NicholasEsping

In this scenario what you would need to do is create catalog files to allow the unsigned code. Deploy catalog files to support App Control for Business | Microsoft Learn

Depending on how your web filter works you could block sharepoint.com and onedrive.live.com and then add a allow rule that allows https://schoolname-my.sharepoint.com.

That would probably be the better way to do this, and I really should switch it. Since we already needed to deploy AppLocker to make the Managed Installers work I just left it in the AppLocker policy.

Here is my appx xml. I use the local group policy editor to create this on a test computer and then export the xml to push out with Intune. <AppLockerPolicy Version="1"> <RuleCollection Type="Appx" EnforcementMode="Enabled"> <FilePublisherRule Id="0a45d15c-5033-48fa-88c1-d1d2d875b511" Name="AdobeSystemsIncorporated.AdobeReader, version 0.0.0.0 and above, from CN=553ADC34-E6D7-49F5-B450-3BCAE6182ACB" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=553ADC34-E6D7-49F5-B450-3BCAE6182ACB" ProductName="AdobeSystemsIncorporated.AdobeReader" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="28ee9e16-1d2a-470f-be7a-7449242ce033" Name="Signed by 3CX Software DMCC" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=FB532F09-9100-4C71-89EC-9FE6CFC37A83" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="3a25d9df-87fd-4538-a24c-e33e61f61bf0" Name="PearsonEducationInc.TestNav, version 0.0.0.0 and above, from Pearson Education Inc" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=064058AF-B77F-42B8-82D3-37A4EFB14996" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="3d68107b-186e-45c3-b875-79b370d05d82" Name="McGraw-HillEducation.McGraw-HillK-12ConnectEDMobil, version 0.0.0.0 and above, from CN=40CD84DB-C8D5-4A33-9354-6243F1A9EDA6" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=40CD84DB-C8D5-4A33-9354-6243F1A9EDA6" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="5b24053c-4f9c-4358-a308-e49f9ff3d165" Name="AdobePhotoshopExpress" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=553ADC34-E6D7-49F5-B450-3BCAE6182ACB" ProductName="AdobeSystemsIncorporated.AdobePhotoshopExpress" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="721f1150-1e95-4c94-afae-480a8cc28b69" Name="Signed by INTEL CORP" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=EB51A5DA-0E72-4863-82E4-EA21C1F8DFE3" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="75c4e5fd-44ae-4e0a-9fd4-a0d18e569ea2" Name="Duolingo" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=FFBE6978-4D2C-4598-A465-8F4DB11260AC" ProductName="D5EA27B7.Duolingo-LearnLanguagesforFree" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="7ff9438e-e9e8-4989-83dc-f55afa7c6d94" Name="Signed by Data Recognition Corporation" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=B603712B-3BB5-48D0-8DD4-5EF501685EFC" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="828c8b94-c536-4fe5-a9f0-661985bbff2a" Name="Signed by HP Inc." Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=ED346674-0FA1-4272-85CE-3187C9C86E26" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="8738e104-5a12-41d3-a711-0993b319232b" Name="Signed by Microsoft Corp." Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=33F0F141-36F3-4EC2-A77D-51B53D0BA0E4" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="94acd254-3656-4e27-82c7-2398a515c393" Name="Signed by Apple Inc." Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=5BD5593D-A41B-4F89-884E-B4F3E0FBAA75" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="bbafb65c-20f2-49a5-b5fe-fa6810b28848" Name="Signed by Notepad++" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=&quot;Notepad++&quot;, O=&quot;Notepad++&quot;, L=Saint Cloud, S=Ile-de-France, C=FR" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="bfc529c0-8dce-43ee-add0-ae6dd3d3985f" Name="Signed by Realtek Semiconductor Corp" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=83564403-0B26-46B8-9D84-040F43691D31" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="c96e4c83-1eb2-46ab-82b6-261db96d44c8" Name="All signed packaged apps-Microsoft Corporation" Description="Allows members of the Everyone group to run packaged apps that are signed." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="ddb44d11-2ce1-431a-96a6-ebded18f935e" Name="All signed packaged apps-Microsoft Windows" Description="Allows members of the Everyone group to run packaged apps that are signed." UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> <FilePublisherRule Id="e8947f11-2d60-47f0-a998-2b6130f33cfb" Name="Signed by Pearson Education Inc" Description="" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePublisherCondition PublisherName="CN=064058AF-B77F-42B8-82D3-37A4EFB14996" ProductName="*" BinaryName="*"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule> </RuleCollection> </AppLockerPolicy>

For store apps I just use an AppLocker policy to block/allow the ones we want students using. I ran into that same issue with my policy and found it a lot easier to just use AppLocker then try to block/allow them in the base policy.

Yes, I do Merge with the recommended block rules. Here are the options I have set in my policy. I used to have Dynamic Code Security on, but it started causing problems with our web filter functionality.

Yes, it should since Winget will be launched by the Intune management extension when deployed with Intune. If it's an app that auto updates you might run into issues when it updates if the updater is not a managed installer. If you control all updates through Intune, you should be fine.

Once you have the managed installer option set in your WDAC policy you can enable the Managed installer in a couple of different ways. There is an option in Endpoint security that will set the Intune Management extension as a managed installer. Otherwise, you can create your own AppLocker xml that can have additional managed installers. For example, I made our web filter a managed installer, so it is able to update everything without any issues. I then deploy this policy using proactive remediations. Here is the Microsoft documentation on creating managed installers and a GitHub page with example detection and remediation scripts. Allow apps deployed with an App Control managed installer | Microsoft Learn scripts/remediation.ps1 at main · ne8801/scripts · GitHub

Do you use managed installers? You might be able to just deploy the papercut client using Intune as long as the Intune management extension is set as a managed installer the WDAC policy should allow the application to run. I use WDAC on my student devices but do not currently have papercut. I was able to deploy MyQ which is a different print management solution with this method.

I use proactive remediation to update my managed installers for WDAC. This uses AppLocker so you should be able to modify this with your AppLocker policy if you have access to proactive remediations. You could also do this as a win32 application if you do not have access to remediations. ne8801/scripts

Have you tried updating the proxy and target address to the SMTP:[email protected] format? I have not seen office 365 work with only x500:/o=ExchangeLabs listed for these. Also do you see any sign in attempts in their sign in logs when you are getting the username/password error?

We have A5 here so it could definitely be a license thing, but I think that would be a weird setting to lock behind a license.

I can do folders as well. My sharing settings are set to Most permissive for both SharePoint and OneDrive and we expire the links after 90 days. I am not seeing any check boxes or anything related to the Password box.

Here is a screenshot you would just put a password in the set password box.

We do not require MFA to access Company Portal or apps like OneDrive and office. We do require MFA if they are using a device that is not owned by the school though. I would recommend looking into your Windows hello for business policy. Whenever I have enabled that it has tried to force MFA to be set up for all users in our tenant.