Allow Copy paste only within Office365 in Browser

%3CLINGO-SUB%20id%3D%22lingo-sub-1812038%22%20slang%3D%22en-US%22%3EAllow%20Copy%20paste%20only%20within%20Office365%20in%20Browser%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1812038%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20all%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20have%20a%20session%20policy%20in%20place%20to%20Block%20Copy%20and%20paste%20in%20a%20Browser%20session%2C%20but%20we%20would%20like%20to%20allow%20Copy%20and%20paste%20within%20Office%20365%20documents%20in%20the%20browser%20but%20Block%20outside%20of%20office%20365%20and%20non%20browser%20apps.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20played%20around%20with%20the%20settings%20but%20can't%20find%20the%20right%20set%20of%20settings.%20Anyone%20has%20any%20experience%20with%20this%3F%20Putting%20it%20to%3A%3CBR%20%2F%3EActivity%3A%20Paste%3CBR%20%2F%3EApp%20Does%20not%20Equal%20Office%20365%26nbsp%3B%3C%2FP%3E%3CP%3E%3CBR%20%2F%3EDoes%20not%20work.%3CBR%20%2F%3E%3CBR%20%2F%3ECheers%2C%3C%2FP%3E%3CP%3EHans%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1812038%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECloud%20App%20Security%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1814164%22%20slang%3D%22en-US%22%3ERe%3A%20Allow%20Copy%20paste%20only%20within%20Office365%20in%20Browser%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1814164%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F597702%22%20target%3D%22_blank%22%3E%40Hansm_NL%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EHi!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20you%20say%20it%20isn't%20working%2C%20do%20you%20mean%20that%20MCAS%20is%20still%20blocking%20copy%2Fpaste%20for%20Office%20365%3F%20Or%2C%20that%20MCAS%20is%20NOT%20blocking%20copy%2Fpaste%20for%20non%20Office%20365%20apps%20configured%20for%20conditional%20access%20app%20controls%20(CAAC)%3F%20Which%20other%20apps%20do%20you%20have%20configured%20for%20CAAC%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20my%20test%20case%2C%20I%20was%20able%20to%20get%20MCAS%20to%20block%20copy%2Fpaste%20for%20GitHub%20and%20not%20block%20for%20Office%20365%20using%20the%20configuration%20below.%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Sarahzin_0-1603493902773.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F228957iDF68A5D8F18320C3%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Sarahzin_0-1603493902773.png%22%20alt%3D%22Sarahzin_0-1603493902773.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Sarahzin_1-1603494010242.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F228958iB2469E80CB9D1757%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Sarahzin_1-1603494010242.png%22%20alt%3D%22Sarahzin_1-1603494010242.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EPlease%20let%20me%20know!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThank%20you!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESarahzin%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1814910%22%20slang%3D%22en-US%22%3ERe%3A%20Allow%20Copy%20paste%20only%20within%20Office365%20in%20Browser%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1814910%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F708110%22%20target%3D%22_blank%22%3E%40Sarahzin%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%20Sarahzin%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ethank%20you%20for%20looking%20into%20this%2C%26nbsp%3B%20With%20these%20settings%20i%20am%20able%20to%20copy%2Fpaste%20the%20contents%20of%20files%20located%20in%20sharepoint%20to%20anyplace%20outside%20of%20office365%20including%20desktop%20apps%2C%20etc.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20to%20me%20it%20seems%20the%20only%20way%20to%20protect%20the%20contents%20is%20to%20not%20allow%20copy%20at%20all.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

Hi all,

 

We have a session policy in place to Block Copy and paste in a Browser session, but we would like to allow Copy and paste within Office 365 documents in the browser but Block outside of office 365 and non browser apps.

 

I played around with the settings but can't find the right set of settings. Anyone has any experience with this? Putting it to:
Activity: Paste
App Does not Equal Office 365 


Does not work.

Cheers,

Hans

3 Replies
Highlighted

@Hansm_NL 

 

Hi!

 

When you say it isn't working, do you mean that MCAS is still blocking copy/paste for Office 365? Or, that MCAS is NOT blocking copy/paste for non Office 365 apps configured for conditional access app controls (CAAC)? Which other apps do you have configured for CAAC?

 

In my test case, I was able to get MCAS to block copy/paste for GitHub and not block for Office 365 using the configuration below.

Sarahzin_0-1603493902773.png

 

Sarahzin_1-1603494010242.png

 

Please let me know!

 

Thank you!

 

Sarahzin

Highlighted

@Sarahzin 

 

Hi Sarahzin,

 

thank you for looking into this,  With these settings i am able to copy/paste the contents of files located in sharepoint to anyplace outside of office365 including desktop apps, etc.

 

So to me it seems the only way to protect the contents is to not allow copy at all.

 

Highlighted
Hi @Hansm_NL,

Gotcha. If I’m understanding correctly, you don’t want the info to go from browser to 365 thick client versions, right? If that is the case, yes. Copy/Paste would need to be blocked for for Office 365. We also have a non-MCAS capability in preview, endpoint DLP, which might be something that would also help. Please let me know!