Unable to open some applications when Windows Information Protection is enabled

Joshua Walsh 1 Reputation point
2020-08-18T23:00:21.23+00:00

I'm testing out Windows Information Protection. I'm running into some issues with it.

My "Targeted Apps" list includes:

  • Office 365 ProPlus
  • Edge
  • IE11
  • Chrome
  • OneDrive Sync Client
  • Teams
  • Azure Information Protection
  • Company Portal

My network boundary includes all the suggested items here.

The protection mode is set to "Silent". It's my understanding that Silent should not block anything, so it should be suitable for trying things out with minimal user impact.

After assigning the policy to my test group, I noticed a few strange things. While files on SMB network shares have their "File ownership" correctly appear as the configured corporate identity, files synchronised via OneDrive Sync do not have their file ownership set, they are treated as Personal. This is surprising, as from what I can see online they should be using the coprorate identity.

If I try to copy a file from a network drive to any local location I get a message saying "Do you want to copy this file without encryption? You are copying the file to a destination that does not support encryption." If I click Yes, it appears to copy the file (the progress bar fills up normally and it takes longer for larger files) but afterwards the file can't be found at the destination.

Another strange thing I noticed is that Google Chrome can no longer save files in to the Documents or Downloads directories. Whenever I try it says:

C:\Users\testuser\OneDrive - CONTOSO PTY LTD\Documents\testpage.html  
You don't have permission to save in this location.  
Contact the administrator to obtain permission.  
  
Would you like to save in the Documents folder instead?  

(Clicking Yes doesn't do anything, since it's already trying to save in the documents folder)

Even worse, after I restarted my test computer, many applications failed to open. Google Chrome won't launch, Teams won't launch. There's no error message and I can't see anything in Event Viewer.

Personal apps still work fine. Strangely enough, Outlook also works fine, even though Task Manager confirms that its enterprise context is the corporate identity.

Unassigning the policy allows applications to be launched normally again.

As an aside, I initially failed to include /*AppCompat*/ in my network boundary. Everything I've read online suggests that this may prevent some "unenlightened" apps from being able to connect to TLS-secured servers directly by IP address, but for me it actually prevented all apps from connecting to the internet at all. Including some apps that I'd expect to be "enlightened" such as Outlook and Teams. Adding /*AppCompat*/ fixed this.

So, my questions are this:

  1. Why is "Silent" mode blocking access to things?
  2. Why are OneDrive synced locations treated as personal?
  3. Why can't I store corporate files (from targeted apps or network drives) locally?
  4. Why are many targeted apps not able to launch? (Probably same reason as #3, I suspect they aren't allowed to access required files)

Thanks!

Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
4,656 questions
{count} votes