Windows Information Protection device policy
Windows Information Protection (WIP), previously known as enterprise data protection (EDP), is a Windows technology that protects against the potential leakage of enterprise data. Data leakage can occur through sharing of enterprise data to non-enterprise protected apps, between apps, or outside of the organization network. For more information, seeProtect your enterprise data using Windows Information Protection (WIP).
You can create a device policy in XenMobile to specify the apps that require Windows Information Protection at the enforcement level you set. The Windows Information Protection policy is for supervised Tablet and Desktop running Windows 10 or Windows 11.
XenMobile includes some common apps and you can add others. You specify for the policy an enforcement level that affects the user experience. For example, you can:
Block any inappropriate data sharing.
Warn about inappropriate data sharing and allow users to override the policy.
Run WIP silently while logging and permitting inappropriate data sharing.
To exclude apps from Windows Information Protection, define the apps in Microsoft AppLocker XML files and then import those files into XenMobile.
To add or configure this policy, go toConfigure > Device Policies. For more information, seeDevice policies.
Windows 10 and Windows 11 settings
Desktop App(Windows 10 or Windows 11 Desktop),Store App(Windows 10 or Windows 11 Tablet): XenMobile includes some common apps, as shown in the sample above. You can edit or remove those apps as needed.
To add other apps: In theDesktop ApporStore Apptable, clickAddand provide the app information.
Allowedapps can read, create, and update enterprise data.Deniedapps can’t access enterprise data.Exemptapps can read enterprise data but can’t create or modify the data.
AppLocker XML:Microsoft provides a list of Microsoft apps that have known compatibility issues with WIP. To exclude those apps from WIP, clickBrowseto upload the list. XenMobile combines the uploaded AppLocker XML and the configured desktop and store apps in the policy sent to the device. For more information, seeRecommended blocklist for Windows Information Protection.
Enforcement level:Select an option to specify how you want Windows Information Protection to protect and manage data sharing. Defaults toOff.
0-Off:WIP is off and doesn’t protect or audit your data.
1-Silent:WIP runs silently, logs inappropriate data sharing, and doesn’t block anything. You can access logs throughReporting CSP.
2-Override:WIP warns users about potentially unsafe data sharing. Users can override warnings and share the data. This mode logs actions, including user overrides, to your audit log.
3-Block:WIP prevents users from completing potentially unsafe data sharing.
-
Protected domain names:The domains that your enterprise uses for its user identities. This list of managed identity domains, along with the primary domain, make up the identity of your managing enterprise. The first domain in the list is the primary corporate identity used in the Windows UI. Use “ ” to separate list items. For example: domain1.com | domain2.com
Data recovery certificate:ClickBrowseand then select a recovery certificate to use for data recovery of encrypted files. This certificate is the same as the data recovery agent (DRA) certificate for the encrypting file system (EFS), only delivered through MDM instead of Group Policy. If a recovery certificate isn’t available, create it. For information, see “Create a data recovery certificate” in this section.
Network domain names:A list of domains that comprise the boundaries of the enterprise. WIP protects all traffic to the fully qualified domains in this list. This setting, with theIP rangesetting, detects whether a network endpoint is enterprise or personal on private networks. Use a comma to separate list items. For example: corp.example.com,region.example.com
IP range:A list of the enterprise IPv4 and IPv6 ranges that define the computers in the enterprise network. WIP considers these locations as a safe destination for enterprise data sharing. Use commas to separate list items. For example:
10.0.0.0-10.255.255.255,2001:4898::-2001:4898:7fff:ffff:ffff:ffff:ffff:ffff
IP ranges list is authoritative:To prevent auto-detection of IP ranges by Windows, change this setting toOn. Defaults toOff.
Proxy servers:A list of the proxy servers that the enterprise can use for corporate resources. This setting is required if you use a proxy in your network. Without a proxy server, enterprise resources might be unavailable when a client is behind a proxy. For example, resources might be unavailable from certain WiFi hotspots at hotels and restaurants. Use commas to separate list items. For example:
proxy.example.com:80;157.54.11.118:443
内部代理servers:一个代理服务器列表,你的设备through to reach your cloud resources. Using this server type indicates that the cloud resources you’re connecting to are enterprise resources. Don’t include in this list any of the servers in theProxy serverssetting, which are used for non-WIP-protected traffic. Use commas to separate list items. For example:
example.internalproxy1.com;10.147.80.50
Cloud resources:A list of cloud resources protected by WIP. For each cloud resource, you can also optionally specify a proxy server in theProxy serverslist to route traffic for this cloud resource. All traffic routed through theProxy serversis treated as enterprise traffic. Use commas to separate list items. For example:
domain1.com:InternalProxy.domain1.com,domain2.com:InternalProxy.domain2.com
Revoke WIP certificate on unenroll:Specifies whether to revoke local encryption keys from a user device when it’s unenrolled from Windows Information Protection. After the encryption keys are revoked, a user can’t access encrypted corporate data. IfOff, the keys aren’t revoked and the user continues to have access to protected files after unenrollment. Defaults toOn.
- Show overlay icons:Specifies whether to include the Windows Information Protection icon overlay on corporate files in Explorer and enterprise only app tiles in the Start menu. Defaults toOff.
Create a data recovery certificate
A data recover certificate is required to enable theWindows Information Protectionpolicy.
On the machine where the XenMobile console is running, open a command prompt and navigate to a folder (other than Windows\System32) where you want to create a certificate.
Run this command:
cipher /r:ESFDRA
When prompted, enter a password to protect the private key file.
密码命令创建一个c和.pfx文件。
In the XenMobile console, go toSettings > Certificatesand import the .cer file, which applies to Windows 10 and Windows 11 tablets.
User experience
When Windows Information Protection is in effect, apps and files include an icon:
If a user copies or saves a protected file to a non-protected location, the following notification appears, depending on the enforcement level configured.