Windows Information Protection (WIP) App Protection Policies: Protected and Exempt; Denied and Allowed - What Do They Mean?

Thu, 14 May 2020 21:05:30 +0000

One of things that strikes me as vague in Windows Information Protection (WIP) policies in Intune is configuring targeted apps: what’s the exact difference between a protected app and an exempt app; and what does allow or deny exactly do for both of those?

A recap on some terminology before explaining what-does-what.

Targeted apps are ones the WIP service will implement controls over.
Unenlightened apps cannot differentiate between work and personal data. They have no idea what WIP is as the developer has not incorporated it. They can only implement controls if the device is MDM enrolled.
Enlightened apps have incorporated WIP into the design and can differentiate between work and personal data. For example, Outlook knows if the email account is tenant one or not. They can implement controls even if it’s just using MAM. Such a scenario is called WIP Without Enrollment or WIP-WE.
Enterprise context is the ownership of data in the application. You can review this by adding the column in Task Manager. Data will either belong to the tenant (work) or personal (not work). It can also be exempt, which means waived from rules.

In the example below, every app you see - protected and exempt - will be controlled if an MDM scenario, but only enlightened ones can be in a MAM scenario.

Windows-Information-Protection on Ru Campbell MVP

Windows Information Protection (WIP) App Protection Policies: Protected and Exempt; Denied and Allowed - What Do They Mean?