mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 13:27:23 +00:00

Corey Plett a9be47a33c Merged PR 7677: WIP and Autopilot Reset updates

2018-05-01 02:15:29 +00:00

39 KiB

Raw Blame History

title, description, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, author, ms.localizationpriority, ms.date

title	description	ms.prod	ms.mktglfcycl	ms.sitesec	ms.pagetype	author	ms.localizationpriority	ms.date
Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune (Windows 10)	The Azure portal for Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, supporting mobile device management (MDM), to let you choose your protected apps, your WIP-protection level, and how to find enterprise data on the network.	w10	explore	library	security	eross-msft	medium	10/16/2017

Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune

Applies to:

Windows 10, version 1607 and later
Windows 10 Mobile, version 1607 and later (except Microsoft Azure Rights Management, which is only available on the desktop)

Microsoft Intune helps you create and deploy your Windows Information Protection (WIP) policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network.

Important

This topic covers creating a Windows Information Protection (WIP) policy for organizations already managing devices by using Mobile Device Management (MDM) solutions. If your organization uses a mobile application management (MAM) solution to deploy your WIP policy to Intune apps without managing devices, you must follow the instructions in the Create a Windows Information Protection (WIP) policy with MAM using the Azure portal for Microsoft Intune topic.

Add a WIP policy

After you’ve set up Intune for your organization, you must create a WIP-specific policy.

To add a WIP policy

Open the Microsoft Intune mobile application management console, click All settings, and then click App policy.
In the App policy screen, click Add a policy, and then fill out the fields:
- Name. Type a name (required) for your new policy.
- Description. Type an optional description.
- Platform. Choose Windows 10 as the supported platform for your policy.
- Enrollment state. Choose With enrollment as the enrollment state for your policy.
  
  Important
  
  Choosing With enrollment only applies for organizations using MDM. If you're using MAM, you must use these instructions, Create and deploy Windows Information Protection (WIP) app protection policy with Intune, instead.
Click Create.

The policy is created and appears in the table on the App Policy screen.

Note

Optionally, you can also add your apps and set your settings from the Add a policy blade, but for the purposes of this documentation, we recommend instead that you create the policy first, and then use the subsequent menus that become available.

Add apps to your Allowed apps list

During the policy-creation process in Intune, you can choose the apps you want to give access to your enterprise data through WIP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps.

The steps to add your apps are based on the type of template being applied. You can add a recommended app, a store app (also known as a Universal Windows Platform (UWP) app), or a signed Windows desktop app.

Important

Enlightened apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, WIP-unaware apps might not respect the corporate network boundary, and WIP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with WIP before adding it to your Allowed apps list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.

Add a Recommended app to your Allowed apps list

For this example, we’re going to add Microsoft Edge, a recommended app, to the Allowed apps list.

To add a recommended app

From the App policy blade, click the name of your policy, and then click Allowed apps from the menu that appears.

The Allowed apps blade appears, showing you any apps that are already included in the list for this policy.
From the Allowed apps blade, click Add apps.

The Add apps blade appears, showing you all Recommended apps.
Select each app you want to access your enterprise data, and then click OK.

The Allowed apps blade updates to show you your selected apps.

Add a Store app to your Allowed apps list

For this example, we’re going to add Microsoft Power BI, a store app, to the Allowed apps list.

To add a Store app

From the App policy blade, click the name of your policy, and then click Allowed apps from the menu that appears.

The Allowed apps blade appears, showing you any apps that are already included in the list for this policy.
From the Allowed apps blade, click Add apps.
On the Add apps blade, click Store apps from the dropdown list.

The blade changes to show boxes for you to add a publisher and app name.
Type the name of the app and the name of its publisher, and then click OK. For this UWP app example, the Publisher is CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US and the Product name is Microsoft.MicrosoftPowerBIForWindows.
After you’ve entered the info into the fields, click OK to add the app to your Allowed apps list.

Note

To add multiple Store apps at the same time, you can click the menu (…) at the end of the app row, and then continue to add more apps. When you’re done, click OK.

If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps.

To find the publisher and product name values for Store apps without installing them

Go to the Microsoft Store for Business website, and find your app. For example, Microsoft Power BI.
Copy the ID value from the app URL. For example, Microsoft Power BI ID URL is https://www.microsoft.com/en-us/store/p/microsoft-power-bi/9nblgggzlxn1, and you'd copy the ID value, 9nblgggzlxn1.
In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblgggzlxn1/applockerdata, where 9nblgggzlxn1 is replaced with your ID value.

The API runs and opens a text editor with the app details.
```
    {
        "packageIdentityName": "Microsoft.MicrosoftPowerBIForWindows",
        "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US"
    }
```
Copy the publisherCertificateName value into the Publisher box and copy the packageIdentityName value into the Name box of Intune.

Important

The JSON file might also return a windowsPhoneLegacyId value for both the Publisher Name and Product Name boxes. This means that you have an app that’s using a XAP package and that you must set the Product Name as windowsPhoneLegacyId, and set the Publisher Name as CN= followed by the windowsPhoneLegacyId.

For example:
{ "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", }

To find the publisher and product name values for apps installed on Windows 10 mobile phones

If you need to add mobile apps that aren't distributed through the Store for Business, you must use the Windows Device Portal feature.

Note

Your PC and phone must be on the same wireless network.
On the Windows Phone, go to Settings, choose Update & security, and then choose For developers.
In the For developers screen, turn on Developer mode, turn on Device Discovery, and then turn on Device Portal.
Copy the URL in the Device Portal area into your device's browser, and then accept the SSL certificate.
In the Device discovery area, press Pair, and then enter the PIN into the website from the previous step.
On the Apps tab of the website, you can see details for the running apps, including the publisher and product names.
Start the app for which you're looking for the publisher and product name values.
Copy the publisherCertificateName value and paste it into the Publisher Name box and the packageIdentityName value into the Product Name box of Intune.

Important

The JSON file might also return a windowsPhoneLegacyId value for both the Publisher Name and Product Name boxes. This means that you have an app that’s using a XAP package and that you must set the Product Name as windowsPhoneLegacyId, and set the Publisher Name as CN= followed by the windowsPhoneLegacyId.

For example:
{ "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", }

Add a Desktop app to your Allowed apps list

For this example, we’re going to add WordPad, a desktop app, to the Allowed apps list.

To add a Desktop app

From the App policy blade, click the name of your policy, and then click Allowed apps from the menu that appears.

The Allowed apps blade appears, showing you any apps that are already included in the list for this policy.
From the Allowed apps blade, click Add apps.

On the Add apps blade, click Desktop apps from the dropdown list.

The blade changes to show boxes for you to add the following, based on what results you want returned:

Field	Manages
All fields marked as “*”	All files signed by any publisher. (Not recommended)
Publisher only	If you only fill out this field, you’ll get all files signed by the named publisher. This might be useful if your company is the publisher and signer of internal line-of-business apps.
Publisher and Name only	If you only fill out these fields, you’ll get all files for the specified product, signed by the named publisher.
Publisher, Name, and File only	If you only fill out these fields, you’ll get any version of the named file or package for the specified product, signed by the named publisher.
Publisher, Name, File, and Min version only	If you only fill out these fields, you’ll get the specified version or newer releases of the named file or package for the specified product, signed by the named publisher. This option is recommended for enlightened apps that weren't previously enlightened.
Publisher, Name, File, and Max version only	If you only fill out these fields, you’ll get the specified version or older releases of the named file or package for the specified product, signed by the named publisher.
All fields completed	If you fill out all fields, you’ll get the specified version of the named file or package for the specified product, signed by the named publisher.

After you’ve entered the info into the fields, click OK to add the app to your Allowed apps list.

Note

To add multiple Desktop apps at the same time, you can click the menu (…) at the end of the app row, and then continue to add more apps. When you’re done, click OK.

To find the Publisher values for Desktop apps If you’re unsure about what to include for the publisher, you can run this PowerShell command:
```
    Get-AppLockerFileInformation -Path "<path_of_the_exe>"
```
Where "<path_of_the_exe>" goes to the location of the app on the device. For example, Get-AppLockerFileInformation -Path "C:\Program Files\Windows NT\Accessories\wordpad.exe".

In this example, you'd get the following info:
```
    Path                   Publisher
    ----                   ---------
    %PROGRAMFILES%\WINDOWS NT\ACCESSORIES\WORDPAD.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US
```
Where the text, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US is the publisher name to enter into the Publisher box and WORDPAD.EXE is the text to enter into the File box.

Import a list of apps to your Allowed apps list

For this example, we’re going to add an AppLocker XML file to the Allowed apps list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the AppLocker content.

To create a list of Allowed apps using the AppLocker tool

Open the Local Security Policy snap-in (SecPol.msc).
In the left blade, expand Application Control Policies, expand AppLocker, and then click Packaged App Rules.
Right-click in the right-hand blade, and then click Create New Rule.

The Create Packaged app Rules wizard appears.
On the Before You Begin page, click Next.
On the Permissions page, make sure the Action is set to Allow and the User or group is set to Everyone, and then click Next.
On the Publisher page, click Select from the Use an installed packaged app as a reference area.
In the Select applications box, pick the app that you want to use as the reference for your rule, and then click OK. For this example, we’re using Microsoft Dynamics 365.
On the updated Publisher page, click Create.
Click No in the dialog box that appears, asking if you want to create the default rules. You must not create default rules for your WIP policy.
Review the Local Security Policy snap-in to make sure your rule is correct.
In the left blade, right-click on AppLocker, and then click Export policy.

The Export policy box opens, letting you export and save your new policy as XML.

In the Export policy box, browse to where the policy should be stored, give the policy a name, and then click Save.

The policy is saved and you’ll see a message that says 1 rule was exported from the policy.

Example XML file
This is the XML file that AppLocker creates for Microsoft Dynamics 365.

    <?xml version="1.0"?>
    <AppLockerPolicy Version="1">
        <RuleCollection EnforcementMode="NotConfigured" Type="Appx">
            <FilePublisherRule Action="Allow" UserOrGroupSid="S-1-1-0" Description="" Name="Microsoft.MicrosoftDynamicsCRMforWindows10, version 3.2.0.0 and above, from Microsoft Corporation" Id="3da34ed9-aec6-4239-88ba-0afdce252ab4">
                <Conditions>
                    <FilePublisherCondition BinaryName="*" ProductName="Microsoft.MicrosoftDynamicsCRMforWindows10" PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US">
                        <BinaryVersionRange HighSection="*" LowSection="3.2.0.0"/>
                    </FilePublisherCondition>
                </Conditions>
            </FilePublisherRule>
        </RuleCollection>
        <RuleCollection EnforcementMode="NotConfigured" Type="Dll"/>
        <RuleCollection EnforcementMode="NotConfigured" Type="Exe"/>
        <RuleCollection EnforcementMode="NotConfigured" Type="Msi"/>
        <RuleCollection EnforcementMode="NotConfigured" Type="Script"/>
    </AppLockerPolicy>

After you’ve created your XML file, you need to import it by using Microsoft Intune.

To import your list of Allowed apps using Microsoft Intune

From the Allowed apps area, click Import apps.

The blade changes to let you add your import file.
Browse to your exported AppLocker policy file, and then click Open.

The file imports and the apps are added to your Allowed app list.

Add exempt apps to your policy

If you're running into compatibility issues where your app is incompatible with WIP, but still needs to be used with enterprise data, you can exempt the app from the WIP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak.

To exempt a Store app, a Desktop app, or an AppLocker policy file from the Allowed apps list

From the App policy blade, click the name of your policy, and then click Exempt apps from the menu that appears.

The Exempt apps blade appears, showing you any apps that are already included in the list for this policy.
From the Exempt apps blade, click Add apps.

Be aware that when you exempt apps, they’re allowed to bypass the WIP restrictions and access your corporate data. To allow apps, see the Add app rules to your policy section of this topic.
Fill out the rest of the app info, based on the type of app you’re adding:
- Recommended app. Follow the instructions in the Add a Recommended app to your Allowed apps list section of this topic.
- Store app. Follow the instructions in the Add a Store app to your Allowed apps list section of this topic.
- Desktop app. Follow the instructions in the Add a Desktop app to your Allowed apps list section of this topic.
- AppLocker policy file. Follow the instructions to create your app list in the Import a list of apps to your Allowed apps list section of this topic, using a list of exempted apps.
Click OK.

Manage the WIP protection mode for your enterprise data

After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode.

We recommend that you start with Silent or Allow Overrides while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, Hide Overrides.

Note

For info about how to collect your audit log files, see How to collect Windows Information Protection (WIP) audit event logs.

To add your protection mode

From the App policy blade, click the name of your policy, and then click Required settings from the menu that appears.

The Required settings blade appears.

Mode	Description
Hide Overrides	WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.
Allow Overrides	WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. For info about how to collect your audit log files, see How to collect Windows Information Protection (WIP) audit event logs.
Silent	WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.
Off (not recommended)	WIP is turned off and doesn't help to protect or audit your data. After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.

Click Save.

Define your enterprise-managed corporate identity

Corporate identity, usually expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by WIP. For example, emails using contoso.com are identified as being corporate and are restricted by your Windows Information Protection policies.

Starting with Windows 10, version 1703, Intune automatically determines your corporate identity and adds it to the Corporate identity field.

To change your corporate identity

From the App policy blade, click the name of your policy, and then click Required settings from the menu that appears.

The Required settings blade appears.
If the auto-defined identity isn’t correct, you can change the info in the Corporate identity field. If you need to add additional domains, for example your email domains, you can do it in the Advanced settings area.

Choose where apps can access enterprise data

After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network.

There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT).

Important

Every WIP policy should include policy that defines your enterprise network locations.
Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations.

To define where your allowed apps can find and send enterprise data on you network

From the App policy blade, click the name of your policy, and then click Advanced settings from the menu that appears.

The Advanced settings blade appears.
Click Add network boundary from the Network perimeter area.

The Add network boundary blade appears.
Select the type of network boundary to add from the Boundary type box.

Type a name for your boundary into the Name box, add your values to the Value box, based on the following options, and then click OK.

Boundary type	Value format	Description
Cloud Resources	With proxy: contoso.sharepoint.com,contoso.internalproxy1.com\| contoso.visualstudio.com,contoso.internalproxy2.com Without proxy: contoso.sharepoint.com\|contoso.visualstudio.com	Specify the cloud resources to be treated as corporate and protected by WIP. For each cloud resource, you may also optionally specify a proxy server from your Internal proxy servers list to route traffic for this cloud resource. Be aware that all traffic routed through your Internal proxy servers is considered enterprise. If you have multiple resources, you must separate them using the "\|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "\|". For example: `URL <,proxy>\|URL <,proxy>`. Important In some cases, such as when an app connects directly to a cloud resource through an IP address, Windows can’t tell whether it’s attempting to connect to an enterprise cloud resource or to a personal site. In this case, Windows blocks the connection by default. To stop Windows from automatically blocking these connections, you can add the `/AppCompat/` string to the setting. For example: `URL <,proxy>\|URL <,proxy>\|/AppCompat/`. When using this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access), using the Domain joined or marked as compliant option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.
Network domain names	corp.contoso.com,region.contoso.com	Starting with Windows 10, version 1703, this field is optional. Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. If you have multiple resources, you must separate them using the "," delimiter.
Proxy servers	proxy.contoso.com:80;proxy2.contoso.com:443	Specify the proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources. This list shouldn’t include any servers listed in your Internal proxy servers list. Internal proxy servers must be used only for WIP-protected (enterprise) traffic. If you have multiple resources, you must separate them using the ";" delimiter.
Internal proxy servers	contoso.internalproxy1.com;contoso.internalproxy2.com	Specify the internal proxy servers your devices will go through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources. This list shouldn’t include any servers listed in your Proxy servers list. Proxy servers must be used only for non-WIP-protected (non-enterprise) traffic. If you have multiple resources, you must separate them using the ";" delimiter.
IPv4 ranges	Starting IPv4 Address: 3.4.0.1 Ending IPv4 Address: 3.4.255.254 Custom URI: 3.4.0.1-3.4.255.254, 10.0.0.1-10.255.255.254	Starting with Windows 10, version 1703, this field is optional. Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. If you have multiple ranges, you must separate them using the "," delimiter.
IPv6 ranges	Starting IPv6 Address: 2a01:110:: Ending IPv6 Address: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff Custom URI: 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff, fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff	Starting with Windows 10, version 1703, this field is optional. Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. If you have multiple ranges, you must separate them using the "," delimiter.
Neutral resources	sts.contoso.com,sts.contoso2.com	Specify your authentication redirection endpoints for your company. These locations are considered enterprise or personal, based on the context of the connection before the redirection. If you have multiple resources, you must separate them using the "," delimiter.

Repeat steps 1-4 to add any additional network boundaries.
Decide if you want to Windows to look for additional network settings:
- Enterprise Proxy Servers list is authoritative (do not auto-detect). Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network.
- Enterprise IP Ranges list is authoritative (do not auto-detect). Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network.

Upload your Data Recovery Agent (DRA) certificate

After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data.

Important

Using a DRA certificate isn’t mandatory. However, we strongly recommend it. For more info about how to find and export your data recovery certificate, see the Data Recovery and Encrypting File System (EFS) topic. For more info about creating and verifying your EFS DRA certificate, see the Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate topic.

To upload your DRA certificate

From the App policy blade, click the name of your policy, and then click Advanced settings from the menu that appears.

The Advanced settings blade appears.
In the Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data box, click Browse to add a data recovery certificate for your policy.

After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional WIP settings.

To set your optional settings

Choose to set any or all optional settings:
- Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile. Determines whether to encrypt enterprise data using a key that's protected by an employee's PIN code on a locked device. Apps won't be able to read corporate data when the device is locked. The options are:
  - On (recommended). Turns on the feature and provides the additional protection.
  - Off, or not configured. Doesn't enable this feature.
- Revoke encryption keys on unenroll. Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are:
  - On, or not configured (recommended). Revokes local encryption keys from a device during unenrollment.
  - Off. Stop local encryption keys from being revoked from a device during unenrollment. For example if you’re migrating between Mobile Device Management (MDM) solutions.
- Show the Windows Information Protection icon overlay. Determines whether the Windows Information Protection icon overlay appears on corporate files in the Save As and File Explorer views. The options are:
  - On. Allows the Windows Information Protection icon overlay to appear on corporate files in the Save As and File Explorer views. Additionally, for unenlightened but allowed apps, the icon overlay also appears on the app tile and with Managed text on the app name in the Start menu.
  - Off, or not configured (recommended). Stops the Windows Information Protection icon overlay from appearing on corporate files or unenlightened, but allowed apps. Not configured is the default option.
- Use Azure RMS for WIP. Determines whether to use Azure Rights Management encryption with Windows Information Protection.
  - On. Starts using Azure Rights Management encryption with WIP. By turning this option on, you can also add a TemplateID GUID to specify who can access the Azure Rights Management protected files, and for how long. For more info about setting up Azure Rights management and using a template ID with WIP, see the Choose to set up Azure Rights Management with WIP section of this topic.
  - Off, or not configured. Stops using Azure Rights Management encryption with WIP.

Choose to set up Azure Rights Management with WIP

WIP can integrate with Microsoft Azure Rights Management to enable secure sharing of files by using removable drives such as USB drives. For more info about Azure Rights Management, see Microsoft Azure Rights Management. To integrate Azure Rights Management with WIP, you must already have Azure Rights Management set up.

To configure WIP to use Azure Rights Management, you must set the AllowAzureRMSForEDP MDM setting to 1 in Microsoft Intune. This setting tells WIP to encrypt files copied to removable drives with Azure Rights Management, so they can be shared amongst your employees on computers running at least Windows 10, version 1703.

Optionally, if you don’t want everyone in your organization to be able to share your enterprise data, you can set the RMSTemplateIDForEDP MDM setting to the TemplateID of the Azure Rights Management template used to encrypt the data. You must make sure to mark the template with the EditRightsData option.

Important

Curly braces -- {} -- are required around the RMS Template ID.

Note

For more info about setting the AllowAzureRMSForEDP and the RMSTemplateIDForEDP MDM settings, see the EnterpriseDataProtection CSP topic. For more info about setting up and using a custom template, see Configuring custom templates for the Azure Rights Management service topic.

Note

Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see Contributing to TechNet content.

39 KiB Raw Blame History Unescape Escape