diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index 3c0bd54506..ee29ad4063 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -37,15 +37,13 @@ Microsoft Intune helps you create and deploy your enterprise data protection (ED After you’ve installed and set up Intune for your organization, you must create an EDP-specific policy. **To add an EDP policy** -1. Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy**. +1. Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy** from the **Tasks** area. -2. Click **Add Policy** from the **Tasks** area. - -3. Go to **Windows**, click the **Enterprise Data Protection (Windows 10 and Mobile and later) policy**, pick the EDP template, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. +2. Go to **Windows**, click the **Enterprise Data Protection (Windows 10 and Mobile and later) policy**, pick the EDP template, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. ![Microsoft Intune: Create your new policy from the New Policy screen](images/intune-createnewpolicy.png) -4. Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. +3. Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. ![Microsoft Intune: Fill out the required Name and optional Description fields](images/intune-namedescription.png) @@ -93,7 +91,7 @@ The steps to add your apps are based on the type of app it is; either a Universa **To find the Publisher and Product name values for apps installed on Windows 10 Mobile phones** - 1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the Windows Device Portal feature. + 1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature.

**Note**
Your PC and phone must be on the same wireless network. 2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. @@ -104,10 +102,11 @@ The steps to add your apps are based on the type of app it is; either a Universa 5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. - 6. On the **Apps** tab of the website, click the drop-down box to choose the app you want to know more about. -

The **Publisher** and **Product Name** values appear. + 6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. + + 7. Start the app for which you're looking for the publisher and product name values - 7. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. + 8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune.

**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`.

For example:
``` json @@ -157,8 +156,6 @@ The steps to add your apps are based on the type of app it is; either a Universa - ![Microsoft Intune: Add a Classic Windows app to the Protected Apps list](images/intune-add-desktop-app.png) - If you’re unsure about what to include for the publisher, you can run this PowerShell command: ``` ps1 @@ -175,6 +172,8 @@ Path Publisher ``` Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box. +![Microsoft Intune: Add a Classic Windows app to the Protected Apps list](images/intune-add-desktop-app.png) + ## Exempt apps from EDP restrictions If you're running into compatibility issues where your app is incompatible with EDP, but still needs to be used with enterprise data, you can exempt the app from the EDP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. @@ -233,7 +232,7 @@ We recommend that you start with **Silent** or **Override** while verifying with Off - EDP is turned off and doesn't help to protect or audit your data. + EDP is turned off and doesn't help to protect or audit your data.

After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives. diff --git a/windows/keep-secure/protect-enterprise-data-using-edp.md b/windows/keep-secure/protect-enterprise-data-using-edp.md index 9c0a32e736..d0c4802441 100644 --- a/windows/keep-secure/protect-enterprise-data-using-edp.md +++ b/windows/keep-secure/protect-enterprise-data-using-edp.md @@ -37,7 +37,7 @@ EDP helps address your everyday challenges in the enterprise. Including: - Helping to maintain the ownership and control of your enterprise data. -- Managing apps that aren’t enterprise aware, especially on mobile devices. +- Managing apps that aren’t enterprise aware. ### EDP-protection modes You can set EDP to 1 of 4 protection and management modes: @@ -69,7 +69,7 @@ EDP gives you a new way to manage data security for apps and documents, along wi - **Continuous data encryption.** EDP helps protect enterprise data when it leaves a device. For example, when an employee saves to public cloud storage, or synchronizes with another device.

Apps such as Microsoft Word work with EDP to continue your data encryption across locations and services. These apps are being referred to as, *enterprise aware*. For example, if an employee opens EDP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies EDP to the new document, maintaining the encryption. - - **Helping prevent accidental data disclosure to public spaces.** EDP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, file syncing apps not on your **Protected App** list, such as Dropbox™, won’t be able to sync encrypted files to the employee’s personal cloud storage. Instead, if an employee stores content in their Microsoft OneDrive for Business folder, which is automatically synced with OneDrive for Business (an app on your **Protected App** list), then the document maintains its encryption and can sync freely. + - **Helping prevent accidental data disclosure to public spaces.** EDP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your **Protected App** list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your **Protected Apps** list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the cloud, while maintaining the encryption. - **Helping prevent accidental data disclosure to other devices.** EDP helps prevent enterprise data from leaking when it's copied or transferred to other devices. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t.