WIP w/ MDM Office 365 Licences

Question

Greetings Everyone,I am attempting to get a WIP policy set up for my company to protect our files in this new "work-from-home" era. Our devices are MDM enrolled and the policy I have created is working mostly as intended for my test group.&nbsp;Biggest issue is this: all files labeled File Ownership - "work-domain" are opening as read-only with the following message in Office apps. If I click on Activate, it completely messes up my computer's Office activation, I become un-activated on all profiles and have to completely re-install to fix the issue.&nbsp;What am I missing? Is this a network boundary issue? An enrollment issue? Or some other setting I have overlooked, perhaps on a different window?&nbsp;Any help would be grand!

jjboffy · Answer

JanBakkerOrphanedThanks for the reply!&nbsp;I haven't configured any cloud services boundaries yet, so I haven't used the /*AppCompat*/ string. Do I need to use it on network domain and IP4 boundaries as well? I didn't think I did. And yes, the Office ProPlus XML is included in my protected apps.&nbsp;I wasn't sure what the Denied-Office option was below it, but I've tried it with both, neither, and each selected, all with the same results. I've even tried adding the Excel Program via the Desktop Apps dropdown where you have to enter the fully qualified application publisher name. Same behavior.&nbsp;My issue is happening when reading any file on a network file server mapped to my profile. My inclination is that its either not seeing my domain boundary or IP boundary. When I open the file with Excel, it becomes read-only and when I bring up "Task Manager ---&gt; Details ---&gt; Enterprise Context" Excel.exe is listed as Enlightened and Work Owned, so I figured that I had the Protected Apps set up correctly.&nbsp;I was hoping the domain portion of this project would be the easy part, because I know when I start adding cloud service boundaries it is going to get hairy

oktay sari · Answer

JanBakkerOrphaned&nbsp;Haven't seen this before but I'm curious to know more about your configuration&nbsp;@jjboffy&nbsp;. Perhaps you can share a little more info?&nbsp;&nbsp;Did you configure&nbsp; Network Domains? These (FQDN's) are used in conjunction with the IP ranges you configure.Do you see the extra column "file ownership" in explorer when you browse to the SMB share?You say it happens when "mapped to my profile" Did you test without mapping?Can you perhaps test with a .txt file? from the same file share (add notepad to your approved apps) Can you open the txt and is it protected?Can you open a word document from the share using&nbsp;Wordpad? (while not on approved apps list)How did you configure your WIP protection mode? Block, Allow Override or Silent? ( I'd advise to start with silent)&nbsp;&nbsp;Almost sure you did but asking anyway...Did you check the event logs?Is it possible to configure another (test) WIP policy and target it to a test group with one or 2 users? This policy should be configured the same, but with network domains configured. I'm also curious about Cloud resources. Could you configure this test policy to include cloud resources like Sharepoint and OneDrive? I'm wondering if Office is going to behave the same way when opening files from SPO or OdB.

oktay sari · Answer

jjboffy&nbsp;Sorry couldn't be of help. Did you open a support case with Microsoft already? I'm looking at this from a MEM and WIP perspective but I'm starting to think the root cause is something else.&nbsp;&nbsp;PS: If we don't speak to each other this year...All the best for 2021!&nbsp;New year, new start...and hopefully a solution to this mind-boggling situation you have.&nbsp;&nbsp;

janbakkerorphaned · Answer

jjboffy&nbsp;Did you add the /*AppCompat*/ string to your boundaries?&nbsp;Is the Office Proplus XML included in the apps section?&nbsp;&nbsp;Unenlightened and enlightened app behavior while using Windows Information Protection (WIP) (Windows 10) - Microsoft 365 Security | Microsoft Docs

janbakkerorphaned · Answer

jjboffy&nbsp;Mhhm, never had this experience before.&nbsp;&nbsp;Oktay Sari&nbsp;any clue what could be wrong here?&nbsp;

Forum Discussion

WIP w/ MDM Office 365 Licences

Share

Resources