diff --git a/windows/keep-secure/create-edp-policy-using-sccm.md b/windows/keep-secure/create-edp-policy-using-sccm.md index 718d69ba0c..edfc06c2ec 100644 --- a/windows/keep-secure/create-edp-policy-using-sccm.md +++ b/windows/keep-secure/create-edp-policy-using-sccm.md @@ -1,8 +1,8 @@ --- -title: Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager (Windows 10) -description: Configuration Manager (version 1606 or later) helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network. +title: Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager (Windows 10) +description: Configuration Manager (version 1606 or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. ms.assetid: 85b99c20-1319-4aa3-8635-c1a87b244529 -keywords: WIP, Windows Information Protection, EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager +keywords: EDP, Enterprise Data Protection, SCCM, System Center Configuration Manager, Configuration Manager ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -10,7 +10,7 @@ ms.pagetype: security author: eross-msft --- -# Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager +# Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager **Applies to:** - Windows 10 Insider Preview @@ -19,15 +19,15 @@ author: eross-msft [Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -System Center Configuration Manager (version 1605 Tech Preview or later) helps you create and deploy your Windows Information Protection (WIP) policy (previously known as enterprise data protection (EDP), including letting you choose your protected apps, your WIP-protection mode, and how to find enterprise data on the network. +System Center Configuration Manager (version 1605 Tech Preview or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection mode, and how to find enterprise data on the network. >**Important**
-If you previously created a WIP policy using System Center Configuration Manager version 1511 or 1602, you’ll need to recreate it using version 1605 Tech Preview or later. Editing a WIP policy created in version 1511 or 1602 is not supported in version 1605 Tech Preview. There is no migration path between WIP policies across these versions. +If you previously created an EDP policy using System Center Configuration Manager version 1511 or 1602, you’ll need to recreate it using version 1605 Tech Preview or later. Editing an EDP policy created in version 1511 or 1602 is not supported in version 1605 Tech Preview. There is no migration path between EDP policies across these versions. -## Add a WIP policy -After you’ve installed and set up System Center Configuration Manager for your organization, you must create a configuration item for WIP, which in turn becomes your WIP policy. +## Add an EDP policy +After you’ve installed and set up System Center Configuration Manager for your organization, you must create a configuration item for EDP, which in turn becomes your EDP policy. -**To create a configuration item for WIP** +**To create a configuration item for EDP** 1. Open the System Center Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node. @@ -52,21 +52,21 @@ The **Create Configuration Item Wizard** starts. ![Create Configuration Item wizard, choose the supported platforms for the policy](images/edp-sccm-supportedplat.png) -6. On the **Device Settings** screen, click **Windows Information Protection**, and then click **Next**. +6. On the **Device Settings** screen, click **Enterprise data protection**, and then click **Next**. - ![Create Configuration Item wizard, choose the Windows Information Protection settings](images/edp-sccm-devicesettings.png) + ![Create Configuration Item wizard, choose the enterprise data protection settings](images/edp-sccm-devicesettings.png) -The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization. +The **Configure enterprise data protection settings** page appears, where you'll configure your policy for your organization. ### Add app rules to your policy -During the policy-creation process in System Center Configuration Manager, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. +During the policy-creation process in System Center Configuration Manager, you can choose the apps you want to give access to your enterprise data through EDP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed desktop app (also known as a Classic Windows app), or an AppLocker policy file. >**Important**
-WIP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process. +EDP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, EDP-unaware apps might not respect the corporate network boundary, and EDP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process. -Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your **App rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. +Care must be taken to get a support statement from the software provider that their app is safe with EDP before adding it to your **App rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. #### Add a store app rule to your policy For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list. @@ -81,9 +81,9 @@ For this example, we’re going to add Microsoft OneNote, a store app, to the ** 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*. -3. Click **Allow** from the **Windows Information Protection mode** drop-down list. +3. Click **Allow** from the **Enterprise data protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-edp) section. + Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp) section. 4. Pick **Store App** from the **Rule template** drop-down list. @@ -163,9 +163,9 @@ For this example, we’re going to add Internet Explorer, a desktop app, to the 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*. -3. Click **Allow** from the **Windows Information Protection mode** drop-down list. +3. Click **Allow** from the **Enterprise data protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-edp) section. + Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp) section. 4. Pick **Desktop App** from the **Rule template** drop-down list. @@ -303,9 +303,9 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*. -3. Click **Allow** from the **Windows Information Protection mode** drop-down list. +3. Click **Allow** from the **Enterprise data protection mode** drop-down list. - Allow turns on WIP, helping to protect that app’s corporate data through the enforcement of WIP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from WIP restrictions](#exempt-apps-from-edp) section. + Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. If you want to exempt an app, you can follow the steps in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp) section. 4. Pick the **AppLocker policy file** from the **Rule template** drop-down list. @@ -315,8 +315,8 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* The file is imported and the apps are added to your **App Rules** list. -#### Exempt apps from WIP restrictions -If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. +#### Exempt apps from EDP restrictions +If you're running into compatibility issues where your app is incompatible with EDP, but still needs to be used with enterprise data, you can exempt the app from the EDP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. **To exempt a store app, a desktop app, or an AppLocker policy file app rule** @@ -326,9 +326,9 @@ If you're running into compatibility issues where your app is incompatible with 2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*. -3. Click **Exempt** from the **Windows Information Protection mode** drop-down list. +3. Click **Exempt** from the **Enterprise data protection mode** drop-down list. - Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. + Be aware that when you exempt apps, they’re allowed to bypass the EDP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. 4. Fill out the rest of the app rule info, based on the type of rule you’re adding: @@ -340,22 +340,22 @@ If you're running into compatibility issues where your app is incompatible with 5. Click **OK**. -### Manage the WIP-protection level for your enterprise data -After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode. +### Manage the EDP-protection level for your enterprise data +After you've added the apps you want to protect with EDP, you'll need to apply a management and protection mode. We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**. |Mode |Description | |-----|------------| -|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| -|Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkID=746459). | -|Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.| -|Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

After you turn off WIP, an attempt is made to decrypt any closed WIP-tagged files on the locally attached drives.| +|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| +|Override |EDP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkID=746459). | +|Silent |EDP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or EDP-protected data, are still blocked.| +|Off (not recommended) |EDP is turned off and doesn't help to protect or audit your data.

After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives.| -![Create Configuration Item wizard, choose your WIP-protection level](images/edp-sccm-appmgmt.png) +![Create Configuration Item wizard, choose your EDP-protection level](images/edp-sccm-appmgmt.png) ### Define your enterprise-managed identity domains -Corporate identity, usually expressed as your primary internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies. +Corporate identity, usually expressed as your primary internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by EDP. For example, emails using contoso.com are identified as being corporate and are restricted by your enterprise data protection policies. You can specify multiple domains owned by your enterprise by separating them with the "|" character. For example, (contoso.com|newcontoso.com). With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list. @@ -368,11 +368,11 @@ You can specify multiple domains owned by your enterprise by separating them wit ### Choose where apps can access enterprise data After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. -There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). +There are no default locations included with EDP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). >**Important**
-- Every WIP policy should include policy that defines your enterprise network locations. -- Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations. +- Every EDP policy should include policy that defines your enterprise network locations. +- Classless Inter-Domain Routing (CIDR) notation isn’t supported for EDP configurations. **To define where your protected apps can find and send enterprise data on you network** @@ -393,7 +393,7 @@ There are no default locations included with WIP, you must add each of your netw Enterprise Cloud Resources **With proxy:** contoso.sharepoint.com,proxy.contoso.com|
contoso.visualstudio.com,proxy.contoso.com

**Without proxy:** contoso.sharepoint.com|contoso.visualstudio.com - Specify the cloud resources to be treated as corporate and protected by WIP.

For each cloud resource, you may also optionally specify an internal proxy server that routes your traffic through your Enterprise Internal Proxy Server.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: `URL <,proxy>|URL <,proxy>`.

If Windows is unable to determine whether an app should be allowed to connect to a network resource, it will automatically block the connection. If instead you want Windows to allow the connections to happen, you can add the `/*AppCompat*/` string to this setting. For example: `URL <,proxy>|URL <,proxy>|/*AppCompat*/` + Specify the cloud resources to be treated as corporate and protected by EDP.

For each cloud resource, you may also optionally specify an internal proxy server that routes your traffic through your Enterprise Internal Proxy Server.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: `URL <,proxy>|URL <,proxy>`.

If Windows is unable to determine whether an app should be allowed to connect to a network resource, it will automatically block the connection. If instead you want Windows to allow the connections to happen, you can add the `/*AppCompat*/` string to this setting. For example: `URL <,proxy>|URL <,proxy>|/*AppCompat*/` Enterprise Network Domain Names (Required) @@ -403,12 +403,12 @@ There are no default locations included with WIP, you must add each of your netw Enterprise Proxy Servers proxy.contoso.com:80;proxy2.contoso.com:137 - Specify your externally-facing proxy server addresses, along with the port through which traffic is allowed and protected with WIP.

This list shouldn’t include any servers listed in the Enterprise Internal Proxy Servers list, which are used for WIP-protected traffic.

This setting is also required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when you’re visiting another company and not on that company’s guest network.

If you have multiple resources, you must separate them using the ";" delimiter. + Specify your externally-facing proxy server addresses, along with the port through which traffic is allowed and protected with EDP.

This list shouldn’t include any servers listed in the Enterprise Internal Proxy Servers list, which are used for EDP-protected traffic.

This setting is also required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when you’re visiting another company and not on that company’s guest network.

If you have multiple resources, you must separate them using the ";" delimiter. Enterprise Internal Proxy Servers contoso.internalproxy1.com;contoso.internalproxy2.com - Specify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-WIP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter. + Specify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-EDP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter. Enterprise IPv4 Range (Required) @@ -439,18 +439,18 @@ There are no default locations included with WIP, you must add each of your netw - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. - - **Show the Windows Information Protection icon overlay on your allowed apps that are WIP-unaware in the Windows Start menu and on corporate file icons in the File Explorer.** Click this box if you want the Windows Information Protection icon overlay to appear on corporate files or in the Start menu, on top the tiles for your unenlightened protected apps. + - **Show the enterprise data protection icon overlay on your allowed apps that are EDP-unaware in the Windows Start menu and on corporate file icons in the File Explorer.** Click this box if you want the enterprise data protection icon overlay to appear on corporate files or in the Start menu, on top the tiles for your unenlightened protected apps. 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. + After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic. ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/edp-sccm-dra.png) -#### Create and verify an Encrypting File System (EFS) DRA certificate for WIP -If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use WIP in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. +#### Create and verify an Encrypting File System (EFS) DRA certificate for EDP +If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use EDP in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. >**Important**
If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. @@ -464,12 +464,12 @@ If you don’t already have an EFS DRA certificate, you’ll need to create and The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1. - **Important**
Because these files can be used to decrypt any WIP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location. + **Important**
Because these files can be used to decrypt any EDP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location. -4. Add your EFS DRA certificate to your WIP policy by using Step 3 of the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic. +4. Add your EFS DRA certificate to your EDP policy by using Step 3 of the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic. -**To verify your data recovery certificate is correctly set up on a WIP client computer** -1. Open an app on your protected app list, and then create and save a file so that it’s encrypted by WIP. +**To verify your data recovery certificate is correctly set up on an EDP client computer** +1. Open an app on your protected app list, and then create and save a file so that it’s encrypted by EDP. 2. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command: @@ -478,7 +478,7 @@ If you don’t already have an EFS DRA certificate, you’ll need to create and 3. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. **To recover your data using the EFS DRA certificate in a test environment** -1. Copy your WIP-encrypted file to a location where you have admin access. +1. Copy your EDP-encrypted file to a location where you have admin access. 2. Install the EFSDRA.pfx file, using your password. @@ -486,8 +486,8 @@ If you don’t already have an EFS DRA certificate, you’ll need to create and `cipher /d `
Where `` is the name of your encrypted file. For example, corporatedata.docx. -### Choose your optional WIP-related settings -After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings. +### Choose your optional EDP-related settings +After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional EDP settings. ![Create Configuration Item wizard, Choose any additional, optional settings](images/edp-sccm-additionalsettings.png) @@ -512,10 +512,10 @@ After you've decided where your protected apps can access enterprise data on you - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. - - **Revoke local encryption keys during the unerollment process.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: + - **Revoke local encryption keys during the unerollment process.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from enterprise data protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: - **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. - + - **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. 2. After you pick all of the settings you want to include, click **Summary**. @@ -531,8 +531,8 @@ After you've finished configuring your policy, you can review all of your info o A progress bar appears, showing you progress for your policy. After it's done, click **Close** to return to the **Configuration Items** page. -## Deploy the WIP policy -After you’ve created your WIP policy, you'll need to deploy it to your organization's devices. For info about your deployment options, see these topics: +## Deploy the EDP policy +After you’ve created your EDP policy, you'll need to deploy it to your organization's devices. For info about your deployment options, see these topics: - [Operations and Maintenance for Compliance Settings in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=708224) - [How to Create Configuration Baselines for Compliance Settings in Configuration Manager]( http://go.microsoft.com/fwlink/p/?LinkId=708225) - [How to Deploy Configuration Baselines in Configuration Manager]( http://go.microsoft.com/fwlink/p/?LinkId=708226)