Forum Discussion

jjboffy's avatar
jjboffy
Copper Contributor
Dec 16, 2020

WIP w/ MDM Office 365 Licences

Greetings Everyone, I am attempting to get a WIP policy set up for my company to protect our files in this new "work-from-home" era. Our devices are MDM enrolled and the policy I have created is w...
Intune
Mobile Device Management (MDM)
  • jjboffy's avatar
    jjboffy
    Copper Contributor
    Dec 18, 2020

    JanBakkerOrphanedThanks for the reply!

     

    I haven't configured any cloud services boundaries yet, so I haven't used the /*AppCompat*/ string. Do I need to use it on network domain and IP4 boundaries as well? I didn't think I did. And yes, the Office ProPlus XML is included in my protected apps.

     

    I wasn't sure what the Denied-Office option was below it, but I've tried it with both, neither, and each selected, all with the same results. I've even tried adding the Excel Program via the Desktop Apps dropdown where you have to enter the fully qualified application publisher name. Same behavior.

     

    My issue is happening when reading any file on a network file server mapped to my profile. My inclination is that its either not seeing my domain boundary or IP boundary. When I open the file with Excel, it becomes read-only and when I bring up "Task Manager ---> Details ---> Enterprise Context" Excel.exe is listed as Enlightened and Work Owned, so I figured that I had the Protected Apps set up correctly.

     

    I was hoping the domain portion of this project would be the easy part, because I know when I start adding cloud service boundaries it is going to get hairy :facepalm:

      • Oktay Sari's avatar
        Oktay Sari
        Iron Contributor
        Dec 18, 2020

        JanBakkerOrphaned Haven't seen this before but I'm curious to know more about your configuration @jjboffy . Perhaps you can share a little more info? 

         

        1. Did you configure  Network Domains? These (FQDN's) are used in conjunction with the IP ranges you configure.
        2. Do you see the extra column "file ownership" in explorer when you browse to the SMB share?
        3. You say it happens when "mapped to my profile" Did you test without mapping?
        4. Can you perhaps test with a .txt file? from the same file share (add notepad to your approved apps) Can you open the txt and is it protected?
        5. Can you open a word document from the share using Wordpad? (while not on approved apps list)
        6. How did you configure your WIP protection mode? Block, Allow Override or Silent? ( I'd advise to start with silent)  
        7. Almost sure you did but asking anyway...Did you check the event logs?
        8. Is it possible to configure another (test) WIP policy and target it to a test group with one or 2 users? This policy should be configured the same, but with network domains configured. I'm also curious about Cloud resources. Could you configure this test policy to include cloud resources like Sharepoint and OneDrive? I'm wondering if Office is going to behave the same way when opening files from SPO or OdB.

Resources