mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-16 19:03:46 +00:00
Moved text from table into bullets
This commit is contained in:
Mandi Ohlinger
GitHub
@ -31,20 +31,128 @@ You can try any of the processes included in these scenarios, but you should foc
|
||||
>[!IMPORTANT]
|
||||
>If any of these scenarios does not work, first take note of whether WIP has been revoked. If it has, unenlightened apps will have to be uninstalled and re-installed since their settings files will remain encrypted.
|
||||
|
||||
|Scenario|Processes|
|
||||
|--- |--- |
|
||||
|Encrypt and decrypt files using File Explorer.|**For desktop:**<br><ol><li>Open File Explorer, right-click a work document, and then click **Work** from the **File Ownership** menu.<br>Make sure the file is encrypted by right-clicking the file again, clicking **Advanced** from the **General** tab, and then clicking **Details** from the **Compress or Encrypt attributes** area. The file should show up under the heading, **This enterprise domain can remove or revoke access:** <em><your_enterprise_identity></em>. For example, contoso.com.<li>In File Explorer, right-click the same document, and then click **Personal** from the **File Ownership** menu.<br>Make sure the file is decrypted by right-clicking the file again, clicking **Advanced** from the **General** tab, and then verifying that the **Details** button is unavailable.</ol>**For mobile:**<br><br><ol><li>Open the File Explorer app, browse to a file location, click the elipsis (...), and then click **Select** to mark at least one file as work-related.<li>Click the elipsis (...) again, click **File ownership** from the drop down menu, and then click **Work**.<br>Make sure the file is encrypted, by locating the **Briefcase** icon next to the file name.<li>Select the same file, click **File ownership** from the drop down menu, and then click **Personal**.<br>Make sure the file is decrypted and that you're no longer seeing the **Briefcase** icon next to file name.</ol>|
|
||||
|Create work documents in enterprise-allowed apps.|**For desktop:**<br><br><ul><li>Start an unenlightened but allowed app, such as a line-of-business app, and then create a new document, saving your changes.<br>Make sure the document is encrypted to your Enterprise Identity. This might take a few minutes and require you to close and re-open the file.<br><br>**Important**<br>Certain file types like <code>.exe</code> and <code>.dll</code>, along with certain file paths, such as <code>%windir%</code> and <code>%programfiles%</code> are excluded from automatic encryption.<br><br>For more info about your Enterprise Identity and adding apps to your allowed apps list, see either [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune-azure.md) or [Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-configmgr.md), based on your deployment system.</ul>**For mobile:**<br><br><ol><li>Start an allowed mobile app, such as Word Mobile, create a new document, and then save your changes as **Work** to a local, work-related location.<br>Make sure the document is encrypted, by locating the **Briefcase** icon next to the file name.<li>Open the same document and attempt to save it to a non-work-related location.<br>WIP should stop you from saving the file to this location.<li>Open the same document one last time, make a change to the contents, and then save it again using the **Personal** option.<br>Make sure the file is decrypted and that you're no longer seeing the **Briefcase** icon next to file name.</ol>|
|
||||
|Block enterprise data from non-enterprise apps.|<ol><li>Start an app that doesn't appear on your allowed apps list, and then try to open a work-encrypted file.<br>The app shouldn't be able to access the file.<li>Try double-clicking or tapping on the work-encrypted file.<br>If your default app association is an app not on your allowed apps list, you should get an **Access Denied** error message.</ol>|
|
||||
|Copy and paste from enterprise apps to non-enterprise apps.|<ol><li>Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list.<br>You should see a WIP-related warning box, asking you to click either **Change to personal** or **Keep at work**.<li>Click **Keep at work**.<br>The content isn't pasted into the non-enterprise app.<li>Repeat Step 1, but this time click **Change to personal**, and try to paste the content again.<br>The content is pasted into the non-enterprise app.<li>Try copying and pasting content between apps on your allowed apps list.<br>The content should copy and paste between apps without any warning messages.</ol>|
|
||||
|Drag and drop from enterprise apps to non-enterprise apps.|<ol><li>Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list.<br>You should see a WIP-related warning box, asking you to click either **Keep at work** or **Change to personal**.<li>Click **Keep at work**.<br>The content isn't dropped into the non-enterprise app.<li>Repeat Step 1, but this time click **Change to personal**, and try to drop the content again.<br>The content is dropped into the non-enterprise app.<li>Try dragging and dropping content between apps on your allowed apps list.<br>The content should move between the apps without any warning messages.</ol>|
|
||||
|Share between enterprise apps and non-enterprise apps.|<ol><li>Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook.<br>You should see a WIP-related warning box, asking you to click either **Keep at work** or **Change to personal**.<li>Click **Keep at work**.<br>The content isn't shared into Facebook.<li>Repeat Step 1, but this time click **Change to personal**, and try to share the content again.<br>The content is shared into Facebook.<li>Try sharing content between apps on your allowed apps list.<br>The content should share between the apps without any warning messages.</ol>|
|
||||
|Verify that Windows system components can use WIP.|<ol><li>Start Windows Journal and Internet Explorer 11, creating, editing, and saving files in both apps.<br>Make sure that all of the files you worked with are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted.<li>Open File Explorer and make sure your modified files are appearing with a **Lock** icon.<li>Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.<br><br>**Note**<br>Most Windows-signed components like File Explorer (when running in the user's context), should have access to enterprise data.<br><br>A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.</ol>|
|
||||
|Use WIP on NTFS, FAT, and exFAT systems.|<ol><li>Start an app that uses the FAT or exFAT file system (for example a SD card or USB flash drive), and appears on your allowed apps list.<li>Create, edit, write, save, copy, and move files.<br>Basic file and folder operations like copy, move, rename, delete, and so on, should work properly on encrypted files.</ol>|
|
||||
|Verify your shared files can use WIP.|<ol><li>Download a file from a protected file share, making sure the file is encrypted by locating the **Briefcase** icon next to the file name.<li>Open the same file, make a change, save it and then try to upload it back to the file share. Again, this should work without any warnings.<li>Open an app that doesn't appear on your allowed apps list and attempt to access a file on the WIP-enabled file share.<br>The app shouldn't be able to access the file share.</ol>|
|
||||
|Verify your cloud resources can use WIP.|<ol><li>Add both Internet Explorer 11 and Microsoft Edge to your allowed apps list.<li>Open SharePoint (or another cloud resource that's part of your policy) and access a WIP-enabled resource by using both IE11 and Microsoft Edge.<br>Both browsers should respect the enterprise and personal boundary.<li>Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource.<br>IE11 shouldn't be able to access the sites.<br><br>**Note**<br>Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as **Work**.</ol>|
|
||||
|Verify your Virtual Private Network (VPN) can be auto-triggered.|<ol><li>Set up your VPN network to start based on the **WIPModeID** setting.<br>For specific info about how to do this, see the [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune-azure.md) topic.<li>Start an app from your allowed apps list.<br>The VPN network should automatically start.<li>Disconnect from your network and then start an app that isn't on your allowed apps list.<br>The VPN shouldn't start and the app shouldn't be able to access your enterprise network.</ol>|
|
||||
|Unenroll client devices from WIP.|<ul><li>Unenroll a device from WIP by going to **Settings**, click **Accounts**, click **Work**, click the name of the device you want to unenroll, and then click **Remove**.<br>The device should be removed and all of the enterprise content for that managed account should be gone.<br><br>**Important**<br>On desktop devices, the data isn't removed and can be recovered, so you must make sure the content is marked as **Revoked** and that access is denied for the employee. On mobile devices, the data is removed.|
|
||||
- **Encrypt and decrypt files using File Explorer**:
|
||||
|
||||
1. Open File Explorer, right-click a work document, and then click **Work** from the **File Ownership** menu.
|
||||
|
||||
Make sure the file is encrypted by right-clicking the file again, clicking **Advanced** from the **General** tab, and then clicking **Details** from the **Compress or Encrypt attributes** area. The file should show up under the heading, **This enterprise domain can remove or revoke access:** `*<your_enterprise_identity>*`. For example, `contoso.com`.
|
||||
|
||||
2. In File Explorer, right-click the same document, and then click **Personal** from the **File Ownership** menu.
|
||||
|
||||
Make sure the file is decrypted by right-clicking the file again, clicking **Advanced** from the **General** tab, and then verifying that the **Details** button is unavailable.
|
||||
|
||||
- **Create work documents in enterprise-allowed apps**: Start an unenlightened but allowed app, such as a line-of-business app, and then create a new document, saving your changes.
|
||||
|
||||
Make sure the document is encrypted to your Enterprise Identity. This might take a few minutes and require you to close and re-open the file.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Certain file types like `.exe` and `.dll`, along with certain file paths, such as `%windir%` and `%programfiles%` are excluded from automatic encryption.
|
||||
|
||||
For more info about your Enterprise Identity and adding apps to your allowed apps list, see either [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-wip-policy-using-intune-azure.md) or [Create a Windows Information Protection (WIP) policy using Microsoft Endpoint Configuration Manager](create-wip-policy-using-configmgr.md), based on your deployment system.
|
||||
|
||||
- **Block enterprise data from non-enterprise apps**:
|
||||
|
||||
1. Start an app that doesn't appear on your allowed apps list, and then try to open a work-encrypted file.
|
||||
|
||||
The app shouldn't be able to access the file.
|
||||
|
||||
2. Try double-clicking or tapping on the work-encrypted file. If your default app association is an app not on your allowed apps list, you should get an **Access Denied** error message.
|
||||
|
||||
- **Copy and paste from enterprise apps to non-enterprise apps**:
|
||||
|
||||
1. Copy (CTRL+C) content from an app on your allowed apps list, and then try to paste (CTRL+V) the content into an app that doesn't appear on your allowed apps list.
|
||||
|
||||
You should see a WIP-related warning box, asking you to click either **Change to personal** or **Keep at work**.
|
||||
|
||||
2. Click **Keep at work**. The content isn't pasted into the non-enterprise app.
|
||||
3. Repeat Step 1, but this time click **Change to personal**, and try to paste the content again.
|
||||
|
||||
The content is pasted into the non-enterprise app.
|
||||
|
||||
4. Try copying and pasting content between apps on your allowed apps list. The content should copy and paste between apps without any warning messages.
|
||||
|
||||
- **Drag and drop from enterprise apps to non-enterprise apps**:
|
||||
|
||||
1. Drag content from an app on your allowed apps list, and then try to drop the content into an app that doesn't appear on your allowed apps list.
|
||||
|
||||
You should see a WIP-related warning box, asking you to click either **Keep at work** or **Change to personal**.
|
||||
|
||||
2. Click **Keep at work**. The content isn't dropped into the non-enterprise app.
|
||||
3. Repeat Step 1, but this time click **Change to personal**, and try to drop the content again.
|
||||
|
||||
The content is dropped into the non-enterprise app.
|
||||
|
||||
4. Try dragging and dropping content between apps on your allowed apps list. The content should move between the apps without any warning messages.
|
||||
|
||||
- **Share between enterprise apps and non-enterprise apps**:
|
||||
|
||||
1. Open an app on your allowed apps list, like Microsoft Photos, and try to share content with an app that doesn't appear on your allowed apps list, like Facebook.
|
||||
|
||||
You should see a WIP-related warning box, asking you to click either **Keep at work** or **Change to personal**.
|
||||
|
||||
2. Click **Keep at work**. The content isn't shared into Facebook.
|
||||
3. Repeat Step 1, but this time click **Change to personal**, and try to share the content again.
|
||||
|
||||
The content is shared into Facebook.
|
||||
|
||||
4. Try sharing content between apps on your allowed apps list. The content should share between the apps without any warning messages.
|
||||
|
||||
- **Verify that Windows system components can use WIP**:
|
||||
|
||||
1. Start Windows Journal and Internet Explorer 11, creating, editing, and saving files in both apps.
|
||||
|
||||
Make sure that all of the files you worked with are encrypted to your configured Enterprise Identity. In some cases, you might need to close the file and wait a few moments for it to be automatically encrypted.
|
||||
|
||||
2. Open File Explorer and make sure your modified files are appearing with a **Lock** icon.
|
||||
3. Try copying and pasting, dragging and dropping, and sharing using these apps with other apps that appear both on and off the allowed apps list.
|
||||
|
||||
> [!NOTE]
|
||||
> Most Windows-signed components like File Explorer (when running in the user's context), should have access to enterprise data.
|
||||
>
|
||||
> A few notable exceptions include some of the user-facing in-box apps, like Wordpad, Notepad, and Microsoft Paint. These apps don't have access by default, but can be added to your allowed apps list.
|
||||
|
||||
- **Use WIP on NTFS, FAT, and exFAT systems**:
|
||||
|
||||
1. Start an app that uses the FAT or exFAT file system (for example a SD card or USB flash drive), and appears on your allowed apps list.
|
||||
2. Create, edit, write, save, copy, and move files. Basic file and folder operations like copy, move, rename, delete, and so on, should work properly on encrypted files.
|
||||
|
||||
- **Verify your shared files can use WIP**:
|
||||
|
||||
1. Download a file from a protected file share, making sure the file is encrypted by locating the **Briefcase** icon next to the file name.
|
||||
2. Open the same file, make a change, save it and then try to upload it back to the file share. Again, this should work without any warnings.
|
||||
3. Open an app that doesn't appear on your allowed apps list and attempt to access a file on the WIP-enabled file share.
|
||||
|
||||
The app shouldn't be able to access the file share.
|
||||
|
||||
- **Verify your cloud resources can use WIP**:
|
||||
|
||||
1. Add both Internet Explorer 11 and Microsoft Edge to your allowed apps list.
|
||||
2. Open SharePoint (or another cloud resource that's part of your policy) and access a WIP-enabled resource by using both IE11 and Microsoft Edge.
|
||||
|
||||
Both browsers should respect the enterprise and personal boundary.
|
||||
|
||||
3. Remove Internet Explorer 11 from your allowed app list and then try to access an intranet site or enterprise-related cloud resource.
|
||||
|
||||
IE11 shouldn't be able to access the sites.
|
||||
|
||||
> [!NOTE]
|
||||
> Any file downloaded from your work SharePoint site, or any other WIP-enabled cloud resource, is automatically marked as **Work**.
|
||||
|
||||
- **Verify your Virtual Private Network (VPN) can be auto-triggered**:
|
||||
|
||||
1. Set up your VPN network to start based on the **WIPModeID** setting. For specific info, see [Create and deploy a VPN policy for Windows Information Protection (WIP) using Microsoft Intune](create-vpn-and-wip-policy-using-intune-azure.md).
|
||||
2. Start an app from your allowed apps list. The VPN network should automatically start.
|
||||
3. Disconnect from your network and then start an app that isn't on your allowed apps list.
|
||||
|
||||
The VPN shouldn't start and the app shouldn't be able to access your enterprise network.
|
||||
|
||||
- **Unenroll client devices from WIP**: Unenroll a device from WIP by going to **Settings**, click **Accounts**, click **Work**, click the name of the device you want to unenroll, and then click **Remove**.
|
||||
|
||||
The device should be removed and all of the enterprise content for that managed account should be gone.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> On client devices, the data isn't removed and can be recovered. So, you must make sure the content is marked as **Revoked** and that access is denied for the employee.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
>Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md).
|
||||
|
||||
Reference in New Issue
Block a user