SOLVED

Prevent users from making copies of SharePoint/OneDrive data that was downloaded via sync app

%3CLINGO-SUB%20id%3D%22lingo-sub-154435%22%20slang%3D%22en-US%22%3EPrevent%20users%20from%20making%20copies%20of%20SharePoint%2FOneDrive%20data%20that%20was%20downloaded%20via%20sync%20app%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-154435%22%20slang%3D%22en-US%22%3E%3CP%20style%3D%22margin%3A%200px%3B%20color%3A%20rgb(51%2C%2051%2C%2051)%3B%20text-transform%3A%20none%3B%20line-height%3A%201.7142%3B%20text-indent%3A%200px%3B%20letter-spacing%3A%20normal%3B%20font-family%3A%20SegoeUI%2C%20Lato%2C%20%26quot%3BHelvetica%20Neue%26quot%3B%2C%20Helvetica%2C%20Arial%2C%20sans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-weight%3A%20300%3B%20word-spacing%3A%200px%3B%20white-space%3A%20normal%3B%20box-sizing%3A%20border-box%3B%20orphans%3A%202%3B%20widows%3A%202%3B%20font-variant-ligatures%3A%20normal%3B%20font-variant-caps%3A%20normal%3B%20-webkit-text-stroke-width%3A%200px%3B%20text-decoration-style%3A%20initial%3B%20text-decoration-color%3A%20initial%3B%22%3EWe%20have%20a%20client%20who%20is%20planning%20to%20roll%20out%20OneDrive%20for%20Business%20and%20SharePoint.%20The%20goal%20is%20to%20allow%20users%20to%20synchronize%20%5BSharePoint%2FOneDrive%5D%20libraries%20on%20their%20laptops%2C%20using%20the%20sync%20app.%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200px%3B%20color%3A%20rgb(51%2C%2051%2C%2051)%3B%20text-transform%3A%20none%3B%20line-height%3A%201.7142%3B%20text-indent%3A%200px%3B%20letter-spacing%3A%20normal%3B%20font-family%3A%20SegoeUI%2C%20Lato%2C%20%26quot%3BHelvetica%20Neue%26quot%3B%2C%20Helvetica%2C%20Arial%2C%20sans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-weight%3A%20300%3B%20word-spacing%3A%200px%3B%20white-space%3A%20normal%3B%20box-sizing%3A%20border-box%3B%20orphans%3A%202%3B%20widows%3A%202%3B%20font-variant-ligatures%3A%20normal%3B%20font-variant-caps%3A%20normal%3B%20-webkit-text-stroke-width%3A%200px%3B%20text-decoration-style%3A%20initial%3B%20text-decoration-color%3A%20initial%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200px%3B%20color%3A%20rgb(51%2C%2051%2C%2051)%3B%20text-transform%3A%20none%3B%20line-height%3A%201.7142%3B%20text-indent%3A%200px%3B%20letter-spacing%3A%20normal%3B%20font-family%3A%20SegoeUI%2C%20Lato%2C%20%26quot%3BHelvetica%20Neue%26quot%3B%2C%20Helvetica%2C%20Arial%2C%20sans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-weight%3A%20300%3B%20word-spacing%3A%200px%3B%20white-space%3A%20normal%3B%20box-sizing%3A%20border-box%3B%20orphans%3A%202%3B%20widows%3A%202%3B%20font-variant-ligatures%3A%20normal%3B%20font-variant-caps%3A%20normal%3B%20-webkit-text-stroke-width%3A%200px%3B%20text-decoration-style%3A%20initial%3B%20text-decoration-color%3A%20initial%3B%22%3EWe%20already%20put%20in%20place%20policies%20to%20prevent%20users%20from%20syncing%20from%20non-domain-joined%20computers%2C%20and%20their%20hard%20drives%20are%20also%20encrypted%20(in%20case%20a%20laptop%20is%20stolen).%20We%20know%20you%20can%20limit%20actions%20on%20data%20in%20the%20portal%2C%20such%20as%20copying%2C%20forwarding%2C%20saving-as%2C%20downloading%2C%20etc.%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200px%3B%20color%3A%20rgb(51%2C%2051%2C%2051)%3B%20text-transform%3A%20none%3B%20line-height%3A%201.7142%3B%20text-indent%3A%200px%3B%20letter-spacing%3A%20normal%3B%20font-family%3A%20SegoeUI%2C%20Lato%2C%20%26quot%3BHelvetica%20Neue%26quot%3B%2C%20Helvetica%2C%20Arial%2C%20sans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-weight%3A%20300%3B%20word-spacing%3A%200px%3B%20white-space%3A%20normal%3B%20box-sizing%3A%20border-box%3B%20orphans%3A%202%3B%20widows%3A%202%3B%20font-variant-ligatures%3A%20normal%3B%20font-variant-caps%3A%20normal%3B%20-webkit-text-stroke-width%3A%200px%3B%20text-decoration-style%3A%20initial%3B%20text-decoration-color%3A%20initial%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200px%3B%20color%3A%20rgb(51%2C%2051%2C%2051)%3B%20text-transform%3A%20none%3B%20line-height%3A%201.7142%3B%20text-indent%3A%200px%3B%20letter-spacing%3A%20normal%3B%20font-family%3A%20SegoeUI%2C%20Lato%2C%20%26quot%3BHelvetica%20Neue%26quot%3B%2C%20Helvetica%2C%20Arial%2C%20sans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-weight%3A%20300%3B%20word-spacing%3A%200px%3B%20white-space%3A%20normal%3B%20box-sizing%3A%20border-box%3B%20orphans%3A%202%3B%20widows%3A%202%3B%20font-variant-ligatures%3A%20normal%3B%20font-variant-caps%3A%20normal%3B%20-webkit-text-stroke-width%3A%200px%3B%20text-decoration-style%3A%20initial%3B%20text-decoration-color%3A%20initial%3B%22%3EThe%20main%20concern%2C%20however%2C%20is%20how%20do%20we%20prevent%20users%20from%20making%20copies%20of%20the%20files%20that%20will%20reside%20in%20their%20laptops%20once%20the%20libraries%20have%20been%20synced%20on%20their%20laptops.%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200px%3B%20color%3A%20rgb(51%2C%2051%2C%2051)%3B%20text-transform%3A%20none%3B%20line-height%3A%201.7142%3B%20text-indent%3A%200px%3B%20letter-spacing%3A%20normal%3B%20font-family%3A%20SegoeUI%2C%20Lato%2C%20%26quot%3BHelvetica%20Neue%26quot%3B%2C%20Helvetica%2C%20Arial%2C%20sans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-weight%3A%20300%3B%20word-spacing%3A%200px%3B%20white-space%3A%20normal%3B%20box-sizing%3A%20border-box%3B%20orphans%3A%202%3B%20widows%3A%202%3B%20font-variant-ligatures%3A%20normal%3B%20font-variant-caps%3A%20normal%3B%20-webkit-text-stroke-width%3A%200px%3B%20text-decoration-style%3A%20initial%3B%20text-decoration-color%3A%20initial%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22margin%3A%200px%3B%20color%3A%20rgb(51%2C%2051%2C%2051)%3B%20text-transform%3A%20none%3B%20line-height%3A%201.7142%3B%20text-indent%3A%200px%3B%20letter-spacing%3A%20normal%3B%20font-family%3A%20SegoeUI%2C%20Lato%2C%20%26quot%3BHelvetica%20Neue%26quot%3B%2C%20Helvetica%2C%20Arial%2C%20sans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-weight%3A%20300%3B%20word-spacing%3A%200px%3B%20white-space%3A%20normal%3B%20box-sizing%3A%20border-box%3B%20orphans%3A%202%3B%20widows%3A%202%3B%20font-variant-ligatures%3A%20normal%3B%20font-variant-caps%3A%20normal%3B%20-webkit-text-stroke-width%3A%200px%3B%20text-decoration-style%3A%20initial%3B%20text-decoration-color%3A%20initial%3B%22%3EThe%20focus%20of%20this%20post%20is%20not%20on%20an%20outside%20attacker%2C%20but%20rather%20on%20the%20employee%20itself.%20For%20instance%2C%20a%20user%20may%20not%20necessarily%20need%20to%20get%20fired%20to%20be%20disgruntled%20and%20make%20copies%20of%20the%20data%20before%20departing%2C%20s%2Fhe%20may%20make%20a%20copy%20of%20the%20data%20anytime%20prior%20to%20the%20termination.%20How%20do%20we%20prevent%20this%3F%20or%20is%20it%20even%20possible%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-154435%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EOffice%20365%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-310072%22%20slang%3D%22en-US%22%3ERe%3A%20Prevent%20users%20from%20making%20copies%20of%20SharePoint%2FOneDrive%20data%20that%20was%20downloaded%20via%20sync%20app%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-310072%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Marcelo%2C%20we%20are%20looking%20for%20similar%20capabilities.%20Could%20you%20please%20let%20know%20if%20this%20served%20your%20needs%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-155269%22%20slang%3D%22en-US%22%3ERe%3A%20Prevent%20users%20from%20making%20copies%20of%20SharePoint%2FOneDrive%20data%20that%20was%20downloaded%20via%20sync%20app%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-155269%22%20slang%3D%22en-US%22%3EThat's%20correct%2C%20IRM%20won't%20prevent%20users%20with%20the%20proper%20permissions%20from%20taking%20the%20data%20somewhere%20else.%3CBR%20%2F%3ETake%20a%20look%20at%20the%20links%20I%20pasted%20about%20Windows%20Information%20Protection%20working%20with%20Intune%20or%20System%20Center%20policies.%20I%20think%20that's%20what%20you%20need.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-155263%22%20slang%3D%22en-US%22%3ERe%3A%20Prevent%20users%20from%20making%20copies%20of%20SharePoint%2FOneDrive%20data%20that%20was%20downloaded%20via%20sync%20app%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-155263%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20the%20feedback%20and%20the%20contribution%2C%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F9466%22%20target%3D%22_blank%22%3E%40Salvatore%20Biscari%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20clarify%20the%20goal%3A%20the%20goal%20is%20to%20to%20prevent%20employees%20from%20making%20copies%20of%20the%20data%3B%20not%20necessarily%20when%20an%20employee%20termination%20takes%20place%2C%20but%20at%20any%20time.%20Revoking%20access%20is%20the%20easy%20part%2C%20the%20hard%20part%20is%20to%20provide%20access%20to%20the%20data%2C%20without%20allowing%20the%20data%20to%20be%20copied.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-155256%22%20slang%3D%22en-US%22%3ERe%3A%20Prevent%20users%20from%20making%20copies%20of%20SharePoint%2FOneDrive%20data%20that%20was%20downloaded%20via%20sync%20app%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-155256%22%20slang%3D%22en-US%22%3E%3CP%3EThat's%20correct%2C%20Pablo.%20The%20goal%20is%20for%20users%20to%20work%20normally%20on%20their%20synced%20files%2C%20but%20prevent%20them%20from%20taking%20the%20data%20somewhere%20else%20by%20making%20copies%20of%20it.%20It's%20very%20hard%20to%20strike%20such%20balance%2C%20as%20users%20want%20to%20work%20with%20their%20data%20locally%2C%20but%20we%20don't%20want%20them%20to%20make%20copies%20of%20it.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ESo%2C%20even%20with%20Windows%2010%20%2B%20IRM%2C%20users%20will%20still%20be%20able%20to%20copy%20the%20data%20huh%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-154681%22%20slang%3D%22en-US%22%3ERe%3A%20Prevent%20users%20from%20making%20copies%20of%20SharePoint%2FOneDrive%20data%20that%20was%20downloaded%20via%20sync%20app%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-154681%22%20slang%3D%22en-US%22%3E%3CP%3EMy%20understanding%20is%20instead%20that%20he%20wants%20to%20revoke%20access%20after%20the%20firing%20of%20an%20employee%2C%20which%20is%20exactly%20what%20IRM%20allows...%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-154670%22%20slang%3D%22en-US%22%3ERe%3A%20Prevent%20users%20from%20making%20copies%20of%20SharePoint%2FOneDrive%20data%20that%20was%20downloaded%20via%20sync%20app%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-154670%22%20slang%3D%22en-US%22%3EI%20think%20they%20want%20users%20to%20work%20normally%20on%20their%20synced%20files%2C%20but%20prevent%20them%20from%20taking%20the%20data%20somewhere%20else.%20You%20cannot%20do%20that%20with%20IRM.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-154665%22%20slang%3D%22en-US%22%3ERe%3A%20Prevent%20users%20from%20making%20copies%20of%20SharePoint%2FOneDrive%20data%20that%20was%20downloaded%20via%20sync%20app%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-154665%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EIf%20necessary%2C%20access%20to%20IRM%20protected%20documents%20can%20be%20revoked%2C%20which%20is%20what%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F117291%22%20target%3D%22_blank%22%3E%40Marcelo%20Gonzalez%3C%2FA%3E%20needs%2C%20if%20I%20understand%20well...%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-154658%22%20slang%3D%22en-US%22%3ERe%3A%20Prevent%20users%20from%20making%20copies%20of%20SharePoint%2FOneDrive%20data%20that%20was%20downloaded%20via%20sync%20app%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-154658%22%20slang%3D%22en-US%22%3E%3CP%3EIRM%20can%20limit%20actions%20on%20downloaded%20files%20for%20users%20with%20Read%20Only%20permissions%2C%20but%20users%20with%20Edit%20or%20Full%20Control%20will%20be%20able%20to%20take%20the%20data%20wherever%20they%20want%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-154640%22%20slang%3D%22en-US%22%3ERe%3A%20Prevent%20users%20from%20making%20copies%20of%20SharePoint%2FOneDrive%20data%20that%20was%20downloaded%20via%20sync%20app%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-154640%22%20slang%3D%22en-US%22%3E%3CP%3EConsider%20using%20IRM.%3C%2FP%3E%0A%3CP%3EOneDrive%20sync%20on%20Windows%20now%20supports%20IRM%20protected%20SharePoint%20document%20libraries%3A%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FOneDrive-Blog%2FOneDrive-sync-on-Windows-now-supports-IRM-protected-SharePoint%2Fba-p%2F146796%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FOneDrive-Blog%2FOneDrive-sync-on-Windows-now-supports-IRM-protected-SharePoint%2Fba-p%2F146796%3C%2FA%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-154485%22%20slang%3D%22en-US%22%3ERe%3A%20Prevent%20users%20from%20making%20copies%20of%20SharePoint%2FOneDrive%20data%20that%20was%20downloaded%20via%20sync%20app%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-154485%22%20slang%3D%22en-US%22%3Eyou%20may%20want%20to%20take%20a%20look%20at%20Windows%20Information%20Protection%2C%20which%20is%20native%20in%20Windows%2010%20from%20release%201607%2C%20and%20takes%20policies%20defined%20in%20Intune%20or%20SCCM%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fwindowsitpro%2F2016%2F06%2F29%2Fintroducing-windows-information-protection%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fblogs.technet.microsoft.com%2Fwindowsitpro%2F2016%2F06%2F29%2Fintroducing-windows-information-protection%2F%3C%2FA%3E%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fblogs.technet.microsoft.com%2Fcbernier%2F2017%2F05%2F19%2Fwindows-information-protection-explained-windows-10-creators-update%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fblogs.technet.microsoft.com%2Fcbernier%2F2017%2F05%2F19%2Fwindows-information-protection-explained-windows-10-creators-update%2F%3C%2FA%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

We have a client who is planning to roll out OneDrive for Business and SharePoint. The goal is to allow users to synchronize [SharePoint/OneDrive] libraries on their laptops, using the sync app.

 

We already put in place policies to prevent users from syncing from non-domain-joined computers, and their hard drives are also encrypted (in case a laptop is stolen). We know you can limit actions on data in the portal, such as copying, forwarding, saving-as, downloading, etc.

 

The main concern, however, is how do we prevent users from making copies of the files that will reside in their laptops once the libraries have been synced on their laptops.

 

The focus of this post is not on an outside attacker, but rather on the employee itself. For instance, a user may not necessarily need to get fired to be disgruntled and make copies of the data before departing, s/he may make a copy of the data anytime prior to the termination. How do we prevent this? or is it even possible?

10 Replies
Highlighted
Best Response confirmed by Marcelo Gonzalez (New Contributor)
Highlighted
Highlighted

IRM can limit actions on downloaded files for users with Read Only permissions, but users with Edit or Full Control will be able to take the data wherever they want

Highlighted

If necessary, access to IRM protected documents can be revoked, which is what @Marcelo Gonzalez needs, if I understand well...

Highlighted
I think they want users to work normally on their synced files, but prevent them from taking the data somewhere else. You cannot do that with IRM.
Highlighted

My understanding is instead that he wants to revoke access after the firing of an employee, which is exactly what IRM allows...

Highlighted

That's correct, Pablo. The goal is for users to work normally on their synced files, but prevent them from taking the data somewhere else by making copies of it. It's very hard to strike such balance, as users want to work with their data locally, but we don't want them to make copies of it.

 

So, even with Windows 10 + IRM, users will still be able to copy the data huh?

Highlighted

Thanks for the feedback and the contribution, @Salvatore Biscari.

 

To clarify the goal: the goal is to to prevent employees from making copies of the data; not necessarily when an employee termination takes place, but at any time. Revoking access is the easy part, the hard part is to provide access to the data, without allowing the data to be copied.

Highlighted
That's correct, IRM won't prevent users with the proper permissions from taking the data somewhere else.
Take a look at the links I pasted about Windows Information Protection working with Intune or System Center policies. I think that's what you need.
Highlighted

Hi Marcelo, we are looking for similar capabilities. Could you please let know if this served your needs?