azure AD work account. The employee can either:
|
||||
|
||||
- Add a work account through the **Windows Settings > Accounts > Access work or school > Connect** menu.
|
||||
|
||||
-OR-
|
||||
|
||||
- Open **Windows Settings > Accounts > Access work or school > Connect** and choose the **Join this device to Azure Active Directory** link, under **Alternate actions**.
|
||||
|
||||
>[!Note]
|
||||
>To perform an Azure AD Domain Join from the Settings page, the employee must have administrator privileges to the device.
|
||||
|
||||
After signing in, the necessary WIP key info is automatically downloaded and employees are able to access the files again.
|
||||
|
||||
**To test what the employee sees during the WIP key recovery process**
|
||||
1. Attempt to open a work file on an unenrolled device.
|
||||
|
||||
The **Connect to Work to access work files** box appears.
|
||||
|
||||
2. Click **Connect**.
|
||||
|
||||
The **Access work or school settings** page appears.
|
||||
|
||||
3. Sign-in to Azure AD as the employee and verify that the files now open
|
||||
|
||||
## Related topics
|
||||
- [Security Watch Deploying EFS: Part 1](https://technet.microsoft.com/magazine/2007.02.securitywatch.aspx)
|
||||
|
||||
- [Protecting Data by Using EFS to Encrypt Hard Drives](https://msdn.microsoft.com/library/cc875821.aspx)
|
||||
|
||||
- [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md)
|
||||
|
||||
- [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-wip-policy-using-sccm.md)
|
||||
|
||||
- [Creating a Domain-Based Recovery Agent](https://msdn.microsoft.com/library/cc875821.aspx#EJAA)
|
||||
|
||||
|
||||
>[!Note]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to this article](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,73 +0,0 @@
|
||||
---
|
||||
title: Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune (Windows 10)
|
||||
description: After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to associate and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy.
|
||||
keywords: WIP, Enterprise Data Protection
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2017
|
||||
---
|
||||
|
||||
# Associate and deploy a VPN policy for Windows Information Protection (WIP) using the Azure portal for Microsoft Intune
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later (except Microsoft Azure Rights Management, which is only available on the desktop)
|
||||
|
||||
After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to associate and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy.
|
||||
|
||||
## Associate your WIP policy to your VPN policy by using Microsoft Intune
|
||||
Follow these steps to associate your WIP policy with your organization's existing VPN policy.
|
||||
|
||||
**To associate your policies**
|
||||
|
||||
1. Create your VPN profile. For info about how to do this, see [How to configure VPN settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune-azure/configure-devices/how-to-configure-vpn-settings) and [How to create custom VPN profiles in Microsoft Intune](https://docs.microsoft.com/en-us/intune-azure/configure-devices/create-custom-vpn-profiles#create-a-custom-configuration).
|
||||
|
||||
2. Open the Microsoft Intune mobile application management console, click **Device configuration**, and then click **Create Profile**.
|
||||
|
||||
|
||||
|
||||
3. In the **Create Profile** blade, type a name for your profile, such as *Contoso_VPN_Win10*, into the **Name** box, add an optional description for your policy into the **Description** box, select **Windows 10 and later** from the **Platform** dropdown box, select **Custom** from the **Profile type** dropdown box, and then click **Configure**.
|
||||
|
||||
|
||||
|
||||
4. In the **Custom OMA-URI Settings** blade, click **Add**.
|
||||
|
||||
5. In the **Add Row** blade, type:
|
||||
|
||||
- **Name.** Type a name for your setting, such as *EDPModeID*.
|
||||
|
||||
- **Description.** Type an optional description for your setting.
|
||||
|
||||
- **OMA-URI.** Type _./Vendor/MSFT/VPNv2/<VPNProfileName>/EDPModeId_ into the box.
|
||||
|
||||
- **Data type.** Select **String** from the dropdown box
|
||||
|
||||
- **Value.** Type your fully-qualified domain that should be used by the OMA-URI setting. For example, _corp.contoso.com_.
|
||||
|
||||
|
||||
|
||||
6. Click **OK** to save your setting info in the **Add Row** blade, and then click **OK** in the **Custom OMA-URI Settings** blade to save the setting with your policy.
|
||||
|
||||
7. Click **Create** to create the policy, including your OMA_URI info.
|
||||
|
||||
## Deploy your VPN policy using Microsoft Intune
|
||||
After you’ve created your VPN policy, you'll need to deploy it to the same group you deployed your Windows Information Protection (WIP) policy.
|
||||
|
||||
**To deploy your Custom VPN policy**
|
||||
|
||||
1. On the **App policy** blade, click your newly-created policy, click **User groups** from the menu that appears, and then click **Add user group**.
|
||||
|
||||
A list of user groups, made up of all of the security groups in your Azure Active Directory, appear in the **Add user group** blade.
|
||||
|
||||
2. Choose the group you want your policy to apply to, and then click **Select** to deploy the policy.
|
||||
|
||||
The policy is deployed to the selected users' devices.
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,121 +0,0 @@
|
||||
---
|
||||
title: Associate and deploy a VPN policy for Windows Information Protection (WIP) using the classic console for Microsoft Intune (Windows 10)
|
||||
description: After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to create and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy.
|
||||
ms.assetid: d0eaba4f-6d7d-4ae4-8044-64680a40cf6b
|
||||
keywords: WIP, Enterprise Data Protection
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2017
|
||||
---
|
||||
|
||||
# Associate and deploy a VPN policy for Windows Information Protection (WIP) using the classic console for Microsoft Intune
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later
|
||||
|
||||
After you've created and deployed your Windows Information Protection (WIP) policy, you can use Microsoft Intune to create and deploy your Virtual Private Network (VPN) policy, linking it to your WIP policy.
|
||||
|
||||
## Create your VPN policy using Microsoft Intune
|
||||
Follow these steps to create the VPN policy you want to use with WIP.
|
||||
|
||||
**To create your VPN policy**
|
||||
|
||||
1. Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy**.
|
||||
|
||||
2. Go to **Windows**, click the **VPN Profile (Windows 10 Desktop and Mobile and later)**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**.
|
||||
|
||||
|
||||
|
||||
3. Type *Contoso_VPN_Win10* into the **Name** box, along with an optional description for your policy into the **Description** box.
|
||||
|
||||
|
||||
|
||||
4. In the **VPN Settings** area, type the following info:
|
||||
|
||||
- **VPN connection name.** This name is also what appears to your employees, so it's important that it be clear and understandable.
|
||||
|
||||
- **Connection type.** Pick the connection type that matches your infrastructure. The options are **Pulse Secure**, **F5 Edge Client**, **Dell SonicWALL Mobile Connect**, or **Check Point Capsule VPN**.
|
||||
|
||||
- **VPN server description.** A descriptive name for this connection. Only you will see it, but it should be unique and readable.
|
||||
|
||||
- **Server IP address or FQDN.** The server's IP address or fully-qualified domain name (FQDN).
|
||||
|
||||
|
||||
|
||||
5. In the **Authentication** area, choose the authentication method that matches your VPN infrastructure, either **Username and Password** or **Certificates**.<p>
|
||||
It's your choice whether you check the box to **Remember the user credentials at each logon**.
|
||||
|
||||
|
||||
|
||||
6. You can leave the rest of the default or blank settings, and then click **Save Policy**.
|
||||
|
||||
## Deploy your VPN policy using Microsoft Intune
|
||||
After you’ve created your VPN policy, you'll need to deploy it to the same group you deployed your Windows Information Protection (WIP) policy.
|
||||
|
||||
**To deploy your VPN policy**
|
||||
|
||||
1. On the **Configuration policies** page, locate your newly-created policy, click to select it, and then click the **Manage Deployment** button.
|
||||
|
||||
2. In the left pane of the **Manage Deployment** box, click the employees or groups that should get the policy, and then click **Add**.<p>
|
||||
The added people move to the **Selected Groups** list on the right-hand pane.
|
||||
|
||||
|
||||
|
||||
3. After you've picked all of the employees and groups that should get the policy, click **OK**.<p>
|
||||
The policy is deployed to the selected users' devices.
|
||||
|
||||
## Link your WIP and VPN policies and deploy the custom configuration policy
|
||||
The final step to making your VPN configuration work with WIP, is to link your two policies together. To do this, you must first create a custom configuration policy, setting it to use your **EDPModeID** setting, and then deploying the policy to the same group you deployed your WIP and VPN policies
|
||||
|
||||
**To link your VPN policy**
|
||||
|
||||
1. Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy**.
|
||||
|
||||
2. Go to **Windows**, click the **Custom Configuration (Windows 10 Desktop and Mobile and later)**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**.
|
||||
|
||||
|
||||
|
||||
3. Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes.
|
||||
|
||||
|
||||
|
||||
4. In the **OMA-URI Settings** area, click **Add** to add your **EDPModeID** info.
|
||||
|
||||
5. In the **OMA-URI Settings** area, type the following info:
|
||||
|
||||
- **Setting name.** Type **EDPModeID** as the name.
|
||||
|
||||
- **Data type.** Pick the **String** data type.
|
||||
|
||||
- **OMA-URI.** Type `./Vendor/MSFT/VPNv2/<VPNProfileName>/EDPModeId`, replacing <*VPNProfileName*> with the name you gave to your VPN policy. For example, `./Vendor/MSFT/VPNv2/W10-Checkpoint-VPN1/EDPModeId`.
|
||||
|
||||
- **Value.** Your fully-qualified domain that should be used by the OMA-URI setting.
|
||||
|
||||
|
||||
|
||||
6. Click **OK** to save your new OMA-URI setting, and then click **Save Policy.**
|
||||
|
||||
|
||||
**To deploy your linked policy**
|
||||
|
||||
1. On the **Configuration policies** page, locate your newly-created policy, click to select it, and then click the **Manage Deployment** button.
|
||||
|
||||
2. In the left pane of the **Manage Deployment** box, click the employees or groups that should get the policy, and then click **Add**. The added people move to the **Selected Groups** list on the right-hand pane.
|
||||
|
||||
|
||||
|
||||
3. After you've picked all of the employees and groups that should get the policy, click **OK**. The policy is deployed to the selected users' devices.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,533 +0,0 @@
|
||||
---
|
||||
title: Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune (Windows 10)
|
||||
description: The Azure portal for Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, supporting mobile device management (MDM), to let you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/16/2017
|
||||
---
|
||||
|
||||
# Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later (except Microsoft Azure Rights Management, which is only available on the desktop)
|
||||
|
||||
Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network.
|
||||
|
||||
>[!Important]
|
||||
>This topic covers creating a Windows Information Protection (WIP) policy for organizations already managing devices by using Mobile Device Management (MDM) solutions. If your organization uses a mobile application management (MAM) solution to deploy your WIP policy to Intune apps without managing devices, you must follow the instructions in the [Create a Windows Information Protection (WIP) policy with MAM using the Azure portal for Microsoft Intune](create-wip-policy-using-mam-intune-azure.md) topic.
|
||||
|
||||
## Add a WIP policy
|
||||
After you’ve set up Intune for your organization, you must create a WIP-specific policy.
|
||||
|
||||
**To add a WIP policy**
|
||||
1. Open the Microsoft Intune mobile application management console, click **All settings**, and then click **App policy**.
|
||||
|
||||
|
||||
|
||||
2. In the **App policy** screen, click **Add a policy**, and then fill out the fields:
|
||||
- **Name.** Type a name (required) for your new policy.
|
||||
|
||||
- **Description.** Type an optional description.
|
||||
|
||||
- **Platform.** Choose **Windows 10** as the supported platform for your policy.
|
||||
|
||||
- **Enrollment state.** Choose **With enrollment** as the enrollment state for your policy.
|
||||
|
||||
|
||||
|
||||
>[!Important]
|
||||
>Choosing **With enrollment** only applies for organizations using MDM. If you're using MAM, you must use these instructions, [Create and deploy Windows Information Protection (WIP) app protection policy with Intune](https://docs.microsoft.com/en-us/intune/deploy-use/create-windows-information-protection-policy-with-intune), instead.
|
||||
|
||||
3. Click **Create**.
|
||||
|
||||
The policy is created and appears in the table on the **App Policy** screen.
|
||||
|
||||
>[!NOTE]
|
||||
>Optionally, you can also add your apps and set your settings from the **Add a policy** blade, but for the purposes of this documentation, we recommend instead that you create the policy first, and then use the subsequent menus that become available.
|
||||
|
||||
## Add apps to your Allowed apps list
|
||||
During the policy-creation process in Intune, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
|
||||
|
||||
The steps to add your apps are based on the type of template being applied. You can add a recommended app, a store app (also known as a Universal Windows Platform (UWP) app), or a signed Windows desktop app.
|
||||
|
||||
>[!Important]
|
||||
>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.<br><br>Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **Allowed apps** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
|
||||
|
||||
### Add a Recommended app to your Allowed apps list
|
||||
For this example, we’re going to add Microsoft Edge, a recommended app, to the **Allowed apps** list.
|
||||
|
||||
**To add a recommended app**
|
||||
1. From the **App policy** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears.
|
||||
|
||||
The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy.
|
||||
|
||||
|
||||
|
||||
2. From the **Allowed apps** blade, click **Add apps**.
|
||||
|
||||
The **Add apps** blade appears, showing you all **Recommended apps**.
|
||||
|
||||
|
||||
|
||||
3. Select each app you want to access your enterprise data, and then click **OK**.
|
||||
|
||||
The **Allowed apps** blade updates to show you your selected apps.
|
||||
|
||||
|
||||
|
||||
### Add a Store app to your Allowed apps list
|
||||
For this example, we’re going to add Microsoft Power BI, a store app, to the **Allowed apps** list.
|
||||
|
||||
**To add a Store app**
|
||||
1. From the **App policy** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears.
|
||||
|
||||
The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy.
|
||||
|
||||
2. From the **Allowed apps** blade, click **Add apps**.
|
||||
|
||||
3. On the **Add apps** blade, click **Store apps** from the dropdown list.
|
||||
|
||||
The blade changes to show boxes for you to add a publisher and app name.
|
||||
|
||||
4. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the Product **name** is `Microsoft.MicrosoftPowerBIForWindows`.
|
||||
|
||||
5. After you’ve entered the info into the fields, click **OK** to add the app to your **Allowed apps** list.
|
||||
|
||||
>[!NOTE]
|
||||
>To add multiple Store apps at the same time, you can click the menu **(…)** at the end of the app row, and then continue to add more apps. When you’re done, click **OK**.
|
||||
|
||||
|
||||
|
||||
If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps.
|
||||
|
||||
**To find the publisher and product name values for Store apps without installing them**
|
||||
1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Microsoft Power BI*.
|
||||
|
||||
2. Copy the ID value from the app URL. For example, Microsoft Power BI ID URL is https://www.microsoft.com/en-us/store/p/microsoft-power-bi/9nblgggzlxn1, and you'd copy the ID value, `9nblgggzlxn1`.
|
||||
|
||||
3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata, where `9nblgggzlxn1` is replaced with your ID value.
|
||||
|
||||
The API runs and opens a text editor with the app details.
|
||||
|
||||
```json
|
||||
{
|
||||
"packageIdentityName": "Microsoft.MicrosoftPowerBIForWindows",
|
||||
"publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
|
||||
}
|
||||
```
|
||||
|
||||
4. Copy the `publisherCertificateName` value into the **Publisher** box and copy the `packageIdentityName` value into the **Name** box of Intune.
|
||||
|
||||
>[!Important]
|
||||
>The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.<br><br>For example:<br>
|
||||
<code>{<br>"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",<br>}</code>
|
||||
|
||||
**To find the publisher and product name values for apps installed on Windows 10 mobile phones**
|
||||
1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature.
|
||||
|
||||
>**Note**<br>Your PC and phone must be on the same wireless network.
|
||||
|
||||
2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**.
|
||||
|
||||
3. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**.
|
||||
|
||||
4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate.
|
||||
|
||||
5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step.
|
||||
|
||||
6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names.
|
||||
|
||||
7. Start the app for which you're looking for the publisher and product name values.
|
||||
|
||||
8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune.
|
||||
|
||||
>[!Important]
|
||||
>The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.<br><br>For example:<br>
|
||||
<code>{<br>"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",<br>}</code>
|
||||
|
||||
### Add a Desktop app to your Allowed apps list
|
||||
For this example, we’re going to add WordPad, a desktop app, to the **Allowed apps** list.
|
||||
|
||||
**To add a Desktop app**
|
||||
1. From the **App policy** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears.
|
||||
|
||||
The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy.
|
||||
|
||||
2. From the **Allowed apps** blade, click **Add apps**.
|
||||
|
||||
3. On the **Add apps** blade, click **Desktop apps** from the dropdown list.
|
||||
|
||||
The blade changes to show boxes for you to add the following, based on what results you want returned:
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Manages</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>All fields marked as “*”</td>
|
||||
<td>All files signed by any publisher. (Not recommended)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Publisher only</td>
|
||||
<td>If you only fill out this field, you’ll get all files signed by the named publisher.<br><br>This might be useful if your company is the publisher and signer of internal line-of-business apps.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Publisher and Name only</td>
|
||||
<td>If you only fill out these fields, you’ll get all files for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Publisher, Name, and File only</td>
|
||||
<td>If you only fill out these fields, you’ll get any version of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Publisher, Name, File, and Min version only</td>
|
||||
<td>If you only fill out these fields, you’ll get the specified version or newer releases of the named file or package for the specified product, signed by the named publisher.<br><br>This option is recommended for enlightened apps that weren't previously enlightened.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Publisher, Name, File, and Max version only</td>
|
||||
<td>If you only fill out these fields, you’ll get the specified version or older releases of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>All fields completed</td>
|
||||
<td>If you fill out all fields, you’ll get the specified version of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
4. After you’ve entered the info into the fields, click **OK** to add the app to your **Allowed apps** list.
|
||||
|
||||
>[!Note]
|
||||
>To add multiple Desktop apps at the same time, you can click the menu **(…)** at the end of the app row, and then continue to add more apps. When you’re done, click **OK**.
|
||||
|
||||
|
||||
|
||||
**To find the Publisher values for Desktop apps**
|
||||
If you’re unsure about what to include for the publisher, you can run this PowerShell command:
|
||||
|
||||
```ps1
|
||||
Get-AppLockerFileInformation -Path "<path_of_the_exe>"
|
||||
```
|
||||
Where `"<path_of_the_exe>"` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Windows NT\Accessories\wordpad.exe"`.
|
||||
|
||||
In this example, you'd get the following info:
|
||||
|
||||
``` json
|
||||
Path Publisher
|
||||
---- ---------
|
||||
%PROGRAMFILES%\WINDOWS NT\ACCESSORIES\WORDPAD.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US
|
||||
```
|
||||
Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter into the **Publisher** box and `WORDPAD.EXE` is the text to enter into the **File** box.
|
||||
|
||||
### Import a list of apps to your Allowed apps list
|
||||
For this example, we’re going to add an AppLocker XML file to the **Allowed apps** list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) content.
|
||||
|
||||
**To create a list of Allowed apps using the AppLocker tool**
|
||||
1. Open the Local Security Policy snap-in (SecPol.msc).
|
||||
|
||||
2. In the left blade, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**.
|
||||
|
||||
|
||||
|
||||
3. Right-click in the right-hand blade, and then click **Create New Rule**.
|
||||
|
||||
The **Create Packaged app Rules** wizard appears.
|
||||
|
||||
4. On the **Before You Begin** page, click **Next**.
|
||||
|
||||
|
||||
|
||||
5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**.
|
||||
|
||||
|
||||
|
||||
6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area.
|
||||
|
||||
|
||||
|
||||
7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Dynamics 365.
|
||||
|
||||
|
||||
|
||||
8. On the updated **Publisher** page, click **Create**.
|
||||
|
||||
|
||||
|
||||
9. Click **No** in the dialog box that appears, asking if you want to create the default rules. You must not create default rules for your WIP policy.
|
||||
|
||||
|
||||
|
||||
9. Review the Local Security Policy snap-in to make sure your rule is correct.
|
||||
|
||||
|
||||
|
||||
10. In the left blade, right-click on **AppLocker**, and then click **Export policy**.
|
||||
|
||||
The **Export policy** box opens, letting you export and save your new policy as XML.
|
||||
|
||||
|
||||
|
||||
11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**.
|
||||
|
||||
The policy is saved and you’ll see a message that says 1 rule was exported from the policy.
|
||||
|
||||
**Example XML file**<br>
|
||||
This is the XML file that AppLocker creates for Microsoft Dynamics 365.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0"?>
|
||||
<AppLockerPolicy Version="1">
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Appx">
|
||||
<FilePublisherRule Action="Allow" UserOrGroupSid="S-1-1-0" Description="" Name="Microsoft.MicrosoftDynamicsCRMforWindows10, version 3.2.0.0 and above, from Microsoft Corporation" Id="3da34ed9-aec6-4239-88ba-0afdce252ab4">
|
||||
<Conditions>
|
||||
<FilePublisherCondition BinaryName="*" ProductName="Microsoft.MicrosoftDynamicsCRMforWindows10" PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US">
|
||||
<BinaryVersionRange HighSection="*" LowSection="3.2.0.0"/>
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
</RuleCollection>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Dll"/>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Exe"/>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Msi"/>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Script"/>
|
||||
</AppLockerPolicy>
|
||||
```
|
||||
|
||||
12. After you’ve created your XML file, you need to import it by using Microsoft Intune.
|
||||
|
||||
**To import your list of Allowed apps using Microsoft Intune**
|
||||
|
||||
1. From the **Allowed apps** area, click **Import apps**.
|
||||
|
||||
The blade changes to let you add your import file.
|
||||
|
||||
|
||||
|
||||
2. Browse to your exported AppLocker policy file, and then click **Open**.
|
||||
|
||||
The file imports and the apps are added to your **Allowed app** list.
|
||||
|
||||
### Add exempt apps to your policy
|
||||
If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak.
|
||||
|
||||
**To exempt a Store app, a Desktop app, or an AppLocker policy file from the Allowed apps list**
|
||||
|
||||
1. From the **App policy** blade, click the name of your policy, and then click **Exempt apps** from the menu that appears.
|
||||
|
||||
The **Exempt apps** blade appears, showing you any apps that are already included in the list for this policy.
|
||||
|
||||
2. From the **Exempt apps** blade, click **Add apps**.
|
||||
|
||||
Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-apps-to_your-allowed-apps-list) section of this topic.
|
||||
|
||||
3. Fill out the rest of the app info, based on the type of app you’re adding:
|
||||
|
||||
- **Recommended app.** Follow the instructions in the [Add a Recommended app to your Allowed apps list](#add-a-recommended-app-to_your-allowed-apps-list) section of this topic.
|
||||
|
||||
- **Store app.** Follow the instructions in the [Add a Store app to your Allowed apps list](#add-a-store-app-to_your-allowed-apps-list) section of this topic.
|
||||
|
||||
- **Desktop app.** Follow the instructions in the [Add a Desktop app to your Allowed apps list](#add-a-desktop-app-to_your-allowed-apps-list) section of this topic.
|
||||
|
||||
- **AppLocker policy file.** Follow the instructions to create your app list in the [Import a list of apps to your Allowed apps list](#import-a-list-of-apps-to_your-allowed-apps-list) section of this topic, using a list of exempted apps.
|
||||
|
||||
4. Click **OK**.
|
||||
|
||||
## Manage the WIP protection mode for your enterprise data
|
||||
After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode.
|
||||
|
||||
We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Hide Overrides**.
|
||||
|
||||
>[!NOTE]
|
||||
>For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).
|
||||
|
||||
**To add your protection mode**
|
||||
|
||||
1. From the **App policy** blade, click the name of your policy, and then click **Required settings** from the menu that appears.
|
||||
|
||||
The **Required settings** blade appears.
|
||||
|
||||
|
||||
|
||||
|Mode |Description |
|
||||
|-----|------------|
|
||||
|Hide Overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.|
|
||||
|Allow Overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).|
|
||||
|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.|
|
||||
|Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.<br><br>After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.|
|
||||
|
||||
2. Click **Save**.
|
||||
|
||||
## Define your enterprise-managed corporate identity
|
||||
Corporate identity, usually expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies.
|
||||
|
||||
Starting with Windows 10, version 1703, Intune automatically determines your corporate identity and adds it to the **Corporate identity** field.
|
||||
|
||||
**To change your corporate identity**
|
||||
|
||||
1. From the **App policy** blade, click the name of your policy, and then click **Required settings** from the menu that appears.
|
||||
|
||||
The **Required settings** blade appears.
|
||||
|
||||
2. If the auto-defined identity isn’t correct, you can change the info in the **Corporate identity** field. If you need to add additional domains, for example your email domains, you can do it in the **Advanced settings** area.
|
||||
|
||||
|
||||
|
||||
## Choose where apps can access enterprise data
|
||||
After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network.
|
||||
|
||||
There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT).
|
||||
|
||||
>[!Important]
|
||||
>Every WIP policy should include policy that defines your enterprise network locations.<br>Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations.
|
||||
|
||||
**To define where your allowed apps can find and send enterprise data on you network**
|
||||
|
||||
1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears.
|
||||
|
||||
The **Advanced settings** blade appears.
|
||||
|
||||
2. Click **Add network boundary** from the Network perimeter area.
|
||||
|
||||
The **Add network boundary** blade appears.
|
||||
|
||||
|
||||
|
||||
3. Select the type of network boundary to add from the **Boundary type** box.
|
||||
|
||||
4. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the following options, and then click **OK**.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Boundary type</th>
|
||||
<th>Value format</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Cloud Resources</td>
|
||||
<td><strong>With proxy:</strong> contoso.sharepoint.com,contoso.internalproxy1.com|<br>contoso.visualstudio.com,contoso.internalproxy2.com<br><br><strong>Without proxy:</strong> contoso.sharepoint.com|contoso.visualstudio.com</td>
|
||||
<td>Specify the cloud resources to be treated as corporate and protected by WIP.<br><br>For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.<br><br>If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: <code>URL <,proxy>|URL <,proxy></code>.<br><br><strong>Important</strong><br>In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the <code>/*AppCompat*/</code> string to the setting. For example: <code>URL <,proxy>|URL <,proxy>|/*AppCompat*/</code>.<br><br>When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the <strong>Domain joined or marked as compliant</strong> option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Network domain names</td>
|
||||
<td>corp.contoso.com,region.contoso.com</td>
|
||||
<td>Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.<br><br>If you have multiple resources, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Proxy servers</td>
|
||||
<td>proxy.contoso.com:80;proxy2.contoso.com:443</td>
|
||||
<td>Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.<br><br>This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.<br><br>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Internal proxy servers</td>
|
||||
<td>contoso.internalproxy1.com;contoso.internalproxy2.com</td>
|
||||
<td>Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.<br><br>This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.<br><br>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>IPv4 ranges</td>
|
||||
<td>**Starting IPv4 Address:** 3.4.0.1<br>**Ending IPv4 Address:** 3.4.255.254<br>**Custom URI:** 3.4.0.1-3.4.255.254,<br>10.0.0.1-10.255.255.254</td>
|
||||
<td>Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries.<br><br>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>IPv6 ranges</td>
|
||||
<td>**Starting IPv6 Address:** 2a01:110::<br>**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff<br>**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,<br>fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</td>
|
||||
<td>Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries.<br><br>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Neutral resources</td>
|
||||
<td>sts.contoso.com,sts.contoso2.com</td>
|
||||
<td>Specify your authentication redirection endpoints for your company.<br><br>These locations are considered enterprise or personal, based on the context of the connection before the redirection.<br><br>If you have multiple resources, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
5. Repeat steps 1-4 to add any additional network boundaries.
|
||||
|
||||
6. Decide if you want to Windows to look for additional network settings:
|
||||
|
||||
|
||||
|
||||
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network.
|
||||
|
||||
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network.
|
||||
|
||||
## Upload your Data Recovery Agent (DRA) certificate
|
||||
After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data.
|
||||
|
||||
>[!Important]
|
||||
>Using a DRA certificate isn’t mandatory. However, we strongly recommend it. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](https://docs.microsoft.com/en-us/windows/threat-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate) topic.
|
||||
|
||||
**To upload your DRA certificate**
|
||||
1. From the **App policy** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears.
|
||||
|
||||
The **Advanced settings** blade appears.
|
||||
|
||||
2. In the **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy.
|
||||
|
||||
|
||||
|
||||
## Choose your optional WIP-related settings
|
||||
After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings.
|
||||
|
||||
**To set your optional settings**
|
||||
|
||||
1. Choose to set any or all optional settings:
|
||||
|
||||
|
||||
|
||||
- **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile.** Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are:
|
||||
|
||||
- **On (recommended).** Turns on the feature and provides the additional protection.
|
||||
|
||||
- **Off, or not configured.** Doesn't enable this feature.
|
||||
|
||||
- **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are:
|
||||
|
||||
- **On, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment.
|
||||
|
||||
- **Off.** Stop local encryption keys from being revoked from a device during unenrollment. For example if you’re migrating between Mobile Device Management (MDM) solutions.
|
||||
|
||||
- **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are:
|
||||
|
||||
- **On.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with Managed text on the app name in the **Start** menu.
|
||||
|
||||
- **Off, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option.
|
||||
|
||||
- **Use Azure RMS for WIP.** Determines whether to use Azure Rights Management encryption with Windows Information Protection.
|
||||
|
||||
- **On.** Starts using Azure Rights Management encryption with WIP. By turning this option on, you can also add a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. For more info about setting up Azure Rights management and using a template ID with WIP, see the [Choose to set up Azure Rights Management with WIP](#choose-to-set-up-azure-rights-management-with-wip) section of this topic.
|
||||
|
||||
- **Off, or not configured.** Stops using Azure Rights Management encryption with WIP.
|
||||
|
||||
## Choose to set up Azure Rights Management with WIP
|
||||
WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files by using removable drives such as USB drives. For more info about Azure Rights Management, see [Microsoft Azure Rights Management](https://products.office.com/en-us/business/microsoft-azure-rights-management). To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up.
|
||||
|
||||
To configure WIP to use Azure Rights Management, you must set the **AllowAzureRMSForEDP** MDM setting to **1** in Microsoft Intune. This setting tells WIP to encrypt files copied to removable drives with Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703.
|
||||
|
||||
Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the **RMSTemplateIDForEDP** MDM setting to the **TemplateID** of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the **EditRightsData** option.
|
||||
|
||||
>[!NOTE]
|
||||
>For more info about setting the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp) topic. For more info about setting up and using a custom template, see [Configuring custom templates for the Azure Rights Management service](https://docs.microsoft.com/en-us/information-protection/deploy-use/configure-custom-templates) topic.
|
||||
|
||||
## Related topics
|
||||
- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md)
|
||||
|
||||
- [Deploy your Windows Information Protection (WIP) policy](deploy-wip-policy-using-intune.md)
|
||||
|
||||
- [Associate and deploy your Windows Information Protection (WIP) and VPN policies by using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md)
|
||||
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
|
||||
|
||||
- [What is Azure Rights Management?]( https://docs.microsoft.com/en-us/information-protection/understand-explore/what-is-azure-rms)
|
||||
|
||||
- [Create and deploy Windows Information Protection (WIP) app protection policy with Intune and MAM](https://docs.microsoft.com/en-us/intune/deploy-use/create-windows-information-protection-policy-with-intune)
|
||||
|
||||
- [Intune MAM Without Enrollment](https://blogs.technet.microsoft.com/configmgrdogs/2016/02/04/intune-mam-without-enrollment/)
|
||||
|
||||
- [Azure RMS Documentation Update for May 2016](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/azure-rms-documentation-update-for-may-2016/)
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,478 +0,0 @@
|
||||
---
|
||||
title: Create a Windows Information Protection (WIP) policy using the classic console for Microsoft Intune (Windows 10)
|
||||
description: Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.
|
||||
ms.assetid: 4b307c99-3016-4d6a-9ae7-3bbebd26e721
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/16/2017
|
||||
---
|
||||
|
||||
# Create a Windows Information Protection (WIP) policy using the classic console for Microsoft Intune
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later
|
||||
|
||||
Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network.
|
||||
|
||||
## Add a WIP policy
|
||||
After you’ve set up Intune for your organization, you must create a WIP-specific policy.
|
||||
|
||||
**To add a WIP policy**
|
||||
1. Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy** from the **Tasks** area.
|
||||
|
||||
2. Go to **Windows**, click the **Windows Information Protection (Windows 10 Desktop and Mobile and later) policy**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**.
|
||||
|
||||
|
||||
|
||||
3. Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes.
|
||||
|
||||
|
||||
|
||||
## Add app rules to your policy
|
||||
During the policy-creation process in Intune, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
|
||||
|
||||
The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file.
|
||||
|
||||
>[!Important]
|
||||
>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.<p>Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App Rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
|
||||
|
||||
### Add a store app rule to your policy
|
||||
For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list.
|
||||
|
||||
**To add a store app**
|
||||
1. From the **App Rules** area, click **Add**.
|
||||
|
||||
The **Add App Rule** box appears.
|
||||
|
||||
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*.
|
||||
|
||||
3. Click **Allow** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic.
|
||||
|
||||
4. Pick **Store App** from the **Rule template** drop-down list.
|
||||
|
||||
The box changes to show the store app rule options.
|
||||
|
||||
5. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`.
|
||||
|
||||
If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps.
|
||||
|
||||
**To find the Publisher and Product Name values for Store apps without installing them**
|
||||
1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Microsoft OneNote*.
|
||||
|
||||
2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`.
|
||||
|
||||
3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata, where `9wzdncrfhvjl` is replaced with your ID value.
|
||||
|
||||
The API runs and opens a text editor with the app details.
|
||||
|
||||
```json
|
||||
{
|
||||
"packageIdentityName": "Microsoft.Office.OneNote",
|
||||
"publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
|
||||
}
|
||||
```
|
||||
|
||||
4. Copy the `publisherCertificateName` value into the **Publisher Name** box and copy the `packageIdentityName` value into the **Product Name** box of Intune.
|
||||
|
||||
>[!Important]
|
||||
>The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.<p>For example:<br>
|
||||
```json
|
||||
{
|
||||
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
|
||||
}
|
||||
```
|
||||
|
||||
**To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones**
|
||||
1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature.
|
||||
|
||||
>**Note**<br>Your PC and phone must be on the same wireless network.
|
||||
|
||||
2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**.
|
||||
|
||||
3. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**.
|
||||
|
||||
4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate.
|
||||
|
||||
5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step.
|
||||
|
||||
6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names.
|
||||
|
||||
7. Start the app for which you're looking for the publisher and product name values.
|
||||
|
||||
8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune.
|
||||
|
||||
>[!Important]
|
||||
>The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.<p>For example:<br>
|
||||
```json
|
||||
{
|
||||
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
|
||||
}
|
||||
```
|
||||
|
||||
### Add a desktop app rule to your policy
|
||||
For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list.
|
||||
|
||||
**To add a desktop app**
|
||||
1. From the **App Rules** area, click **Add**.
|
||||
|
||||
The **Add App Rule** box appears.
|
||||
|
||||
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*.
|
||||
|
||||
3. Click **Allow** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic.
|
||||
|
||||
4. Pick **Desktop App** from the **Rule template** drop-down list.
|
||||
|
||||
The box changes to show the store app rule options.
|
||||
|
||||
5. Pick the options you want to include for the app rule (see table), and then click **OK**.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Option</th>
|
||||
<th>Manages</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>All fields left as “*”</td>
|
||||
<td>All files signed by any publisher. (Not recommended)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong> selected</td>
|
||||
<td>All files signed by the named publisher.<p>This might be useful if your company is the publisher and signer of internal line-of-business apps.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong> and <strong>Product Name</strong> selected</td>
|
||||
<td>All files for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, and <strong>Binary name</strong> selected</td>
|
||||
<td>Any version of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>Binary name</strong>, and <strong>File Version, and above</strong>, selected</td>
|
||||
<td>Specified version or newer releases of the named file or package for the specified product, signed by the named publisher.<p>This option is recommended for enlightened apps that weren't previously enlightened.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>Binary name</strong>, and <strong>File Version, And below</strong> selected</td>
|
||||
<td>Specified version or older releases of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>Binary name</strong>, and <strong>File Version, Exactly</strong> selected</td>
|
||||
<td>Specified version of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
If you’re unsure about what to include for the publisher, you can run this PowerShell command:
|
||||
|
||||
```ps1
|
||||
Get-AppLockerFileInformation -Path "<path of the exe>"
|
||||
```
|
||||
Where `"<path of the exe>"` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Internet Explorer\iexplore.exe"`.
|
||||
|
||||
In this example, you'd get the following info:
|
||||
|
||||
``` json
|
||||
Path Publisher
|
||||
---- ---------
|
||||
%PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR...
|
||||
```
|
||||
Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box.
|
||||
|
||||
### Add an AppLocker policy file
|
||||
For this example, we’re going to add an AppLocker XML file to the **App Rules** list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) content.
|
||||
|
||||
**To create an app rule and xml file using the AppLocker tool**
|
||||
1. Open the Local Security Policy snap-in (SecPol.msc).
|
||||
|
||||
2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**.
|
||||
|
||||
|
||||
|
||||
3. Right-click in the right-hand pane, and then click **Create New Rule**.
|
||||
|
||||
The **Create Packaged app Rules** wizard appears.
|
||||
|
||||
4. On the **Before You Begin** page, click **Next**.
|
||||
|
||||
|
||||
|
||||
5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**.
|
||||
|
||||
|
||||
|
||||
6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area.
|
||||
|
||||
|
||||
|
||||
7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Photos.
|
||||
|
||||
|
||||
|
||||
8. On the updated **Publisher** page, click **Create**.
|
||||
|
||||
|
||||
|
||||
9. Review the Local Security Policy snap-in to make sure your rule is correct.
|
||||
|
||||
|
||||
|
||||
10. In the left pane, right-click on **AppLocker**, and then click **Export policy**.
|
||||
|
||||
The **Export policy** box opens, letting you export and save your new policy as XML.
|
||||
|
||||
|
||||
|
||||
11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**.
|
||||
|
||||
The policy is saved and you’ll see a message that says 1 rule was exported from the policy.
|
||||
|
||||
**Example XML file**<br>
|
||||
This is the XML file that AppLocker creates for Microsoft Photos.
|
||||
|
||||
```xml
|
||||
<AppLockerPolicy Version="1">
|
||||
<RuleCollection Type="Exe" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Msi" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Script" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Dll" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Appx" EnforcementMode="NotConfigured">
|
||||
<FilePublisherRule Id="5e0c752b-5921-4f72-8146-80ad5f582110" Name="Microsoft.Windows.Photos, version 16.526.0.0 and above, from Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
|
||||
<Conditions>
|
||||
<FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.Photos" BinaryName="*">
|
||||
<BinaryVersionRange LowSection="16.526.0.0" HighSection="*" />
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
</RuleCollection>
|
||||
</AppLockerPolicy>
|
||||
```
|
||||
12. After you’ve created your XML file, you need to import it by using Microsoft Intune.
|
||||
|
||||
**To import your Applocker policy file app rule using Microsoft Intune**
|
||||
1. From the **App Rules** area, click **Add**.
|
||||
|
||||
The **Add App Rule** box appears.
|
||||
|
||||
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*.
|
||||
|
||||
3. Click **Allow** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. Instructions for exempting an app are included in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section of this topic.
|
||||
|
||||
4. Pick **AppLocker policy file** from the **Rule template** drop-down list.
|
||||
|
||||
The box changes to let you import your AppLocker XML policy file.
|
||||
|
||||
5. Click **Import**, browse to your AppLocker XML file, click **Open**, and then click **OK** to close the **Add App Rule** box.
|
||||
|
||||
The file is imported and the apps are added to your **App Rules** list.
|
||||
|
||||
### Exempt apps from WIP restrictions
|
||||
If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak.
|
||||
|
||||
**To exempt a store app, a desktop app, or an AppLocker policy file app rule**
|
||||
1. From the **App Rules** area, click **Add**.
|
||||
|
||||
The **Add App Rule** box appears.
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*.
|
||||
|
||||
3. Click **Exempt** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic.
|
||||
|
||||
4. Fill out the rest of the app rule info, based on the type of rule you’re adding:
|
||||
|
||||
- **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic.
|
||||
|
||||
- **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this topic.
|
||||
|
||||
- **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps.
|
||||
|
||||
5. Click **OK**.
|
||||
|
||||
## Manage the WIP protection mode for your enterprise data
|
||||
After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode.
|
||||
|
||||
We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Allow Overrides** or **Hide Overrides**.
|
||||
|
||||
|Mode |Description |
|
||||
|-----|------------|
|
||||
|Hide Overrides|WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.|
|
||||
|Allow Overrides|WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkID=746459). |
|
||||
|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.|
|
||||
|Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.<p>After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.|
|
||||
|
||||
|
||||
|
||||
## Define your enterprise-managed corporate identity
|
||||
Corporate identity, usually expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies.
|
||||
|
||||
You can specify multiple domains owned by your enterprise by separating them with the "|" character. For example, (`contoso.com|newcontoso.com`). With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list.
|
||||
|
||||
**To add your corporate identity**
|
||||
- Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`.
|
||||
|
||||
|
||||
|
||||
## Choose where apps can access enterprise data
|
||||
After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network.
|
||||
|
||||
There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT).
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Every WIP policy should include policy that defines your enterprise network locations.<br>
|
||||
>Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations.
|
||||
|
||||
**To define where your protected apps can find and send enterprise data on you network**
|
||||
|
||||
1. Add additional network locations your apps can access by clicking **Add**.
|
||||
|
||||
The **Add or edit corporate network definition** box appears.
|
||||
|
||||
2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table.
|
||||
|
||||
|
||||
<p>
|
||||
<table>
|
||||
<tr>
|
||||
<th>Network location type</th>
|
||||
<th>Format</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Cloud Resources</td>
|
||||
<td><strong>With proxy:</strong> contoso.sharepoint.com,contoso.internalproxy1.com|<br>contoso.visualstudio.com,contoso.internalproxy2.com<p><strong>Without proxy:</strong> contoso.sharepoint.com|contoso.visualstudio.com</td>
|
||||
<td>Specify the cloud resources to be treated as corporate and protected by WIP.<p>For each cloud resource, you may also optionally specify a proxy server from your Enterprise Internal Proxy Servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Enterprise Internal Proxy Servers is considered enterprise.<p>If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: <code>URL <,proxy>|URL <,proxy></code>.<p><strong>Important</strong><br>In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the <code>/*AppCompat*/</code> string to the setting. For example: <code>URL <,proxy>|URL <,proxy>|/*AppCompat*/</code>.<p>When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the <strong>Domain joined or marked as compliant</strong> option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Network Domain Names (Required)</td>
|
||||
<td>corp.contoso.com,region.contoso.com</td>
|
||||
<td>Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.<p>This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.<p>If you have multiple resources, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Proxy Servers</td>
|
||||
<td>proxy.contoso.com:80;proxy2.contoso.com:443</td>
|
||||
<td>Specify your externally-facing proxy server addresses, along with the port through which traffic accesses the Internet.<p>This list must not include any servers listed in the Enterprise Internal Proxy Servers list, because they’re used for WIP-protected traffic.<p>This setting is also required if there’s a chance you could end up behind a proxy server on another network. In this situation, if you don't have a proxy server pre-defined, you might find that enterprise resources are unavailable to your client device, such as when you’re visiting another company and not on the guest network. To make sure this doesn’t happen, the client device also needs to be able to reach the pre-defined proxy server through the VPN network.<p>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Internal Proxy Servers</td>
|
||||
<td>contoso.internalproxy1.com;contoso.internalproxy2.com</td>
|
||||
<td>Specify the proxy servers your devices will go through to reach your cloud resources.<p>Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.<p>This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-WIP-protected traffic.<p>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise IPv4 Range (Required, if not using IPv6)</td>
|
||||
<td>**Starting IPv4 Address:** 3.4.0.1<br>**Ending IPv4 Address:** 3.4.255.254<br>**Custom URI:** 3.4.0.1-3.4.255.254,<br>10.0.0.1-10.255.255.254</td>
|
||||
<td>Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.<p>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise IPv6 Range (Required, if not using IPv4)</td>
|
||||
<td>**Starting IPv6 Address:** 2a01:110::<br>**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff<br>**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,<br>fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</td>
|
||||
<td>Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.<p>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Neutral Resources</td>
|
||||
<td>sts.contoso.com,sts.contoso2.com</td>
|
||||
<td>Specify your authentication redirection endpoints for your company.<p>These locations are considered enterprise or personal, based on the context of the connection before the redirection.<p>If you have multiple resources, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
3. Add as many locations as you need, and then click **OK**.
|
||||
|
||||
The **Add corporate network definition** box closes.
|
||||
|
||||
4. Decide if you want to Windows to look for additional network settings:
|
||||
|
||||
|
||||
|
||||
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network.
|
||||
|
||||
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network.
|
||||
|
||||
5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy.
|
||||
|
||||
|
||||
|
||||
After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data.
|
||||
|
||||
For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md).
|
||||
|
||||
## Choose to set up Azure Rights Management with WIP
|
||||
WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files via removable drives such as USB drives. For more info about Azure Rights Management, see [Microsoft Azure Rights Management](https://products.office.com/en-us/business/microsoft-azure-rights-management). To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up.
|
||||
|
||||
To configure WIP to use Azure Rights Management, you must set the **AllowAzureRMSForEDP** MDM setting to **1** in Microsoft Intune. This setting tells WIP to encrypt files copied to removable drives with Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703.
|
||||
|
||||
Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the **RMSTemplateIDForEDP** MDM setting to the **TemplateID** of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the **EditRightsData** option.
|
||||
|
||||
>[!NOTE]
|
||||
>For more info about setting the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp) topic. For more info about setting up and using a custom template, see [Configuring custom templates for the Azure Rights Management service](https://docs.microsoft.com/en-us/information-protection/deploy-use/configure-custom-templates) topic.
|
||||
|
||||
## Choose your optional WIP-related settings
|
||||
After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings.
|
||||
|
||||
|
||||
|
||||
**To set your optional settings**
|
||||
1. Choose to set any or all of the optional settings:
|
||||
|
||||
- **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are:
|
||||
|
||||
- **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box.
|
||||
|
||||
- **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult.
|
||||
|
||||
- **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are:
|
||||
|
||||
- **Yes (recommended).** Turns on the feature and provides the additional protection.
|
||||
|
||||
- **No, or not configured.** Doesn't enable this feature.
|
||||
|
||||
- **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are:
|
||||
|
||||
- **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment.
|
||||
|
||||
- **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions.
|
||||
|
||||
- **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are:
|
||||
|
||||
- **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps.
|
||||
|
||||
- **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps.
|
||||
|
||||
- **Show the Windows Information Protection icon overlay.** Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are:
|
||||
|
||||
- **Yes.** Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu.
|
||||
|
||||
- **No, or not configured (recommended).** Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option.
|
||||
|
||||
2. Click **Save Policy**.
|
||||
|
||||
## Related topics
|
||||
- [Deploy your Windows Information Protection (WIP) policy](deploy-wip-policy-using-intune.md)
|
||||
|
||||
- [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md)
|
||||
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
|
||||
|
||||
- [Azure RMS Documentation Update for May 2016](https://blogs.technet.microsoft.com/enterprisemobility/2016/05/31/azure-rms-documentation-update-for-may-2016/)
|
||||
|
||||
- [What is Azure Rights Management?]( https://docs.microsoft.com/en-us/information-protection/understand-explore/what-is-azure-rms)
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,652 +0,0 @@
|
||||
---
|
||||
title: Create a Windows Information Protection (WIP) policy with MAM using the Azure portal for Microsoft Intune (Windows 10)
|
||||
description: The Azure portal for Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, supporting mobile application management (MAM), to let you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.author: lizross
|
||||
ms.date: 10/13/2017
|
||||
localizationpriority: medium
|
||||
---
|
||||
|
||||
# Create a Windows Information Protection (WIP) policy with MAM using the Azure portal for Microsoft Intune
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1703 and later
|
||||
- Windows 10 Mobile, version 1703 and later (except Microsoft Azure Rights Management, which is only available on the desktop)
|
||||
|
||||
By using Microsoft Intune with Mobile application management (MAM), organizations can take advantage of Azure Active Directory (Azure AD) and the app protection policy feature to keep employees from logging in with personal credentials and accessing corporate data. Additionally, MAM solutions can help your enterprise do the following for mobile apps:
|
||||
|
||||
- Configure, update, and deploy mobile apps to employees
|
||||
- Control what your employees can do with enterprise data, such as copying, pasting, and saving
|
||||
- Keep enterprise data separate from your employee's personal data
|
||||
- Remove enterprise data from employee's devices
|
||||
- Report on mobile app inventory and track usage
|
||||
|
||||
>[!NOTE]
|
||||
>This topic covers creating a Windows Information Protection (WIP) policy for organizations using a mobile application management (MAM) solution to deploy your WIP policy to Intune apps without device enrollment. If you are already managing devices by using a Mobile Device Management (MDM) solution, you must follow the instructions in the [Create a Windows Information Protection (WIP) with enrollment policy using the Azure portal for Microsoft Intune](create-wip-policy-using-intune-azure.md) topic.
|
||||
|
||||
## Prerequisites to using MAM with Windows Information Protection (WIP)
|
||||
Before you can create your WIP policy with MAM, you must first set up your MAM provider. For more info about how to do this, see the [Get ready to configure app protection policies for Windows 10](https://docs.microsoft.com/en-us/intune-classic/deploy-use/get-ready-to-configure-app-protection-policies-for-windows-10) topic.
|
||||
|
||||
Additionally, you must have an [Azure AD Premium license](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-licensing-what-is) and be running at least Windows 10, version 1703 on your device.
|
||||
|
||||
>[!Important]
|
||||
>WIP doesn't support multi-identity. Only one managed identity can exist at a time.
|
||||
|
||||
## Add a WIP policy
|
||||
After you’ve set up Intune for your organization, you must create a WIP-specific policy.
|
||||
|
||||
**To add a WIP policy**
|
||||
1. Open the Azure portal and click the **Intune service** from the sidebar.
|
||||
|
||||
The Microsoft Intune Overview blade appears.
|
||||
|
||||
2. Click **Mobile apps**, click **App protection policies**, and then click **Add a policy**.
|
||||
|
||||
|
||||
|
||||
3. In the **Add a policy** blade, fill out the fields:
|
||||
|
||||
- **Name.** Type a name (required) for your new policy.
|
||||
|
||||
- **Description.** Type an optional description.
|
||||
|
||||
- **Platform.** Choose **Windows 10** to create your MAM policy for desktop client devices.
|
||||
|
||||
- **Enrollment state.** Choose **Without enrollment** as the enrollment state for your policy.
|
||||
|
||||
|
||||
|
||||
>[!Important]
|
||||
>Choosing **Without enrollment** only applies for organizations using MAM. If you're using MDM, you must use these instructions, [Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune](create-wip-policy-using-intune-azure.md), instead.
|
||||
|
||||
4. Click **Create**.
|
||||
|
||||
The policy is created and appears in the table on the **Mobile apps - App protection policies** blade.
|
||||
|
||||
>[!NOTE]
|
||||
>Optionally, you can also add your apps and set your settings from the **Add a policy** blade, but for the purposes of this documentation, we recommend instead that you create the policy first, and then use the subsequent menus that become available.
|
||||
|
||||
## Add apps to your Allowed apps list
|
||||
During the policy-creation process in Intune, you can choose the apps you want to allow, as well as deny, access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
|
||||
|
||||
The steps to add your apps are based on the type of template being applied. You can add a recommended app, a store app (also known as a Universal Windows Platform (UWP) app), or a signed Windows desktop app. You can also import a list of approved apps or add exempt apps.
|
||||
|
||||
In addition, you can create an app deny list related to the policy based on an **action** value. The action can be either **Allow** or **Deny**. When you specify the deny action for an app using the policy, corporate access is denied to the app.
|
||||
|
||||
>[!Important]
|
||||
>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.<br><br>Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **Allowed apps** list. If you don’t get this statement, it’s possible that you could experience app compatibility issues due to an app losing the ability to access a necessary file after revocation.
|
||||
|
||||
### Add a Recommended app to your Allowed apps list
|
||||
For this example, we’re going to add a few recommended apps to the **Allowed apps** list.
|
||||
|
||||
**To add a recommended app**
|
||||
1. From the **Mobile apps - App protection policies** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears.
|
||||
|
||||
The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy.
|
||||
|
||||
|
||||
|
||||
2. From the **Allowed apps** blade, click **Add apps**.
|
||||
|
||||
The **Add apps** blade appears, showing you all **Recommended apps**.
|
||||
|
||||
|
||||
|
||||
3. Select each app you want to access your enterprise data, and then click **OK**.
|
||||
|
||||
The **Allowed apps** blade updates to show you your selected apps.
|
||||
|
||||
|
||||
|
||||
4. Click **Save** to save the **Allowed apps** list to your policy.
|
||||
|
||||
### Add a Store app to your Allowed apps list
|
||||
For this example, we’re going to add Microsoft Power BI, a Windows store app, to the **Allowed apps** list.
|
||||
|
||||
**To add a Store app**
|
||||
1. From the **Mobile apps - App protection policies** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears.
|
||||
|
||||
The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy.
|
||||
|
||||
2. From the **Allowed apps** blade, click **Add apps**.
|
||||
|
||||
3. On the **Add apps** blade, click **Store apps** from the dropdown list.
|
||||
|
||||
4. Type the friendly name of the app, the publisher info, and the product name. For this example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.MicrosoftPowerBIForWindows`.
|
||||
|
||||
5. After you’ve entered the info into the fields, click **OK** to add the app to your **Allowed apps** list, and then click **Save** to save the **Allowed apps** list to your policy.
|
||||
|
||||
>[!NOTE]
|
||||
>To add multiple Store apps at the same time, you can click the menu **(…)** at the end of the app row, and continue to add more apps. When you’re done, click **OK**.
|
||||
|
||||
|
||||
|
||||
#### Find the Name, Publisher, and Product name for Store apps
|
||||
If you don't know the publisher or product name for your Store app, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps.
|
||||
|
||||
**To find the publisher and product name values for Store apps without installing them**
|
||||
1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Microsoft Power BI*.
|
||||
|
||||
2. Copy the ID value from the app URL. For example, Microsoft Power BI ID URL is https://www.microsoft.com/en-us/store/p/microsoft-power-bi/9nblgggzlxn1, and you'd copy the ID value, `9nblgggzlxn1`.
|
||||
|
||||
3. In a browser, run the Microsoft Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata, where `9nblgggzlxn1` is replaced with your ID value.
|
||||
|
||||
The API runs and opens a text editor with the app details.
|
||||
|
||||
```json
|
||||
{
|
||||
"packageIdentityName": "Microsoft.MicrosoftPowerBIForWindows",
|
||||
"publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
|
||||
}
|
||||
```
|
||||
|
||||
4. Copy the `publisherCertificateName` value into the **Publisher** box and copy the `packageIdentityName` value into the **Name** box of the **Add apps** blade.
|
||||
|
||||
>[!Important]
|
||||
>The JSON file might also return a windowsPhoneLegacyId value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as windowsPhoneLegacyId, and set the **Publisher Name** as CN= followed by the windowsPhoneLegacyId.<br><br>For example:<br>
|
||||
<code>{<br>"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",<br>}</code>
|
||||
|
||||
**To find the publisher and product name values for apps installed on Windows 10 mobile phones**
|
||||
1. If you need to add mobile apps that aren't distributed through the Microsoft Store for Business, you must use the **Windows Device Portal** feature.
|
||||
|
||||
>[!NOTE]
|
||||
>Your PC and phone must be on the same wireless network.
|
||||
|
||||
2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**.
|
||||
|
||||
3. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**.
|
||||
|
||||
4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate.
|
||||
|
||||
5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step.
|
||||
|
||||
6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names.
|
||||
|
||||
7. Start the app for which you're looking for the publisher and product name values.
|
||||
|
||||
8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune.
|
||||
|
||||
>[!Important]
|
||||
>The JSON file might also return a windowsPhoneLegacyId value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as windowsPhoneLegacyId, and set the **Publisher Name** as CN= followed by the windowsPhoneLegacyId.<br><br>For example:<br>
|
||||
<code>{<br>"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",<br>}</code>
|
||||
|
||||
### Add a Desktop app to your Allowed apps list
|
||||
For this example, we’re going to add WordPad, a Desktop app, to the **Allowed apps** list.
|
||||
|
||||
**To add a Desktop app**
|
||||
1. From the **Mobile apps - App protection policies** blade, click the name of your policy, and then click **Allowed apps** from the menu that appears.
|
||||
|
||||
The **Allowed apps** blade appears, showing you any apps that are already included in the list for this policy.
|
||||
|
||||
2. From the **Allowed apps** blade, click **Add apps**.
|
||||
|
||||
3. On the **Add apps** blade, click **Desktop apps** from the dropdown list.
|
||||
|
||||
The blade changes to show boxes for you to add the following, based on the results you want returned:
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Field</th>
|
||||
<th>Manages</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>All fields marked as “*”</td>
|
||||
<td>All files signed by any publisher. (Not recommended)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Name</td>
|
||||
<td>A friendly name for your app. You can't use this field by itself. However, you can use it in conjunction with any of the other fields.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Publisher (required) only</td>
|
||||
<td>Filling out this field, gives you all files signed by the named publisher. This might be useful if your company is the publisher and signer of internal line-of-business apps.<br><br>This is a required field and must be filled out whether by itself or in conjunction with other fields.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Publisher (required) and Product name only</td>
|
||||
<td>If you only fill out these fields, you’ll get all files for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Publisher (required), Product name, and File only</td>
|
||||
<td>If you only fill out these fields, you’ll get any version of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Publisher (required), Product name, File, and Min version only</td>
|
||||
<td>If you only fill out these fields, you’ll get the specified version or newer releases of the named file or package for the specified product, signed by the named publisher.<br><br>This option is recommended for enlightened apps that weren't previously enlightened.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Publisher (required), Product name, File, and Max version only</td>
|
||||
<td>If you only fill out these fields, you’ll get the specified version or older releases of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>All fields completed</td>
|
||||
<td>If you fill out all fields, you’ll get the specified version of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
4. After you’ve entered the info into the fields, click **OK** to add the app to your **Allowed apps** list, and then click **Save** to save the **Allowed apps** list to your policy.
|
||||
|
||||
>[!Note]
|
||||
>To add multiple Desktop apps at the same time, you can click the menu **(…)** at the end of the app row, and then continue to add more apps. When you’re done, click **OK**.
|
||||
|
||||
|
||||
|
||||
#### Find the Publisher and File name for Desktop apps
|
||||
If you’re unsure about what to include for the publisher, you can run this PowerShell command:
|
||||
|
||||
```ps1
|
||||
Get-AppLockerFileInformation -Path "<path_of_the_exe>"
|
||||
```
|
||||
Where `"<path_of_the_exe>"` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Windows NT\Accessories\wordpad.exe"`.
|
||||
|
||||
In this example, you'd get the following info:
|
||||
|
||||
``` json
|
||||
Path Publisher
|
||||
---- ---------
|
||||
%PROGRAMFILES%\WINDOWS NT\ACCESSORIES\WORDPAD.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US
|
||||
```
|
||||
Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter into the **Publisher** box and `WORDPAD.EXE` is the text to enter into the **File** box.
|
||||
|
||||
### Import a list of apps to your Allowed apps list
|
||||
For this example, we’re going to add an AppLocker XML file to the **Allowed apps** list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) content.
|
||||
|
||||
**To create a list of Allowed apps using the AppLocker tool**
|
||||
1. Open the Local Security Policy snap-in (SecPol.msc).
|
||||
|
||||
2. In the left blade, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**.
|
||||
|
||||
|
||||
|
||||
3. Right-click in the right-hand blade, and then click **Create New Rule**.
|
||||
|
||||
The **Create Packaged app Rules** wizard appears.
|
||||
|
||||
4. On the **Before You Begin** page, click **Next**.
|
||||
|
||||
|
||||
|
||||
5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**.
|
||||
|
||||
|
||||
|
||||
6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area.
|
||||
|
||||
|
||||
|
||||
7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Dynamics 365.
|
||||
|
||||
|
||||
|
||||
8. On the updated **Publisher** page, click **Create**.
|
||||
|
||||
|
||||
|
||||
9. Click **No** in the dialog box that appears, asking if you want to create the default rules. You must not create default rules for your WIP policy.
|
||||
|
||||
|
||||
|
||||
9. Review the Local Security Policy snap-in to make sure your rule is correct.
|
||||
|
||||
|
||||
|
||||
10. In the left blade, right-click on **AppLocker**, and then click **Export policy**.
|
||||
|
||||
The **Export policy** box opens, letting you export and save your new policy as XML.
|
||||
|
||||
|
||||
|
||||
11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**.
|
||||
|
||||
The policy is saved and you’ll see a message that says 1 rule was exported from the policy.
|
||||
|
||||
**Example XML file**<br>
|
||||
This is the XML file that AppLocker creates for Microsoft Dynamics 365.
|
||||
|
||||
```xml
|
||||
<?xml version="1.0"?>
|
||||
<AppLockerPolicy Version="1">
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Appx">
|
||||
<FilePublisherRule Action="Allow" UserOrGroupSid="S-1-1-0" Description="" Name="Microsoft.MicrosoftDynamicsCRMforWindows10, version 3.2.0.0 and above, from Microsoft Corporation" Id="3da34ed9-aec6-4239-88ba-0afdce252ab4">
|
||||
<Conditions>
|
||||
<FilePublisherCondition BinaryName="*" ProductName="Microsoft.MicrosoftDynamicsCRMforWindows10" PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US">
|
||||
<BinaryVersionRange HighSection="*" LowSection="3.2.0.0"/>
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
</RuleCollection>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Dll"/>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Exe"/>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Msi"/>
|
||||
<RuleCollection EnforcementMode="NotConfigured" Type="Script"/>
|
||||
</AppLockerPolicy>
|
||||
```
|
||||
|
||||
12. After you’ve created your XML file, you need to import it by using Microsoft Intune.
|
||||
|
||||
**To import your list of Allowed apps using Microsoft Intune**
|
||||
|
||||
1. From the **Allowed apps** area, click **Import apps**.
|
||||
|
||||
The blade changes to let you add your import file.
|
||||
|
||||
|
||||
|
||||
2. Browse to your exported AppLocker policy file, and then click **Open**.
|
||||
|
||||
The file imports and the apps are added to your **Allowed app** list.
|
||||
|
||||
### Add exempt apps to your policy
|
||||
If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak.
|
||||
|
||||
**To exempt a Store app, a Desktop app, or an AppLocker policy file from the Allowed apps list**
|
||||
|
||||
1. From the **App policy** blade, click the name of your policy, and then click **Exempt apps** from the menu that appears.
|
||||
|
||||
The **Exempt apps** blade appears, showing you any apps that are already included in the list for this policy.
|
||||
|
||||
2. From the **Exempt apps** blade, click **Add apps**.
|
||||
|
||||
Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-apps-to_your-allowed-apps-list) section of this topic.
|
||||
|
||||
3. Fill out the rest of the app info, based on the type of app you’re adding:
|
||||
|
||||
- **Recommended app.** Follow the instructions in the [Add a Recommended app to your Allowed apps list](#add-a-recommended-app-to_your-allowed-apps-list) section of this topic.
|
||||
|
||||
- **Store app.** Follow the instructions in the [Add a Store app to your Allowed apps list](#add-a-store-app-to_your-allowed-apps-list) section of this topic.
|
||||
|
||||
- **Desktop app.** Follow the instructions in the [Add a Desktop app to your Allowed apps list](#add-a-desktop-app-to_your-allowed-apps-list) section of this topic.
|
||||
|
||||
- **AppLocker policy file.** Follow the instructions to create your app list in the [Import a list of apps to your Allowed apps list](#import-a-list-of-apps-to_your-allowed-apps-list) section of this topic, using a list of exempted apps.
|
||||
|
||||
4. Click **OK**.
|
||||
|
||||
## Manage your Required settings
|
||||
In the **Required settings** blade you must pick your Windows Information Protection mode and you can review or change your **Corporate identity**.
|
||||
|
||||
### Manage the WIP protection mode for your enterprise data
|
||||
After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode.
|
||||
|
||||
We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Hide Overrides**.
|
||||
|
||||
>[!NOTE]
|
||||
>For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).
|
||||
|
||||
**To add your protection mode**
|
||||
|
||||
1. From the **Mobile apps - App protection policies** blade, click the name of your policy, and then click **Required settings** from the menu that appears.
|
||||
|
||||
The **Required settings** blade appears.
|
||||
|
||||
|
||||
|
||||
|Mode |Description |
|
||||
|-----|------------|
|
||||
|Hide Overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.|
|
||||
|Allow Overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).|
|
||||
|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.|
|
||||
|Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.<br><br>After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.|
|
||||
|
||||
2. Click **Save**.
|
||||
|
||||
### Define your enterprise-managed corporate identity
|
||||
Corporate identity, usually expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies.
|
||||
|
||||
Starting with Windows 10, version 1703, Intune automatically determines your corporate identity and adds it to the **Corporate identity** field.
|
||||
|
||||
**To change your corporate identity**
|
||||
|
||||
1. From the **Mobile apps - App protection policies** blade, click the name of your policy, and then click **Required settings** from the menu that appears.
|
||||
|
||||
The **Required settings** blade appears.
|
||||
|
||||
2. If the auto-defined identity isn’t correct, you can change the info in the **Corporate identity** field. If you need to add additional domains, for example your email domains, you can do it in the **Advanced settings** area.
|
||||
|
||||
|
||||
|
||||
## Manage your Advanced settings
|
||||
In the **Advanced settings** blade you must specify where apps can access your corporate data, upload a Data Recovery Agent (DRA) certificate, and set several optional data protection and access settings.
|
||||
|
||||
### Choose where apps can access enterprise data
|
||||
After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network.
|
||||
|
||||
There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT).
|
||||
|
||||
>[!Important]
|
||||
>Every WIP policy should include policy that defines your enterprise network locations.<br>Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations.
|
||||
|
||||
**To define where your allowed apps can find and send enterprise data on you network**
|
||||
|
||||
1. From the **Mobile apps - App protection policies** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears.
|
||||
|
||||
The **Advanced settings** blade appears.
|
||||
|
||||
2. Click **Add network boundary** from the **Network perimeter** area.
|
||||
|
||||
The **Add network boundary** blade appears.
|
||||
|
||||
|
||||
|
||||
3. Select the type of network boundary to add from the **Boundary type** box.
|
||||
|
||||
4. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the following options, and then click **OK**.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Boundary type</th>
|
||||
<th>Value format</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Cloud Resources</td>
|
||||
<td><strong>With proxy:</strong> contoso.sharepoint.com,contoso.internalproxy1.com|<br>contoso.visualstudio.com,contoso.internalproxy2.com<br><br><strong>Without proxy:</strong> contoso.sharepoint.com|contoso.visualstudio.com</td>
|
||||
<td>Specify the cloud resources to be treated as corporate and protected by WIP.<br><br>For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.<br><br>If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: <code>URL <,proxy>|URL <,proxy></code>.<br><br><strong>Important</strong><br>In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the <code>/*AppCompat*/</code> string to the setting. For example: <code>URL <,proxy>|URL <,proxy>|/*AppCompat*/</code>.<br><br>When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the <strong>Domain joined or marked as compliant</strong> option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Network domain names</td>
|
||||
<td>corp.contoso.com,region.contoso.com</td>
|
||||
<td>Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.<br><br>If you have multiple resources, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Proxy servers</td>
|
||||
<td>proxy.contoso.com:80;proxy2.contoso.com:443</td>
|
||||
<td>Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.<br><br>This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.<br><br>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Internal proxy servers</td>
|
||||
<td>contoso.internalproxy1.com;contoso.internalproxy2.com</td>
|
||||
<td>Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.<br><br>This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.<br><br>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>IPv4 ranges</td>
|
||||
<td>**Starting IPv4 Address:** 3.4.0.1<br>**Ending IPv4 Address:** 3.4.255.254<br>**Custom URI:** 3.4.0.1-3.4.255.254,<br>10.0.0.1-10.255.255.254</td>
|
||||
<td>Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries.<br><br>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>IPv6 ranges</td>
|
||||
<td>**Starting IPv6 Address:** 2a01:110::<br>**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff<br>**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,<br>fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</td>
|
||||
<td>Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries.<br><br>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Neutral resources</td>
|
||||
<td>sts.contoso.com,sts.contoso2.com</td>
|
||||
<td>Specify your authentication redirection endpoints for your company.<br><br>These locations are considered enterprise or personal, based on the context of the connection before the redirection.<br><br>If you have multiple resources, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
5. Repeat steps 1-4 to add any additional network boundaries.
|
||||
|
||||
6. Decide if you want to Windows to look for additional network settings:
|
||||
|
||||
|
||||
|
||||
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click **On** for Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network.Click **Off** and Windows searches for additional proxy servers in your immediate network.
|
||||
|
||||
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click **On** for Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. Click **Off** and Windows searches for additional IP ranges on any domain-joined devices connected to your network.
|
||||
|
||||
### Upload your Data Recovery Agent (DRA) certificate
|
||||
After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data.
|
||||
|
||||
>[!Important]
|
||||
>Using a DRA certificate isn’t mandatory. However, we strongly recommend it. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) topic.
|
||||
|
||||
**To upload your DRA certificate**
|
||||
1. From the **Mobile apps - App protection policies** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears.
|
||||
|
||||
The **Advanced settings** blade appears.
|
||||
|
||||
2. In the **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy.
|
||||
|
||||
|
||||
|
||||
### Choose your optional WIP-related settings
|
||||
After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings.
|
||||
|
||||
**To set your optional settings**
|
||||
|
||||
1. From the **Mobile apps - App protection policies** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears.
|
||||
|
||||
The **Advanced settings** blade appears.
|
||||
|
||||
2. Choose to set any or all optional settings:
|
||||
|
||||
|
||||
|
||||
- **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile.** Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are:
|
||||
|
||||
- **On (recommended).** Turns on the feature and provides the additional protection.
|
||||
|
||||
- **Off** Doesn't enable this feature.
|
||||
|
||||
- **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are:
|
||||
|
||||
- **On (recommended).** Revokes local encryption keys from a device during unenrollment.
|
||||
|
||||
- **Off.** Stop local encryption keys from being revoked from a device during unenrollment. For example if you’re migrating between Mobile Device Management (MDM) solutions.
|
||||
|
||||
- **Revoke access to protected data when the device enrolls to MDM.** Determines whether to revoke a user's WIP keys when a device is upgraded from MAM to a higher-security MDM solution. The options are:
|
||||
|
||||
- **On.** Revokes the encryption keys from a device when it's upgraded from MAM to MDM.
|
||||
|
||||
- **Off.** Encryption keys aren't removed and the user can continue to access protected files. This is the recommended setting if the MDM service uses the same WIP EnterpriseID value as the MAM service.
|
||||
|
||||
- **Show the enterprise data protection icon.** Determines whether an icon appears on corporate files in the **Save As** and **File Explorer** views. The options are:
|
||||
|
||||
- **On.** Allows an icon to appear on corporate files in the **Save As** and **File Explorer** views. Additionally, for unenlightened but allowed apps, the icon also appears on the app tile and with Managed text on the app name in the **Start** menu.
|
||||
|
||||
- **Off (recommended).** Stops the icon from appearing on corporate files or unenlightened, but allowed apps. By default, this is turned off.
|
||||
|
||||
- **Use Azure RMS for WIP.** Determines whether to use Azure Rights Management encryption with Windows Information Protection. The options are:
|
||||
|
||||
- **On.** Starts using Azure Rights Management encryption with WIP. By turning this option on, you can also add a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. For more info about setting up Azure Rights management and using a template ID with WIP, see the [Choose to set up Azure Rights Management with WIP](#choose-to-set-up-azure-rights-management-with-wip) section of this topic.
|
||||
|
||||
- **Off.** Stops using Azure Rights Management encryption with WIP.
|
||||
|
||||
- **MDM discovery URL.** Lets the **Windows Settings** > **Accounts** > **Access work or school** sign-in offer an **Upgrade to MDM** link. Additionally, this lets you switch to another MDM provider, so that Microsoft Intune can manage MAM, while the new MDM provider manages the MDM devices. By default, this is specified to use Microsoft Intune.
|
||||
|
||||
#### Choose to set up Azure Rights Management with WIP
|
||||
WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files by using removable drives such as USB drives. For more info about Azure Rights Management, see [Microsoft Azure Rights Management](https://products.office.com/en-us/business/microsoft-azure-rights-management). To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up.
|
||||
|
||||
To configure WIP to use Azure Rights Management, you must set the **AllowAzureRMSForEDP** MDM setting to **1** in Microsoft Intune. This setting tells WIP to encrypt files copied to removable drives with Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703.
|
||||
|
||||
Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the **RMSTemplateIDForEDP** MDM setting to the **TemplateID** of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the **EditRightsData** option.
|
||||
|
||||
>[!NOTE]
|
||||
>For more info about setting the **AllowAzureRMSForEDP** and the **RMSTemplateIDForEDP** MDM settings, see the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/enterprisedataprotection-csp) topic. For more info about setting up and using a custom template, see [Configuring custom templates for the Azure Rights Management service](https://docs.microsoft.com/en-us/information-protection/deploy-use/configure-custom-templates) topic.
|
||||
|
||||
### Choose whether to use and configure Windows Hello for Business
|
||||
You can turn on Windows Hello for Business, letting your employees use it as a sign-in method for their devices.
|
||||
|
||||
**To turn on and configure Windows Hello for Business**
|
||||
|
||||
1. From the **Mobile apps - App protection policies** blade, click the name of your policy, and then click **Advanced settings** from the menu that appears.
|
||||
|
||||
The **Advanced settings** blade appears.
|
||||
|
||||
2. Choose to turn on and configure the Windows Hello for Business settings:
|
||||
|
||||
|
||||
|
||||
- **Use Windows Hello for Business as a method for signing into Windows.** Turns on Windows Hello for Business. The options are:
|
||||
|
||||
- **On.** Turns on Windows Hello For Business for anyone assigned to this policy.
|
||||
|
||||
- **Off.** Turns off Windows Hello for Business.
|
||||
|
||||
- **Set the minimum number of characters required for the PIN.** Enter a numerical value (4-127 characters) for how many characters must be used to create a valid PIN. Default is 4 characters.
|
||||
|
||||
- **Configure the use of uppercase letters in the Windows Hello for Business PIN.** Lets you decide whether uppercase letters can be used in a valid PIN. The options are:
|
||||
|
||||
- **Allow the use of uppercase letters in PIN.** Lets an employee use uppercase letters in a valid PIN.
|
||||
|
||||
- **Require the use of at least one uppercase letter in PIN.** Requires an employee to use at least 1 uppercase letter in a valid PIN.
|
||||
|
||||
- **Do not allow the use of uppercase letters in PIN.** Prevents an employee from using uppercase letters in a valid PIN.
|
||||
|
||||
- **Configure the use of lowercase letters in the Windows Hello for Business PIN.** Lets you decide whether lowercase letters can be used in a valid PIN. The options are:
|
||||
|
||||
- **Allow the use of lowercase letters in PIN.** Lets an employee use lowercase letters in a valid PIN.
|
||||
|
||||
- **Require the use of at least one lowercase letter in PIN.** Requires an employee to use at least 1 lowercase letter in a valid PIN.
|
||||
|
||||
- **Do not allow the use of lowercase letters in PIN.** Prevents an employee from using lowercase letters in a valid PIN.
|
||||
|
||||
- **Configure the use of special characters in the Windows Hello for Business PIN.** Lets you decide whether special characters can be used in a valid PIN. The options are:
|
||||
|
||||
- **Allow the use of special characters in PIN.** Lets an employee use special characters in a valid PIN.
|
||||
|
||||
- **Require the use of at least one special character in PIN.** Requires an employee to use at least 1 special character in a valid PIN.
|
||||
|
||||
- **Do not allow the use of special characters in PIN.** Prevents an employee from using special characters in a valid PIN.
|
||||
|
||||
- **Specify the period of time (in days) that a PIN can be used before the system requires the user to change it.** Enter a numerical value (0-730 days) for how many days can pass before a PIN must be changed. If you enter a value of 0, the PIN never expires.
|
||||
|
||||
- **Specify the number of past PINs that can be associated to a user account that can't be reused.** Enter a numerical value (0-50 days) for how many days can pass before an employee can reuse a previous PIN. If you enter a value of 0, a PINs can be reused immediately and past PINs aren't stored.
|
||||
|
||||
>[!NOTE]
|
||||
>PIN history is not preserved through a PIN reset.
|
||||
|
||||
- **Number of authentication failures allowed before the device will be wiped.** Enter a numerical value for how many times the PIN can be incorrectly entered before wiping the device of corporate data. If you enter a value of 0, the device is never wiped, regardless of the number of incorrect PIN entries.<p>This setting has different behavior for mobile devices and desktops.
|
||||
|
||||
- **On mobile devices.** When an employee reaches the value set here, the device is wiped of corporate data.
|
||||
|
||||
- **On desktop devices.** When an employee reaches the value set here, the desktop is put into BitLocker recovery mode, instead of being wiped. You must have BitLocker installed on the device or this setting is ignored.
|
||||
|
||||
- **Maximum amount of time (in minutes) allowed after the device is idle that will cause the device to become PIN or password locked.** Enter a numerical value for how many days can pass before a PIN must be changed. If you enter a value of 0, the device never becomes PIN or password locked while idle.
|
||||
|
||||
>[!NOTE]
|
||||
>You can set this value to be anything; however, it can't be longer than the time specified by the **Settings** app. If you exceed the maximum timeout value, this setting is ignored.
|
||||
|
||||
|
||||
## Deploy your policy
|
||||
After you’ve created your policy, you'll need to deploy it to your employees. MAM is deployed to users and not devices.
|
||||
|
||||
**To deploy your policy**
|
||||
|
||||
1. On the **Mobile apps - App protection policies** pane, click your newly-created policy, click **Assignments** from the menu that appears, and then click **Select groups**.
|
||||
|
||||
A list of user groups, made up of all of the security groups in your Azure Active Directory, appear in the **Add user group** pane.
|
||||
|
||||
2. Choose the group you want your policy to apply to, and then click **Select** to deploy the policy.
|
||||
|
||||
The policy is deployed to the selected group.
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Implement server-side support for mobile application management on Windows](https://docs.microsoft.com/en-us/windows/client-management/mdm/implement-server-side-mobile-application-management)
|
||||
|
||||
- [Microsoft Intune - Mobile Application Management (MAM) standalone blog post](https://blogs.technet.microsoft.com/cbernier/2016/01/05/microsoft-intune-mobile-application-management-mam-standalone/)
|
||||
|
||||
- [MAM-supported apps](https://www.microsoft.com/en-us/cloud-platform/microsoft-intune-apps)
|
||||
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
|
||||
|
||||
- [Deploy your Windows Information Protection (WIP) policy](deploy-wip-policy-using-intune.md)
|
||||
|
||||
- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md)
|
||||
@ -1,516 +0,0 @@
|
||||
---
|
||||
title: Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager (Windows 10)
|
||||
description: Configuration Manager (version 1606 or later) helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.
|
||||
ms.assetid: 85b99c20-1319-4aa3-8635-c1a87b244529
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/16/2017
|
||||
---
|
||||
|
||||
# Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later
|
||||
- System Center Configuration Manager
|
||||
|
||||
System Center Configuration Manager helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network.
|
||||
|
||||
## Add a WIP policy
|
||||
After you’ve installed and set up System Center Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy.
|
||||
|
||||
**To create a configuration item for WIP**
|
||||
|
||||
1. Open the System Center Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node.
|
||||
|
||||
|
||||
|
||||
2. Click the **Create Configuration Item** button.<p>
|
||||
The **Create Configuration Item Wizard** starts.
|
||||
|
||||
|
||||
|
||||
3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes.
|
||||
|
||||
4. In the **Specify the type of configuration item you want to create** area, pick the option that represents whether you use System Center Configuration Manager for device management, and then click **Next**.
|
||||
|
||||
- **Settings for devices managed with the Configuration Manager client:** Windows 10
|
||||
|
||||
-OR-
|
||||
|
||||
- **Settings for devices managed without the Configuration Manager client:** Windows 8.1 and Windows 10
|
||||
|
||||
5. On the **Supported Platforms** screen, click the **Windows 10** box, and then click **Next**.
|
||||
|
||||
|
||||
|
||||
6. On the **Device Settings** screen, click **Windows Information Protection**, and then click **Next**.
|
||||
|
||||
|
||||
|
||||
The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization.
|
||||
|
||||
## Add app rules to your policy
|
||||
During the policy-creation process in System Center Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.
|
||||
|
||||
The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed Windows desktop app, or an AppLocker policy file.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.<p>Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.
|
||||
|
||||
### Add a store app rule to your policy
|
||||
For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list.
|
||||
|
||||
**To add a store app**
|
||||
|
||||
1. From the **App rules** area, click **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*.
|
||||
|
||||
3. Click **Allow** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section.
|
||||
|
||||
4. Pick **Store App** from the **Rule template** drop-down list.
|
||||
|
||||
The box changes to show the store app rule options.
|
||||
|
||||
5. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`.
|
||||
|
||||
If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps.
|
||||
|
||||
**To find the Publisher and Product Name values for Store apps without installing them**
|
||||
|
||||
1. Go to the [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, Microsoft OneNote.
|
||||
|
||||
>[!NOTE]
|
||||
|
||||
>If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the steps in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section.
|
||||
|
||||
2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`.
|
||||
|
||||
3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata, where `9wzdncrfhvjl` is replaced with your ID value.
|
||||
|
||||
The API runs and opens a text editor with the app details.
|
||||
|
||||
``` json
|
||||
{
|
||||
"packageIdentityName": "Microsoft.Office.OneNote",
|
||||
"publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
|
||||
}
|
||||
```
|
||||
|
||||
4. Copy the `publisherCertificateName` value and paste them into the **Publisher Name** box, copy the `packageIdentityName` value into the **Product Name** box of Intune.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.<p>For example:<p>
|
||||
```json
|
||||
{
|
||||
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
|
||||
}
|
||||
```
|
||||
|
||||
**To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones**
|
||||
1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature.
|
||||
|
||||
>[!NOTE]
|
||||
>Your PC and phone must be on the same wireless network.
|
||||
|
||||
2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**.
|
||||
|
||||
3. On the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**.
|
||||
|
||||
4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate.
|
||||
|
||||
5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step.
|
||||
|
||||
6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names.
|
||||
|
||||
7. Start the app for which you're looking for the publisher and product name values.
|
||||
|
||||
8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.
|
||||
>For example:<p>
|
||||
```json
|
||||
{
|
||||
"windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d",
|
||||
}
|
||||
```
|
||||
|
||||
### Add a desktop app rule to your policy
|
||||
For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list.
|
||||
|
||||
**To add a desktop app to your policy**
|
||||
1. From the **App rules** area, click **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*.
|
||||
|
||||
3. Click **Allow** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section.
|
||||
|
||||
4. Pick **Desktop App** from the **Rule template** drop-down list.
|
||||
|
||||
The box changes to show the desktop app rule options.
|
||||
|
||||
5. Pick the options you want to include for the app rule (see table), and then click **OK**.
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Option</th>
|
||||
<th>Manages</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>All fields left as “*”</td>
|
||||
<td>All files signed by any publisher. (Not recommended.)</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong> selected</td>
|
||||
<td>All files signed by the named publisher.<p>This might be useful if your company is the publisher and signer of internal line-of-business apps.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong> and <strong>Product Name</strong> selected</td>
|
||||
<td>All files for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, and <strong>Binary name</strong> selected</td>
|
||||
<td>Any version of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>Binary name</strong>, and <strong>File Version, and above</strong>, selected</td>
|
||||
<td>Specified version or newer releases of the named file or package for the specified product, signed by the named publisher.<p>This option is recommended for enlightened apps that weren't previously enlightened.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>Binary name</strong>, and <strong>File Version, And below</strong> selected</td>
|
||||
<td>Specified version or older releases of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td><strong>Publisher</strong>, <strong>Product Name</strong>, <strong>Binary name</strong>, and <strong>File Version, Exactly</strong> selected</td>
|
||||
<td>Specified version of the named file or package for the specified product, signed by the named publisher.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
If you’re unsure about what to include for the publisher, you can run this PowerShell command:
|
||||
|
||||
```ps1
|
||||
Get-AppLockerFileInformation -Path "<path of the exe>"
|
||||
```
|
||||
Where `"<path of the exe>"` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Internet Explorer\iexplore.exe"`.
|
||||
|
||||
In this example, you'd get the following info:
|
||||
|
||||
``` json
|
||||
Path Publisher
|
||||
---- ---------
|
||||
%PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR...
|
||||
```
|
||||
Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box.
|
||||
|
||||
### Add an AppLocker policy file
|
||||
For this example, we’re going to add an AppLocker XML file to the **App Rules** list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/itpro/windows/keep-secure/applocker-overview) content.
|
||||
|
||||
**To create an app rule and xml file using the AppLocker tool**
|
||||
1. Open the Local Security Policy snap-in (SecPol.msc).
|
||||
|
||||
2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**.
|
||||
|
||||
|
||||
|
||||
3. Right-click in the right-hand pane, and then click **Create New Rule**.
|
||||
|
||||
The **Create Packaged app Rules** wizard appears.
|
||||
|
||||
4. On the **Before You Begin** page, click **Next**.
|
||||
|
||||
|
||||
|
||||
5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**.
|
||||
|
||||
|
||||
|
||||
6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area.
|
||||
|
||||
|
||||
|
||||
7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Photos.
|
||||
|
||||
|
||||
|
||||
8. On the updated **Publisher** page, click **Create**.
|
||||
|
||||
|
||||
|
||||
9. Review the Local Security Policy snap-in to make sure your rule is correct.
|
||||
|
||||
|
||||
|
||||
10. In the left pane, right-click on **AppLocker**, and then click **Export policy**.
|
||||
|
||||
The **Export policy** box opens, letting you export and save your new policy as XML.
|
||||
|
||||
|
||||
|
||||
11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**.
|
||||
|
||||
The policy is saved and you’ll see a message that says 1 rule was exported from the policy.
|
||||
|
||||
**Example XML file**<br>
|
||||
This is the XML file that AppLocker creates for Microsoft Photos.
|
||||
|
||||
```xml
|
||||
<AppLockerPolicy Version="1">
|
||||
<RuleCollection Type="Exe" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Msi" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Script" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Dll" EnforcementMode="NotConfigured" />
|
||||
<RuleCollection Type ="Appx" EnforcementMode="NotConfigured">
|
||||
<FilePublisherRule Id="5e0c752b-5921-4f72-8146-80ad5f582110" Name="Microsoft.Windows.Photos, version 16.526.0.0 and above, from Microsoft Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow">
|
||||
<Conditions>
|
||||
<FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.Windows.Photos" BinaryName="*">
|
||||
<BinaryVersionRange LowSection="16.526.0.0" HighSection="*" />
|
||||
</FilePublisherCondition>
|
||||
</Conditions>
|
||||
</FilePublisherRule>
|
||||
</RuleCollection>
|
||||
</AppLockerPolicy>
|
||||
```
|
||||
12. After you’ve created your XML file, you need to import it by using System Center Configuration Manager.
|
||||
|
||||
**To import your Applocker policy file app rule using System Center Configuration Manager**
|
||||
1. From the **App rules** area, click **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*.
|
||||
|
||||
3. Click **Allow** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-wip-restrictions) section.
|
||||
|
||||
4. Pick the **AppLocker policy file** from the **Rule template** drop-down list.
|
||||
|
||||
The box changes to let you import your AppLocker XML policy file.
|
||||
|
||||
5. Click the ellipsis (...) to browse for your AppLocker XML file, click **Open**, and then click **OK** to close the **Add app rule** box.
|
||||
|
||||
The file is imported and the apps are added to your **App Rules** list.
|
||||
|
||||
### Exempt apps from WIP restrictions
|
||||
If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak.
|
||||
|
||||
**To exempt a store app, a desktop app, or an AppLocker policy file app rule**
|
||||
|
||||
1. From the **App rules** area, click **Add**.
|
||||
|
||||
The **Add app rule** box appears.
|
||||
|
||||
2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*.
|
||||
|
||||
3. Click **Exempt** from the **Windows Information Protection mode** drop-down list.
|
||||
|
||||
Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic.
|
||||
|
||||
4. Fill out the rest of the app rule info, based on the type of rule you’re adding:
|
||||
|
||||
- **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic.
|
||||
|
||||
- **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this topic.
|
||||
|
||||
- **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps.
|
||||
|
||||
5. Click **OK**.
|
||||
|
||||
## Manage the WIP-protection level for your enterprise data
|
||||
After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode.
|
||||
|
||||
We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Hide Overrides**.
|
||||
|
||||
>[!NOTE]
|
||||
>For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).
|
||||
|
||||
|Mode |Description |
|
||||
|-----|------------|
|
||||
|Hide Overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.|
|
||||
|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. |
|
||||
|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.|
|
||||
|Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.<p>After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.|
|
||||
|
||||
|
||||
|
||||
## Define your enterprise-managed identity domains
|
||||
Corporate identity, usually expressed as your primary internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies.
|
||||
|
||||
You can specify multiple domains owned by your enterprise by separating them with the "|" character. For example, (contoso.com|newcontoso.com). With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list.
|
||||
|
||||
**To add your corporate identity**
|
||||
|
||||
- Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`.
|
||||
|
||||
|
||||
|
||||
## Choose where apps can access enterprise data
|
||||
After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network.
|
||||
|
||||
There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT).
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Every WIP policy should include policy that defines your enterprise network locations.<br>
|
||||
>Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations.
|
||||
|
||||
**To define where your protected apps can find and send enterprise data on you network**
|
||||
|
||||
1. Add additional network locations your apps can access by clicking **Add**.
|
||||
|
||||
The **Add or edit corporate network definition** box appears.
|
||||
|
||||
2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table.
|
||||
|
||||
|
||||
|
||||
<table>
|
||||
<tr>
|
||||
<th>Network location type</th>
|
||||
<th>Format</th>
|
||||
<th>Description</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Cloud Resources</td>
|
||||
<td><strong>With proxy:</strong> contoso.sharepoint.com,contoso.internalproxy1.com|<br>contoso.visualstudio.com,contoso.internalproxy2.com<p><strong>Without proxy:</strong> contoso.sharepoint.com|contoso.visualstudio.com</td>
|
||||
<td>Specify the cloud resources to be treated as corporate and protected by WIP.<p>For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise.<p>If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: <code>URL <,proxy>|URL <,proxy></code>.<p><strong>Important</strong><br>In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the <code>/*AppCompat*/</code> string to the setting. For example: <code>URL <,proxy>|URL <,proxy>|/*AppCompat*/</code>.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise Network Domain Names (Required)</td>
|
||||
<td>corp.contoso.com,region.contoso.com</td>
|
||||
<td>Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.<p>This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.<p>If you have multiple resources, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Proxy servers</td>
|
||||
<td>proxy.contoso.com:80;proxy2.contoso.com:443</td>
|
||||
<td>Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.<br><br>This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic.<br><br>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Internal proxy servers</td>
|
||||
<td>contoso.internalproxy1.com;contoso.internalproxy2.com</td>
|
||||
<td>Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.<br><br>This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic.<br><br>If you have multiple resources, you must separate them using the ";" delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise IPv4 Range (Required)</td>
|
||||
<td>**Starting IPv4 Address:** 3.4.0.1<br>**Ending IPv4 Address:** 3.4.255.254<br>**Custom URI:** 3.4.0.1-3.4.255.254,<br>10.0.0.1-10.255.255.254</td>
|
||||
<td>Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.<p>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise IPv6 Range</td>
|
||||
<td>**Starting IPv6 Address:** 2a01:110::<br>**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff<br>**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,<br>fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff</td>
|
||||
<td>Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.<p>If you have multiple ranges, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Neutral Resources</td>
|
||||
<td>sts.contoso.com,sts.contoso2.com</td>
|
||||
<td>Specify your authentication redirection endpoints for your company.<p>These locations are considered enterprise or personal, based on the context of the connection before the redirection.<p>If you have multiple resources, you must separate them using the "," delimiter.</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
3. Add as many locations as you need, and then click **OK**.
|
||||
|
||||
The **Add or edit corporate network definition** box closes.
|
||||
|
||||
4. Decide if you want to Windows to look for additional network settings and if you want to show the WIP icon on your corporate files while in File Explorer.
|
||||
|
||||
|
||||
|
||||
- **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. Not configured is the default option.
|
||||
|
||||
- **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. Not configured is the default option.
|
||||
|
||||
- **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware on corporate files in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with *Managed* text on the app name in the **Start** menu. Not configured is the default option.
|
||||
|
||||
5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy.
|
||||
|
||||
|
||||
|
||||
After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data.
|
||||
|
||||
For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](https://go.microsoft.com/fwlink/p/?LinkId=761462) topic. For more info about creating and verifying your EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md).
|
||||
|
||||
## Choose your optional WIP-related settings
|
||||
After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings.
|
||||
|
||||
|
||||
|
||||
**To set your optional settings**
|
||||
1. Choose to set any or all of the optional settings:
|
||||
|
||||
- **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are:
|
||||
|
||||
- **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box.
|
||||
|
||||
- **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>The **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box** option is only available for Configuration Manager versions 1610 and below.
|
||||
|
||||
- **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are:
|
||||
|
||||
- **Yes (recommended).** Turns on the feature and provides the additional protection.
|
||||
|
||||
- **No, or not configured.** Doesn't enable this feature.
|
||||
|
||||
- **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are:
|
||||
|
||||
- **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps.
|
||||
|
||||
- **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps.
|
||||
|
||||
- **Revoke local encryption keys during the unerollment process.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are:
|
||||
|
||||
- **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment.
|
||||
|
||||
- **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions.
|
||||
|
||||
2. After you pick all of the settings you want to include, click **Summary**.
|
||||
|
||||
## Review your configuration choices in the Summary screen
|
||||
After you've finished configuring your policy, you can review all of your info on the **Summary** screen.
|
||||
|
||||
**To view the Summary screen**
|
||||
- Click the **Summary** button to review your policy choices, and then click **Next** to finish and to save your policy.
|
||||
|
||||
|
||||
|
||||
A progress bar appears, showing you progress for your policy. After it's done, click **Close** to return to the **Configuration Items** page.
|
||||
|
||||
## Deploy the WIP policy
|
||||
After you’ve created your WIP policy, you'll need to deploy it to your organization's devices. For info about your deployment options, see these topics:
|
||||
- [Operations and Maintenance for Compliance Settings in Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=708224)
|
||||
|
||||
- [How to Create Configuration Baselines for Compliance Settings in Configuration Manager]( https://go.microsoft.com/fwlink/p/?LinkId=708225)
|
||||
|
||||
- [How to Deploy Configuration Baselines in Configuration Manager]( https://go.microsoft.com/fwlink/p/?LinkId=708226)
|
||||
|
||||
## Related topics
|
||||
- [System Center Configuration Manager and Endpoint Protection (Version 1606)](https://go.microsoft.com/fwlink/p/?LinkId=717372)
|
||||
|
||||
- [TechNet documentation for Configuration Manager](https://go.microsoft.com/fwlink/p/?LinkId=691623)
|
||||
|
||||
- [Manage mobile devices with Configuration Manager and Microsoft Intune](https://go.microsoft.com/fwlink/p/?LinkId=691624)
|
||||
|
||||
- [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md)
|
||||
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
|
||||
@ -1,44 +0,0 @@
|
||||
---
|
||||
title: Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune (Windows 10)
|
||||
description: After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices.
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, Intune
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2017
|
||||
---
|
||||
|
||||
# Deploy your Windows Information Protection (WIP) policy using the Azure portal for Microsoft Intune
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later (except Microsoft Azure Rights Management, which is only available on the desktop)
|
||||
|
||||
After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. Enrollment can be done for business or personal devices, allowing the devices to use your managed apps and to sync with your managed content and information.
|
||||
|
||||
**To deploy your WIP policy**
|
||||
|
||||
1. On the **App policy** pane, click your newly-created policy, click **User groups** from the menu that appears, and then click **Add user group**.
|
||||
|
||||
A list of user groups, made up of all of the security groups in your Azure Active Directory, appear in the **Add user group** pane.
|
||||
|
||||
2. Choose the group you want your policy to apply to, and then click **Select** to deploy the policy.
|
||||
|
||||
The policy is deployed to the selected users' devices.
|
||||
|
||||
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
|
||||
## Related topics
|
||||
- [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md)
|
||||
|
||||
- [Associate and deploy your Windows Information Protection (WIP) and VPN policies by using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md)
|
||||
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
|
||||
@ -1,45 +0,0 @@
|
||||
---
|
||||
title: Deploy your Windows Information Protection (WIP) policy using the classic console for Microsoft Intune (Windows 10)
|
||||
description: After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices.
|
||||
ms.assetid: 9c4a01e7-0b1c-4f15-95d0-0389f0686211
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, Intune
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2017
|
||||
---
|
||||
|
||||
# Deploy your Windows Information Protection (WIP) policy using the classic console for Microsoft Intune
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later
|
||||
|
||||
After you’ve created your Windows Information Protection (WIP) policy, you'll need to deploy it to your organization's enrolled devices. Enrollment can be done for business or personal devices, allowing the devices to use your managed apps and to sync with your managed content and information.
|
||||
|
||||
**To deploy your WIP policy**
|
||||
|
||||
1. On the **Configuration policies** page, locate your newly-created policy, click to select it, and then click the **Manage Deployment** button.
|
||||
|
||||
|
||||
|
||||
2. In the left pane of the **Manage Deployment** box, click the employees or groups that should get the policy, and then click **Add**.<p>
|
||||
The added people move to the **Selected Groups** list on the right-hand pane.
|
||||
|
||||
|
||||
|
||||
3. After you've picked all of the employees and groups that should get the policy, click **OK**.<p>
|
||||
The policy is deployed to the selected users' devices.
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
|
||||
## Related topics
|
||||
- [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune.md)
|
||||
|
||||
- [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune.md)
|
||||
|
||||
- [General guidance and best practices for Windows Information Protection (WIP)](guidance-and-best-practices-wip.md)
|
||||
@ -1,98 +0,0 @@
|
||||
---
|
||||
title: List of enlightened Microsoft apps for use with Windows Information Protection (WIP) (Windows 10)
|
||||
description: Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list.
|
||||
ms.assetid: 17c85ea3-9b66-4b80-b511-8f277cb4345f
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2017
|
||||
---
|
||||
|
||||
# List of enlightened Microsoft apps for use with Windows Information Protection (WIP)
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later
|
||||
|
||||
Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list.
|
||||
|
||||
## Enlightened versus unenlightened apps
|
||||
Apps can be enlightened or unenlightened:
|
||||
|
||||
- **Enlightened apps** can differentiate between corporate and personal data, correctly determining which to protect, based on your policies.
|
||||
|
||||
- **Unenlightened apps** consider all data corporate and encrypt everything. Typically, you can tell an unenlightened app because:
|
||||
|
||||
- Windows Desktop shows it as always running in enterprise mode.
|
||||
|
||||
- Windows **Save As** experiences only allow you to save your files as enterprise.
|
||||
|
||||
- **WIP-work only apps** are unenlightened line-of-business apps that have been tested and deemed safe for use in an enterprise with WIP and Mobile App Management (MAM) solutions.
|
||||
|
||||
## List of enlightened Microsoft apps
|
||||
Microsoft has made a concerted effort to enlighten several of our more popular apps, including the following:
|
||||
|
||||
- Microsoft Edge
|
||||
|
||||
- Internet Explorer 11
|
||||
|
||||
- Microsoft People
|
||||
|
||||
- Mobile Office apps, including Word, Excel, PowerPoint, OneNote, and Outlook Mail and Calendar
|
||||
|
||||
- Office 365 ProPlus apps, including Word, Excel, PowerPoint, OneNote, and Outlook
|
||||
|
||||
- OneDrive app
|
||||
|
||||
- OneDrive sync client (OneDrive.exe, the next generation sync client)
|
||||
|
||||
- Microsoft Photos
|
||||
|
||||
- Groove Music
|
||||
|
||||
- Notepad
|
||||
|
||||
- Microsoft Paint
|
||||
|
||||
- Microsoft Movies & TV
|
||||
|
||||
- Microsoft Messaging
|
||||
|
||||
- Microsoft Remote Desktop
|
||||
|
||||
## List of WIP-work only apps from Microsoft
|
||||
Microsoft still has apps that are unenlightened, but which have been tested and deemed safe for use in an enterprise with WIP and MAM solutions.
|
||||
|
||||
- Skype for Business
|
||||
|
||||
## Adding enlightened Microsoft apps to the allowed apps list
|
||||
You can add any or all of the enlightened Microsoft apps to your allowed apps list. Included here is the **Publisher name**, **Product or File name**, and **App Type** info for both Microsoft Intune and System Center Configuration Manager.
|
||||
|
||||
|Product name |App info |
|
||||
|-------------|---------|
|
||||
|Microsoft Edge |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.MicrosoftEdge<br>**App Type:** Universal app |
|
||||
|Microsoft People |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.People<br>**App Type:** Universal app |
|
||||
|Word Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.Word<br>**App Type:** Universal app |
|
||||
|Excel Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.Excel<br>**App Type:** Universal app |
|
||||
|PowerPoint Mobile |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.PowerPoint<br>**App Type:** Universal app |
|
||||
|OneNote |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Office.OneNote<br>**App Type:** Universal app |
|
||||
|Outlook Mail and Calendar |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** microsoft.windowscommunicationsapps<br>**App Type:** Universal app |
|
||||
|Office 365 ProPlus|Office 365 ProPlus apps are set up as a suite. You must use the [O365 ProPlus - Allow and Exempt AppLocker policy files (.zip files)](http://download.microsoft.com/download/7/0/D/70D72459-D72D-4673-B309-F480E3BEBCC9/O365%20ProPlus%20-%20WIP%20Enterprise%20AppLocker%20Policy%20Files.zip) to turn the suite on for WIP.<br>We don't recommend setting up Office by using individual paths or publisher rules.|
|
||||
|Microsoft Photos |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Windows.Photos<br>**App Type:** Universal app |
|
||||
|Groove Music |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.ZuneMusic<br>**App Type:** Universal app |
|
||||
|Microsoft Movies & TV |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.ZuneVideo<br>**App Type:** Universal app |
|
||||
|Microsoft Messaging |**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Messaging<br>**App Type:** Universal app |
|
||||
|IE11 |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** iexplore.exe<br>**App Type:** Desktop app |
|
||||
|OneDrive Sync Client|**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** onedrive.exe<br>**App Type:** Desktop app|
|
||||
|OneDrive app|**Publisher:** `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Product Name:** Microsoft.Microsoftskydrive<br>**Product Version:**Product version: 17.21.0.0 (and later)<br>**App Type:** Universal app |
|
||||
|Notepad |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** notepad.exe<br>**App Type:** Desktop app |
|
||||
|Microsoft Paint |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** mspaint.exe<br>**App Type:** Desktop app |
|
||||
|Microsoft Remote Desktop |**Publisher:** `O=Microsoft Corporation, L=Redmond, S=Washington, C=US`<br>**Binary Name:** mstsc.exe<br>**App Type:** Desktop app |
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
@ -1,32 +0,0 @@
|
||||
---
|
||||
title: General guidance and best practices for Windows Information Protection (WIP) (Windows 10)
|
||||
description: This section includes info about the enlightened Microsoft apps, including how to add them to your Protected Apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with Windows Information Protection (WIP).
|
||||
ms.assetid: aa94e733-53be-49a7-938d-1660deaf52b0
|
||||
keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: explore
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: eross-msft
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/11/2017
|
||||
---
|
||||
|
||||
# General guidance and best practices for Windows Information Protection (WIP)
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10, version 1607 and later
|
||||
- Windows 10 Mobile, version 1607 and later
|
||||
|
||||
This section includes info about the enlightened Microsoft apps, including how to add them to your allowed apps list in Microsoft Intune. It also includes some testing scenarios that we recommend running through with Windows Information Protection (WIP).
|
||||
|
||||
## In this section
|
||||
|Topic |Description |
|
||||
|------|------------|
|
||||
|[Enlightened apps for use with Windows Information Protection (WIP)](enlightened-microsoft-apps-and-wip.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your allowed apps list. |
|
||||
|[Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)](app-behavior-with-wip.md) |Learn the difference between enlightened and unenlightened app behaviors. |
|
||||
|[Recommended Enterprise Cloud Resources and Neutral Resources network settings with Windows Information Protection (WIP)](recommended-network-definitions-for-wip.md) |Recommended additions for the Enterprise Cloud Resources and Neutral Resources network settings, when used with Windows Information Protection (WIP). |
|
||||
|[Using Outlook on the web with Windows Information Protection (WIP)](using-owa-with-wip.md) |Options for using Outlook on the web with Windows Information Protection (WIP). |
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 41 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 45 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 41 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 8.6 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 22 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 18 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 26 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 27 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 2.1 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 48 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 3.3 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 19 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 59 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 66 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 65 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 4.7 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 23 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 2.7 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 42 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 13 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 5.0 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 10 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 9.5 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 50 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 41 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 65 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 66 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 45 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 12 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 50 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 48 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 90 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 58 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 18 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 10 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 37 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 46 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 26 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 10 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 10 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 3.2 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 3.7 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 33 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 49 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 8.8 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 8.7 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 52 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 42 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 68 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 104 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 69 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 28 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 28 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 8.0 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 19 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 7.7 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 11 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 44 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 46 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 40 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 121 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 44 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 42 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 1.4 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 34 KiB |
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user