WIP support

[markthomas]

What is the status of Windows Information Protection (WIP) support in Edge?  Will all WIP features be supported prior to GA?

[#2]

@Georg Brandner - unfortunately its not easy to personally hand roll an MSI and distribute it :\

If you are trying to deploy on a bigger scale than a few devices and would like to get past the flag - then please deploy this policy which will skip the flag check and turn on WIP.

Browser Policy reference - NonRemovableProfileEnabled

Hope this helps.

[#3]

@Arunesh_Chandra  I added the above mentioned policy to Edge (Enable a non-removable default sign-in profile), however it does not appear to have enabled edge WIP.  All previous pre-reqs are in place, and legacy Edge works, but new edge (80) still isn't using the established WIP polices.

[#4]

Same here. I can't get it to have the flag activated in the DEV build. When I activate the flag as user, it works as expected, but I can't roll out as long as users can overwrite the flag, take out content and activate again.
So I guess I'll just wait for the final release?

[#5]

@Philip Büchler @GitToDeChoppah  the Policy is available in Edge 81 which is currently in dev. Expected to reach Beta sometime this week.

[#6]

A few hours ago, stable version 81 was released.
How can we activate WIP natively from Intune?

Regards,
Jose

[#7]

@Jose Castillo Soriano You need to add Edge in the WIP policy with the App Locker XML file and then you need an administrative template activating "Enable Proactive Authentication" 

[#8]

I wrote it up in a blog post: https://www.wpninjas.ch/2020/04/edge-version-81-now-supports-windows-information-protection/

[#9]

@Philip Büchler 

I didn't enable "Proactive Authentication" and files saved from protected sites encrypted well.

My action was:

1. Install new Edge via Company Portal

2. In WIP-App Protection policy add from Recommended: "MsEdge - WIPMode-Allow - Enterprise AppLocker Policy File.xml"

3. Sync PC and all works fine.

Can you please explain more in detail the need of the "Proactive Authentication"?

[#10]

Well so much has changed in the time of development, but I was under the impression "proactive authentication" is needed, so users can't go to edge://flags to disable Information Protection.

[#11]

@Philip Büchler Thanks for the blog post!

Yes...WIP integration is enabled by default in latest Edge STABLE!

Microsoft Intune supports it natively, so you no longer need to manually import any files & MsEdge should be available in the Intune's WIP policy deployment UX.

NonRemovableProfileEnabled Edge policy is also recommended for better user experience: https://docs.microsoft.com/en-us/deployedge/microsoft-edge-security-windows-information-protection#c...