WDAG - Microsoft Defender Application Guard for Office - No Attachment protection

%3CLINGO-SUB%20id%3D%22lingo-sub-2868623%22%20slang%3D%22en-US%22%3EWDAG%20-%20Microsoft%20Defender%20Application%20Guard%20for%20Office%20-%20No%20Attachment%20protection%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2868623%22%20slang%3D%22en-US%22%3E%3CP%3EAfter%20trying%20on%20%3CA%20href%3D%22https%3A%2F%2Fwww.reddit.com%2Fr%2FIntune%2Fcomments%2Fqbhik4%2Fapplication_guard_for_office_doesnt_work_for%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3EReddit%3C%2FA%3E%2C%20Let's%20try%20to%20find%20an%20answers%20here.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20enabled%20Microsoft%20Defender%20Application%20Guard%20for%20Office%20for%20a%20few%20test%20devices%2Fusers%20in%20our%20organisation.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI've%20used%20Microsoft%20Endpoint%20Manager%20%2F%20Endpoint%20Security%20for%20this%3A%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Screenshot%202021-10-19%20201611.png%22%20style%3D%22width%3A%20689px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F318905i4B74AC323705415F%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Screenshot%202021-10-19%20201611.png%22%20alt%3D%22Enable%20MDAG%20for%20Office%20(not%20for%20Edge)%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EEnable%20MDAG%20for%20Office%20(not%20for%20Edge)%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Screenshot%202021-10-19%20201648.png%22%20style%3D%22width%3A%20690px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F318906iEC1124F2C8CCB15B%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Screenshot%202021-10-19%20201648.png%22%20alt%3D%22Add%20the%20network%20Rules%20(hidden%20company%20specific%20url%20parts)%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EAdd%20the%20network%20Rules%20(hidden%20company%20specific%20url%20parts)%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Screenshot%202021-10-19%20201854.png%22%20style%3D%22width%3A%20688px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F318907iE83CCC5966053BF3%2Fimage-dimensions%2F688x697%3Fv%3Dv2%22%20width%3D%22688%22%20height%3D%22697%22%20role%3D%22button%22%20title%3D%22Screenshot%202021-10-19%20201854.png%22%20alt%3D%22Neutral%20resources%20(hidden%20company%20url)%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3ENeutral%20resources%20(hidden%20company%20url)%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20configuration%20works%20great%20for%20Downloads%2C%20but%20doesn't%20trigger%20on%20opening%20Outlook%20attachments.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAfter%20a%20lot%20of%20searching%2C%20I've%20found%20the%20Microsoft%20Word%20Trust%20Center%20and%20the%20tick%20for%20Enable%20Application%20Guard%20for%20Outlook%20Attachments%20is%20off%20(and%20greyed%20out).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Screenshot%202021-10-20%20152549.png%22%20style%3D%22width%3A%20824px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F318908i99036AE83B452C33%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Screenshot%202021-10-20%20152549.png%22%20alt%3D%22Enable%20Application%20Guard%20for%20Outlook%20Attachments%20greyed%20out%22%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-caption%22%20onclick%3D%22event.preventDefault()%3B%22%3EEnable%20Application%20Guard%20for%20Outlook%20Attachments%20greyed%20out%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHow%20can%20I%20make%20sure%20this%20will%20be%20turned%20on%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERelated%20question%202%3A%20Is%20it%20possible%20that%20this%20is%20because%20I%20have%20Safe%20documents%20on%3F%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Screenshot%202021-10-21%20111435.png%22%20style%3D%22width%3A%20609px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F318915i28F6804C5A4E04E7%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Screenshot%202021-10-21%20111435.png%22%20alt%3D%22Screenshot%202021-10-21%20111435.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2956566%22%20slang%3D%22en-US%22%3ERe%3A%20WDAG%20-%20Microsoft%20Defender%20Application%20Guard%20for%20Office%20-%20No%20Attachment%20protection%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2956566%22%20slang%3D%22en-US%22%3EFinally%20Found%20it%3A%3CBR%20%2F%3EWe%20had%20an%20old%20Group%20Policy%20converted%20to%20Intune%20with%20this%20setting%3A%3CBR%20%2F%3E%3CBR%20%2F%3E%22Turn%20off%20Protected%20View%20for%20attachments%20opened%20from%20Outlook%22%3CBR%20%2F%3E%3CBR%20%2F%3EAs%20soon%20as%20I%20disabled%20it%2C%20WDAG%20for%20Office%20started%20to%20work%20for%20Outlook%20attachments!%3C%2FLINGO-BODY%3E
Contributor

After trying on Reddit, Let's try to find an answers here. 

 

I've enabled Microsoft Defender Application Guard for Office for a few test devices/users in our organisation.

 

I've used Microsoft Endpoint Manager / Endpoint Security for this:

Enable MDAG for Office (not for Edge)Enable MDAG for Office (not for Edge)Add the network Rules (hidden company specific url parts)Add the network Rules (hidden company specific url parts)Neutral resources (hidden company url)Neutral resources (hidden company url)

 

This configuration works great for Downloads, but doesn't trigger on opening Outlook attachments.

 

After a lot of searching, I've found the Microsoft Word Trust Center and the tick for Enable Application Guard for Outlook Attachments is off (and greyed out).

 

Enable Application Guard for Outlook Attachments greyed outEnable Application Guard for Outlook Attachments greyed out

 

How can I make sure this will be turned on?

 

Related question 2: Is it possible that this is because I have Safe documents on?

Screenshot 2021-10-21 111435.png

 

 

 

1 Reply
Finally Found it:
We had an old Group Policy converted to Intune with this setting:

"Turn off Protected View for attachments opened from Outlook"

As soon as I disabled it, WDAG for Office started to work for Outlook attachments!