Windows Information Protection (WIP) blocking users from copying text from Outlook to corporate web apps

Elisa Virtannen 0 Reputation points
2026-06-08T09:49:28.0933333+00:00

Hi all,

we implemented Windows Information Protection (WIP) in silent audit mode before full enforcement. However, users are reporting that they are already being blocked from copying content out of their Outlook corporate mail profiles and pasting it into internal web applications running inside Google Chrome.

Why is a silent policy actively interfering? Thanks

Windows for business | Windows Client for IT Pros | Devices and deployment | Configure application groups
0 comments

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-06-08T09:49:47.85+00:00

    Because the blocking is not coming from the WIP “Silent” mode itself, but from other protection controls that still enforce restrictions even when WIP is configured as Silent.

    In WIP:

    • Silent mode only means WIP does not prompt end users or block actions that would otherwise show a user-facing warning in Allow Overrides mode.
    • However, “unallowed actions” are still blocked, even in Silent mode. The documentation states that in Silent mode, WIP “runs silently, logging inappropriate data sharing, without stopping anything that would have been prompted for employee interaction while in Allow Overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.”

    In practice, this means:

    • If Outlook is treated as a corporate/WIP-protected app and Chrome (or the specific Chrome profile) is treated as non-corporate/unprotected, then copying corporate data from Outlook and pasting into Chrome can be considered an unallowed action.
    • Even with WIP set to Silent, those unallowed actions are still blocked at the platform level, so users experience blocking when trying to paste into Chrome.

    To avoid this behavior while auditing:

    • Ensure Chrome (or the relevant profile) is configured as a WIP-allowed/enlightened app or otherwise treated as a corporate app in the WIP policy, so that copy/paste from Outlook to the internal web app is not classified as an unallowed action.
    • Alternatively, adjust the app and network boundary definitions so that the internal web app and its browser context are recognized as corporate, reducing the number of actions that fall into the “unallowed” category that WIP must still block even in Silent mode.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Chen Tran 12,940 Reputation points Independent Advisor
    2026-06-08T10:37:13.45+00:00

    Hello Elisa,

    Thank you for posting question on Microsoft Windows Forum!

    Based on the issue description. Well! The plausible explanation to this symptom is that when you configure WIP to run in Silent mode, the operating system changes how it handles user prompts, but it does not alter how it guards cryptographic keys.

    When a user copies text out of Outlook (which is an enlightened, protected app), WIP immediately tags and encrypts that clipboard payload with your corporate identity (e.g., contoso.com). On the other hand, when the user attempts to paste that text into Google Chrome, the Chrome binary (chrome.exe) must programmatically request access to read the contents of the Windows clipboard buffer. Since Google Chrome is not explicitly defined in your WIP policy's Protected Apps list, the Windows kernel classifies Chrome as an unallowed/untrusted application. WIP's Silent mode allows a user to bypass data boundaries via explicit actions, but it never allows an untrusted application binary to programmatically read or decrypt enterprise-protected data structures.

    To stop this interference during your auditing phase, you have to explicitly grant Chrome permission to interact with the protected clipboard by declaring Chrome as an Unenlightened app within your Intune/MAM WIP policy. This tells Windows to trust the binary enough to hand over enterprise-tagged clipboard data.

    Another suggestion is to verify the exact WIP mode assigned to the device, confirm the Chrome-based internal app is actually treated as an enterprise-protected destination, and test whether the same copy/paste works in Edge versus Chrome. The result will usually tell you whether this is WIP enforcement or a separate browser/DLP policy.

    You can consult the following articles for further reference regarding your concerns.

    Hope the above information is helpful! If it is. Free feel to hit "Accepted" for benefitting others in community having the same issue too.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.