Configure and apply data loss prevention (DLP) application policies to the Office 365 applications and data in the Workspace ONE UEM console. Workspace ONE UEM does not directly enforce policies on applications. The Microsoft SDK controls and enforces the policies.
- Current Setting – Select whether to Inherit or Override the displayed settings. Inherit means use the settings of the current organization group's parent OG, while Override enables the settings for editing so you can modify the current OG's settings directly.
Data Loss Prevention
Configure DLP app policies for your managed Office 365 applications and data. Find these configurations in the UEM console at Groups & Settings > All Settings > Apps > Office 365 Settings.
Setting | Description |
---|---|
Data Relocation | |
Prevent Backup | Prevents users from backing up data from their managed applications. |
Allow Apps to Transfer Data to Other Apps |
|
Allow Apps to Receive Data from Other Apps |
|
Prevent Save As | Prevents users from saving managed Office 365 application data to another storage system or area. |
Restrict Cut Copy Paste with Other Apps |
|
Restrict Web Content to Display in Managed Browser | Forces links in managed applications to open in a managed browser. |
Encrypt App Data | Encrypts data pertaining to managed applications when the device is in the selected state. The system encrypts data stored anywhere, including external storage drives and SIM cards. |
Disable Contents Sync | Prevents managed applications fromsaving contacts to the native address book. |
Disable Printing | Prevents users from printing data associated with managed applications. |
Allowed Data Storage Locations | Enables admins to control where users can store managed application data. |
Access | |
Require PIN for Access | Requires users to enter a PIN to access managed applications. Users create the PIN upon initial access. |
Number of Attempts before PIN Reset | Sets the number of entries users attempt before the system resets the PIN. |
Allow Simple PIN | Allows users to create four digit PINs with repeating characters. |
PIN Length | Sets the number of characters users must set for their PINs. |
Allowed PIN Characters | Sets the characters that users must configure for their PINs. |
Allow Fingerprint Instead of PIN | Enables users to access managed applications with their fingerprints rather than PINs. |
Require Corporate Credentials For Access | Requires user to access managed applications with their enterprise credentials. |
Block Managed Apps from Running on Jailbroken or Rooted Devices | Prevents users from accessing managed applications on compromised devices. |
Recheck The Access Requirements After (minutes) | Sets the system to check the access PIN, fingerprint, or credential information when the access session reaches one of the time interval options.
|
Offline Interval (days) before App Data is Wiped | Sets the system to remove managed application data from devices when devices are offline for a set number of days. |
Block Screen Capture and Android Assistant | Prevents users from taking screen shots on their devices when they access managed applications. |
iOS | |
Minimum Operating System version required | Enter the required minimum iOS version number that a user must have to gain secure access to the application. |
Minimum Operating System version required (Warning alert only) | Enter the recommended minimum iOS version number that a user must have to gain secure access to the application. |
Minimum App version required | Enter the required minimum App version number that a user must have to gain secure access to the application. |
Minimum App version required (Warning alert only) | Enter the recommended minimum App version number that a user must have to gain secure access to the application. |
Minimum App protection policy SDK version required | Enter the minimum Intune Application Protection Policy SDK version that a user must have to gain secure access to the application. |
Android | |
Block Screen Capture and Android Assistant | If Yes is selected, screen captures and Android Assistant app scanning will be unavailable when using an Office app. |
Minimum Operating System version required | Enter the required minimum Android OS version number that a user must have to gain secure access to the app. |
Minimum Operating System version required (Warning alert only) | Enter the recommended minimum Android OS version number that a user must have to gain secure access to the app. |
Minimum App version required | Enter the required minimum App version number that a user must have to gain secure access to the app. |
Minimum App version required (Warning alert only) | Enter the recommended minimum App version number that a user must have to gain secure access to the app. |
Minimum Android patch version required | Enter the oldest required Android security patch level a user can have to gain secure access to the app. |
Minimum Android patch version required (Warning alert only) | Enter the oldest recommended Android security patch level a user can have to gain secure access to the app. |
The warning alters for the Operating System version, App version, and the Android Patch version only notifies the user with a warning message. However, the warning alters do not stop the end users from using the app.
Assigned Groups
Assign the DLP app policies to security groups.
Setting | Description |
---|---|
All Security Groups | Enter the name of the security group to assign it to the DLP app policies. Select from the list the system displays after an entry. Select Add Group to assign the DLP app policies to the security group. |
Security Groups Assigned to Office 365 Policies | Lists the security groups assigned to the DPL app policies. Select Remove Group to remove the assignment from the security group. |
Authentication
Office 365 data loss prevention application policies allow administrators to configure policies to protect Office 365 apps and data using Microsoft Graph APIs. To configure Office 365 DLP policies, you need admin credentials to connect your tenant to Workspace ONE UEM.
Setting | Description |
---|---|
User name | Enter the user name to configure your tenant to Workspace ONE UEM. |
Password | Enter the password that is used to configure your tenant to Workspace ONE UEM. |