Policy Defaults

Toggle the switch to On.

Then click the Manage link to add or remove whitelisted IP addresses:

Only logins from IP addresses on this list will be successful. If there are no records on this list, all IP addresses will be allowed to log in.

By default, users will be able to log in to any component of Workplace from an IP address on this list. To exclude login to some Workplace components, you may clear the Workplace Online, Workplace Mobile and/or Workplace Desktop check boxes for any IP address.

You can use wildcard symbol * to include a range of IP addresses.

NOTE  Wildcards are implemented in a very simple way. Just use one or more asterisks in the pattern. An asterisk will replace 0 or more characters

For example, for the IP address 123.456.789.111 all the following patterns will match:
123.*.789.111
123*
123.*.789.*

Toggle the switch to Enable.

Select check box. When this policy is added to the policy profile, you can choose to enable any or all of the following additional settings:

Enforce Email Validation

Public share recipients will be prompted to enter their name (optional) and email address (required) when they access the share.

Enforce Password

Requires that public share recipients enter a password before accessing the file.

Maximum Expiration Length

Determines the maximum amount of time that the share is available. You may select a duration. Users to whom this policy profile applies will be able to adjust the duration downward, but they will not be able to increase it.

Places a watermark on files are viewed with View Only permissions.

The watermark consists of the user's full name and email address. This only applies to converted files, not images or videos. Refer to File conversion limits for more information on which file types are converted.

Remotely erase all data synced via the Workplace service from the user's devices when their account is disabled.

If this policy is enabled, the Disable and Wipe Devices option is selected by default when you disable a user.

When a device is wiped, it is also purged.

NOTE  If Active Directory integration is enabled and a user is disabled via Active Directory, the synced data in the Workplace Folderwill be automatically wiped from all their devices.

Remotely erase all data synced via the Workplace service from the user's devices when their account is deleted.

When this policy is enabled and a user account is deleted, the default Don’t Wipe option next to each device is changed to Wipe.

When a device is wiped, it is also purged.

NOTE  If Active Directory integration is enabled and a user is deleted via Active Directory, the synced data in the Workplace Folder will be automatically wiped from all their devices.

If this policy has been disabled, toggle the switch to On.

This policy is enabled by default, with a setting of 3 months since last connection before a device is disabled, and 12 months in a disabled state before the device is recycled. If no action is taken, recycled devices will be purged after 90 days.

An email notification will be sent to team administrators, Workplace Manager alert recipients, and the device owner whenever a device status changes due to this policy.

Use two-factor authentication in the login process.

For more information, refer to Manage Two-Factor AuthenticationManage Two-Factor Authentication

After you enable the 2FA policy and save, a Manage link will appear next to this setting. Click the Manage link to open the Manage Two-Factor Authentication page and complete configuration of this policy.

All users on your team will be forced to use two-factor authentication the next time they log on.

After you enable the 2FA policy and save, a Manage link will appear next to this setting. Click the Manage link, which will open this popup window:

For each IP address, enter the IP Address Pattern, enter a description, then click Add. You can use wildcard symbol * to include a range of IP addresses.

NOTE  Wildcards are implemented in a very simple way. Just use one or more asterisks in the pattern. An asterisk will replace 0 or more characters

For example, for the IP address 123.456.789.111 all the following patterns will match:
123.*.789.111
123*
123.*.789.*

When you have added all the addresses you want, click Update.

IP addresses on the list can successfully log in without two-factor authentication, even if 2FA is enabled for the account.

Toggle the switch to On. Once you have enabled this selection, click the Manage link to open the Manage Restricted Groups popup window:

Find each group you wish to exclude from sharing and add it to the list. Then click Done.

Toggle the switch to On. Then click the Manage link for this policy to set the default location for the Workplace folder on the Manage Workplace Location page.

Specifies the location in which v10 stores files, and the maximum amount of storage that can be used by the automatic sync process when a user opens a file.

Files that are opened on the device will automatically be retained in this cache and will be available while offline until the cache is full. Files opened the longest time ago will be automatically cleared from the cache.

NOTE  All files are stored in the cache location. Files that have been synced to the device to make them available offline are not included in the cache size.

Toggle the switch to On.

Then, for cache size, enter a value of 10 GB or greater in the corresponding field.

To manage the cache location, you must first click the Save button at the bottom of the page. Then click the Manage Location link. This will open the Manage Cache Location interface.

Specify projects or folders that will automatically sync to the device. If this policy is enabled, the Project list controlled by administrator check box on the Workplace Desktop Sync tab will be selected by default upon installation, but users may clear the check box to customize the projects they wish to sync. If they select the check box again, only projects designated in this policy will be synced.

NOTE  Throttle control settings apply to Workplace Desktop 7.2 and later only. These settings do not affect Workplace Server.

All updates will require manual installation or remote deployment.

For Workplace for Windows and Mac v10 or later, the auto-update mechanism will be disabled.

For Workplace v8.x or earlier, update notifications will be disabled. If, however, the installed version is no longer supported, it will still be updated automatically. This safeguard is in place to ensure that users always enjoy a functional Workplace experience.

IMPORTANT  While we encourage you to use Silent installation, we recommend that you allow Datto to maintain user versions through the auto-update mechanism. This will ensure that users always have an up-to-date version of our Workplace app. Please do not enable this policy unless you have an exceptionally good reason.

Toggle the switch to On.

Toggle the switch to On, then select the type of authentication required, and the timeout period. Passcode is a user-created 4 digit code. Password is the user's Workplace account password. Password is more secure.

If passcode is selected, the users will have to use authentication, but can select between passcode, password or (Workplace Mobile for iOS only) TouchID. If password is selected, the users must enter their password to access their account via Workplace Mobile.

Select the number of failed authentication attempts allowed before all Workplace data on the device is wiped.

If this field is set to None, after 10 attempts, access to the account will be disabled for 10 minutes.