Skip to main content

Cut, Copy, Paste in App Protection Policies

Implementation Effort: Low

User Impact: Medium

Overview​

Clipboard control is one of the most visible and effective APP protections. It determines whether users can move data from a managed work context into other apps, which directly affects the risk of accidental or deliberate exfiltration.

Because this control is user-visible, the goal is not simply to choose the most restrictive option; it is to define a policy that protects sensitive data while still enabling legitimate cross-app work inside the managed app ecosystem.

Implementation Guidance​

  1. In the Intune admin center, edit the relevant app protection policies and review Restrict cut, copy, and paste between other apps in the data protection settings.
  2. For most organizations, Policy managed apps is the best default because it allows productivity inside the managed ecosystem while blocking transfer to personal apps. Use Policy managed apps with paste in only where business workflows genuinely require inbound paste from unmanaged apps. Use None or the most restrictive equivalent for higher-sensitivity populations. Treat Any app as an exception.
  3. If the current platform supports a character limit or other refinements, define them explicitly for high-risk groups instead of applying one global setting to everyone.
  4. Document Windows separately. Windows app protection and Microsoft Edge behaviors are not identical to Android and iOS/iPadOS, so the workshop should not imply a single cross-platform experience.
  5. Test with the real app portfolio: Outlook to Teams, Outlook to OneDrive, Word to personal Notes, browser copy and paste, and any line-of-business apps that claim APP support.

Video Walkthrough​

Reference​