deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 05:17:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity
windows-itpro-docs/windows/security/information-protection/windows-information-protection/app-behavior-with-wip.md
get-itips a03a05bf6e several metadata changes
2019-05-30 09:41:56 -03:00

7.1 KiB
Raw Blame History

title, description, keywords, ms.prod, ms.mktglfcycl, ms.pagetype, ms.sitesec, ms.pagetype, ms.localizationpriority, author, ms.author, manager, audience, ms.collection, ms.topic, ms.date
title description keywords ms.prod ms.mktglfcycl ms.pagetype ms.sitesec ms.pagetype ms.localizationpriority author ms.author manager audience ms.collection ms.topic ms.date
Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) (Windows 10) How unenlightened and enlightened apps might behave, based on Windows Information Protection (WIP) networking policies, app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames. WIP, Enterprise Data Protection, EDP, Windows Information Protection, unenlightened apps, enlightened apps w10 explore security library security medium dulcemontemayor dolmont dansimp ITPro M365-security-compliance conceptual 02/26/2019

Unenlightened and enlightened app behavior while using Windows Information Protection (WIP)

Applies to:

  • Windows 10, version 1607 and later
  • Windows 10 Mobile, version 1607 and later

Windows Information Protection (WIP) classifies apps into two categories: enlightened and unenlightened. Enlighted apps can differentiate between corporate and personal data, correctly determining which to protect based on internal policies. Corporate data is encrypted on the managed device and attempts to copy/paste or share this information with non-corporate apps or people will fail. Unenlightened apps, when marked as corporate-managed, consider all data corporate and encrypt everything by default.

To avoid the automatic encryption of data, developers can enlighten apps by adding and compiling code using the Windows Information Protection application programming interfaces. The most likely candidates for enlightenment are apps that:

  • Don’t use common controls for saving files.
  • Don’t use common controls for text boxes.
  • Simultaneously work on personal and corporate data (for example, contact apps that display personal and corporate data in a single view or a browser that displays personal and corporate web pages on tabs within a single instance).

We strongly suggest that the only unenlightened apps you add to your allowed apps list are Line-of-Business (LOB) apps.

Important

After revoking WIP, unenlightened apps will have to be uninstalled and re-installed since their settings files will remain encrypted.

Note

For more info about creating enlightened apps, see the Windows Information Protection (WIP) topic in the Windows Dev Center.

Unenlightened app behavior

This table includes info about how unenlightened apps might behave, based on your Windows Information Protection (WIP) networking policies, your app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames.

App rule setting Networking policy configuration
  Name-based policies, without the /*AppCompat*/ string Name-based policies, using the /*AppCompat*/ string or proxy-based policies
Not required. App connects to enterprise cloud resources directly, using an IP address.
  • App is entirely blocked from both personal and enterprise cloud resources.
  • No encryption is applied.
  • App can’t access local Work files.
  • App can access both personal and enterprise cloud resources. However, you might encounter apps using policies that restrict access to enterprise cloud resources.
  • No encryption is applied.
  • App can’t access local Work files.
Not required. App connects to enterprise cloud resources, using a hostname.
  • App is blocked from accessing enterprise cloud resources, but can access other network resources.
  • No encryption is applied.
  • App can’t access local Work files.
Allow. App connects to enterprise cloud resources, using an IP address or a hostname.
  • App can access both personal and enterprise cloud resources.
  • Auto-encryption is applied.
  • App can access local Work files.
Exempt. App connects to enterprise cloud resources, using an IP address or a hostname.
  • App can access both personal and enterprise cloud resources.
  • No encryption is applied.
  • App can access local Work files.

Enlightened app behavior

This table includes info about how enlightened apps might behave, based on your Windows Information Protection (WIP) networking policies, your app configuration, and potentially whether the app connects to network resources directly by using IP addresses or by using hostnames.

App rule setting Networking policy configuration for name-based policies, possibly using the /*AppCompat*/ string, or proxy-based policies
Not required. App connects to enterprise cloud resources, using an IP address or a hostname.
  • App is blocked from accessing enterprise cloud resources, but can access other network resources.
  • No encryption is applied.
  • App can't access local Work files.
Allow. App connects to enterprise cloud resources, using an IP address or a hostname.
  • App can access both personal and enterprise cloud resources.
  • App protects work data and leaves personal data unprotected.
  • App can access local Work files.
Exempt. App connects to enterprise cloud resources, using an IP address or a hostname.
  • App can access both personal and enterprise cloud resources.
  • App protects work data and leaves personal data unprotected.
  • App can access local Work files.

Note

Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see Editing Windows IT professional documentation.