When registering a device, the BYOD end user gets a prompt asking “Allow organization to manage this device”. If unticked, it will register with Azure AD and allow terms of use to be accepted, but the WIP policy will not apply.

If the box is left ticked, it will work as intended.

I wonder if there is a way to force the tick box “Allow organization to manage device”?

Many thanks

Hi Adriano,

That`s a very good point. Used this in an environment where we didn`t use Autopilot.
But I assume when you exclude Microsoft Intune Enrollment in the CA policy as Cloud app, it should work.

Bryan,
Have not tested this with an AD joined device, but when the user tries to access Office 365 data the CA policy is applied and the Device is AAD Registered. So you end up in scenario 1 and 2 in a AD joined AAD registered device (like scenario 2). So you can consider it BYOD compared with my article 🙂

Thnx for the info Mario, but indeed the documentation describes it “design to prevent personal files from being unintenionally encrypted by unenlighted apps. Unenlighted apps that need to access work using MAM need to be re-compiled as LOB apps or managed by using MDM with device enrollment.” And MS Support confirms.

https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/limitations-with-wip

This is also usefull link: https://docs.microsoft.com/en-us/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure

That’s correct, wordpad isn’t listed as enlightened app.

Hi Mario,
Good to read. Could you share with me where you found this info: Only enlightened apps can be managed without device Enrollment.
I`m able to allow Wordpad to access corporate data (only since today, in the weekend got an access denied). As far as I know that is not an enlightened app even it is an Microsoft app.

Hi Peter,
i have an update. On monday thinks started to work as expected. Chrome works in enterprise context and is protected app. I noticed that some icons on Intune portal are changed, so maybe Microsoft pushed updates during weekend. Also, i changed Publisher for Chrome app. It was O=GOOGLE INC… to O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US. Even, i tried with Google LLC before, but it didn’t work.

BUT, i overlooked fact that you are talking about devices without enrollment. Expirence i described was with enrolled device.

On device without enrolmnet, still can’t access corp dana with Chrome.
But looks like, it is expected:

– Only enlightened apps can be managed without device Enrollment.

Iz

Ok, that sounds as the opposite as expected.
Must say I just (re)created the WIP policy in my lab and I`m not able to access any corp data with Chrome. I do some further testing.