The last couple of weeks I did blog posts about the configuration and the end-user experience of Windows 10 and MAM-WE. One of the most common questions I received was, “what about the Office desktops apps?”. In this blog post I’ll provide the steps to get the required information about the Office desktop apps, for usage within MAM-WE app policies (or any other WIP-related policies). I’ll also show how to use that information in the MAM-WE app policy and I’ll show the end-user experience. Including some of the current challenges with the end-user experience.
Important: Keep in mind that the Office desktop apps are not yet mentioned on the list of enlightened Microsoft apps for use with WIP (see this article). That could mean that the apps might behave different than expected. As my end-user experience section will show, make sure to test carefully before implementing.
Get Office desktop information
Lets start by getting the required information about the Office desktop apps. These methods are the same for every desktop app that must be configured with any WIP-related policy. There are two methods available, the first method is using the Get-AppLockerFileInformation cmdlet, and the second method is using the Local Security Policy editor to create an AppLocker configuration XML file. I’ll use the PowerShell method in this post. Simply using the mentioned cmdlet, as shown below, provides the information that is needed for adding desktop apps to the MAM-WE app policy,
(Get-AppLockerFileInformation -Path “C:\Program Files\Microsoft Office\root\Office16\excel.exe”).Publisher
For the most common Office desktop apps, version 1609, this results in the following information.
| PublisherName | ProductName | BinaryName | BinaryVersion |
| O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US | MICROSOFT OFFICE 2016 | EXCEL.EXE | 16.0.7369.2130 |
| O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US | MICROSOFT OFFICE 2016 | OUTLOOK.EXE | 16.0.7369.2130 |
| O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US | MICROSOFT OFFICE 2016 | POWERPNT.EXE | 16.0.7369.2130 |
| O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US | MICROSOFT OFFICE 2016 | WINWORD.EXE | 16.0.7369.2130 |
Add Office desktop information
The next step is to add the Office desktop app information, to the MAM-WE app policy. For the step-by-step activities, please refer to my post about configuring MAM-WE app policies for Windows 10. Here I’ll only show the required actions for adding the Office desktop app information to a MAM-WE app policy. The following steps go through adding the Office desktop apps to an existing Windows 10 MAM-WE app policy.
| 1 | Open the Azure portal and navigate to Intune mobile application management; |
| 2 | Select App policy to open the App policy blade; |
| 3 | On the App policy blade, select the [Windows 10 MAM-WE app policy] to open the [Windows 10 MAM-WE app policy] blade; |
| 4 | On the [Windows 10 MAM-WE app policy] blade, select Allowed apps to open the Allowed apps blade; |
| 5 |
On the Allowed apps blade, click Add apps to open the Add apps blade. On the Add apps blade, select Desktop apps. On the Desktop apps blade, provide the following information and click OK to return to the Allowed apps blade.
|
| 6 |
Back on the Allowed apps blade, click Save to save the adjustments. Note: At this moment the Allowed apps blade will show the same NAME as the PRODUCT NAME for manually added apps. |
End-user experience
Now let’s end this post by having a look at the end-user experience. I’ll show the end-user experience by opening a work document. The first action is to open a work document via Word Online. Once opened I’ll select Edit Document > Edit in Word. This provides me with the question “How do you want to open this?”, as shown below on the left. It doesn’t mention that Word 2016 opens work and personal files, but I can open the document with Word 2016. Once opened, I’m still able to copy content to non-managed apps. When I choose Word Mobile, I’m not able to copy content to non-managed apps.
The second action is to download a work document from SharePoint Online. Once downloaded I select Open with. This provides me with the question “How do you want to open this work file?”, as shown below on the right. It correctly shows that Word 2016 opens work and personal files. However, again I’m still able to copy content to non-managed apps. When I choose Word Mobile, I’m not able to copy content to non-managed apps.
 |
 |
This clearly shows that this configuration enables the end-user to use Office desktop apps for work data. However, at this moment, it also clearly shows that it provides the end-user with more options on work data than the company might like.
More information
For more information about enlightened apps and Microsoft apps, please refer to:
- List of enlightened Microsoft apps for use with Windows Information Protection (WIP): https://docs.microsoft.com/en-us/windows/threat-protection/windows-information-protection/enlightened-microsoft-apps-and-wip
- Unenlightened and enlightened app behavior while using Windows Information Protection (WIP): https://docs.microsoft.com/en-us/windows/threat-protection/windows-information-protection/app-behavior-with-wip