Corporate data restriction using Intune for Windows BYOD Devices

Hi Folks,

A customer has a business requirement where external users are provided corporate identity (Email ID) and those users access emails or corporate data from their personal Windows Laptops. For this scenario customer want to restrict corporate data access within approved applications like MS Outlook, Word, Excel and OneDrive but without enrolling external users' devices in Intune.

In addition to this customer wants to block copy of data from MS word to Notepad or wordpad, block screen shots and block copying of data to local disk - this is pretty much similar to MAM Android or iOS policies that customer wants to do with Windows Devices.

We tried this with Windows Information Protection (WIP) policies but couldn't achieve this. Please suggest, if it can be achieved with WIP policies or is there any other way to achieve this using Intune. Thanks.