erikre-oob2206-9450163 1.2

Author: Erikre

memdocs/intune/apps/app-protection-framework.md

@@ -167,7 +167,7 @@ The policy settings enforced in level 2 include all the policy settings recommen
 | Data Transfer |       Send org   data to other apps  |          Policy   managed apps  |          iOS/iPadOS,   Android  |          <p>With   iOS/iPadOS, administrators can configure this value to be "Policy managed   apps", "Policy managed apps with OS sharing", or "Policy managed apps   with Open-In/Share filtering". </p><p>Policy managed apps with OS   sharing is available when the device is also enrolled with Intune. This   setting allows data transfer to other policy managed apps, as well as   file transfers to other apps that have are managed by   Intune. </p><p>Policy managed apps with Open-In/Share filtering   filters the OS Open-in/Share dialogs to only display policy managed   apps. </p><p> For more information, see [iOS app protection policy   settings](app-protection-policy-settings-ios.md).</p> |
 | Data Transfer |       Select apps to exempt  |          Default / skype;app-settings;calshow;itms;itmss;itms-apps;itms-appss;itms-services;  |          iOS/iPadOS  |                  |
 | Data Transfer |       Save   copies of org data  |          Block  |          iOS/iPadOS,   Android  |                  |
-| Data Transfer |       Allow   users to save copies to selected services  |          OneDrive   for Business, SharePoint Online |          iOS/iPadOS,   Android  |                  |
+| Data Transfer |       Allow   users to save copies to selected services  |          OneDrive   for Business, SharePoint Online, Photo Library |          iOS/iPadOS,   Android  |                  |
 | Data Transfer |       Transfer telecommunication data to  |          Any dialer app |          iOS/iPadOS,   Android  |                  |
 | Data Transfer |       Restrict   cut, copy, and paste between apps  |          Policy   managed apps with paste in  |          iOS/iPadOS,   Android  |                  |
 | Data Transfer |       Screen   capture and Google Assistant  |          Block  |          Android  |                  |

memdocs/intune/apps/app-protection-policy-settings-android.md

@@ -48,13 +48,13 @@ There are three categories of policy settings: data protection settings, access
 | **Send org data to other apps** | Specify what apps can receive data from this app: <ul><li> **Policy managed apps**: Allow transfer only to other policy-managed apps.</li> <li>**All apps**: Allow transfer to any app. </li> <li>**None**: Do not allow data transfer to any app, including other policy-managed apps.</li></ul> <p>There are some exempt apps and services to which Intune may allow data transfer by default. In addition, you can create your own exemptions if you need to allow data to transfer to an app that doesn't support Intune APP. For more information, see [Data transfer exemptions](app-protection-policy-settings-android.md#data-transfer-exemptions).<p>This policy may also apply to Android App Links.  General web links are managed by the **Open app links in Intune Managed Browser** policy setting.<p><div class="NOTE"><p>Note</p><p>Intune doesn't currently support the Android Instant Apps feature. Intune will block any data connection to or from the app. For more information, see [Android Instant Apps](https://developer.android.com/topic/instant-apps/index.html) in the Android Developer documentation.</p><p>If **Send org data to other apps** is configured to **All apps**, text data may still be transferred via OS sharing to the clipboard.</p></div> | **All apps** |
 |<ul><b>**Select apps to exempt** | This option is available when you select *Policy managed apps* for the previous option. | |
 |<ul><b>**Save copies of org data** | Choose **Block** to disable the use of the Save As option in this app. Choose **Allow** if you want to allow the use of *Save As*. When set to *Block*, you can configure the setting *Allow user to save copies to selected services*. <br><br>**Note:**<ul><li><i>This setting is supported for Microsoft Excel, OneNote, PowerPoint, and Word. It may also be supported by third-party and LOB apps.</i></li><li><i>This setting is only configurable when the setting **Send org data to other apps** is set to **Policy managed apps**.</i></li><li><i>This setting will be "Allow" when the setting **Send org data to other apps** is set to **All apps**. </i></li><li><i>This setting will be "Block" with no allowed service locations when the setting **Send org data to other apps** is set to **None**. </i></li></ul> | **Allow** |  
-|<ul><b><ul><b>**Allow user to save copies to selected services** |Users can save to the selected services (OneDrive for Business, SharePoint, Box, and Local Storage). All other services will be blocked.  | **0 selected** |
+|<ul><b><ul><b>**Allow user to save copies to selected services** |Users can save to the selected services (OneDrive for Business, SharePoint, Photo Library, Box, and Local Storage). All other services will be blocked.  | **0 selected** |
 |<ul><b>**Transfer telecommunications data to** | Typically, when a user selects a hyperlinked phone number in an app, a dialer app will open with the phone number prepopulated and ready to call. For this setting, choose how to handle this type of content transfer when it is initiated from a policy-managed app:<ul><li>**None, do not transfer this data between apps**: Do not transfer communication data when a phone number is detected.</li><li>**A specific dialer app**: Allow a specific dialer app to initiate contact when a phone number is detected.</li><li>**Any policy-managed dialer app**: Allow any policy managed dialer app to initiate contact when a phone number is detected.</li><li>**Any dialer app**: Allow any dialer app to be used to initiate contact when a phone number is detected.</li></ul>| **Any dialer app** |  
 |<ul><b><ul><b>**Dialer App Package ID** | When a specific dialer app has been selected, you must provide the [app package ID](../apps/app-configuration-vpn-ae.md#get-the-app-package-id). | **Blank** |
 |<ul><b><ul><b>**Dialer App Name** | When a specific dialer app has been selected, you must provide the name of the dialer app. | **Blank** |
 | **Receive data from other apps** | Specify what apps can transfer data to this app: <ul><li>**Policy managed apps**: Allow transfer only from other policy-managed apps.</li><li>**All apps**: Allow data transfer from any app.</li><li>**None**: Do not allow data transfer from any app, including other policy-managed apps. </li></ul> <p>There are some exempt apps and services from which Intune may allow data transfer. See  [Data transfer exemptions](app-protection-policy-settings-android.md#data-transfer-exemptions) for a full list of apps and services. | **All apps** |
 | <ul><b>**Open data into Org documents** | Select **Block** to disable the use of the *Open* option or other options to share data between accounts in this app. Select **Allow** if you want to allow the use of *Open*. <br><br>When set to **Block** you can configure the **Allow user to open data from selected services** to specific which services are allowed for Org data locations.<br><br>**Note:**<ul><li><i>This setting is only configurable when the setting **Receive data from other apps** is set to **Policy managed apps**.</i></li><li><i>This setting will be "Allow" when the setting **Receive data from other apps** is set to **All apps**.</i></li><li><i>This setting will be "Block" with no allowed service locations when the setting **Receive data from other apps** is set to **None**.</i></li><li><i>The following apps support this setting:</i><ul><li><i>OneDrive 6.14.1 or later.</i></li><li><i>Outlook for Android 4.2039.2 or later.</i></li><li><i>Teams for Android 1416/1.0.0.2021173701 or later.</i></li></ul></li></ul> | <br><br> **Allow**   |
-| <ul><b><ul><b>**Allow users to open data from selected services** | Select the application storage services that users can open data from. All other services are blocked. Selecting no services will prevent users from opening data.<br><br>Supported services:<ul><li>OneDrive for Business</li><li>SharePoint Online</li><li>Camera</li><li>Photo Library</li></ul>**Note:** Camera does not include Photos or Photo Gallery access. When selecting **Photo Library** in the **Allow users to open data from selected services** setting within Intune, you can allow managed accounts to allow *incoming* and *outgoing* data to and from their device's photo library to their managed apps on iOS and Android platforms. | **All selected**  |
+| <ul><b><ul><b>**Allow users to open data from selected services** | Select the application storage services that users can open data from. All other services are blocked. Selecting no services will prevent users from opening data.<br><br>Supported services:<ul><li>OneDrive for Business</li><li>SharePoint Online</li><li>Camera</li><li>Photo Library</li></ul>**Note:** Camera does not include Photos or Photo Gallery access. When selecting **Photo Library** in the **Allow users to open data from selected services** setting within Intune, you can allow managed accounts to allow *incoming* data from their device's photo library to their managed apps. | **All selected**  |
 | **Restrict cut, copy and paste between other apps** | Specify when cut, copy, and paste actions can be used with this app. Choose from: <ul><li>**Blocked**:  Do not allow cut, copy, and paste actions between this app and any other app.</li><li>**Policy managed apps**: Allow cut, copy, and paste actions between this app and other policy-managed apps.</li><li>**Policy managed with paste in**: Allow cut or copy between this app and other policy-managed apps. Allow data from any app to be pasted into this app.</li><li>**Any app**: No restrictions for cut, copy, and paste to and from this app. | **Any app** |
 | <ul><b>**Cut and copy character limit for any app** | Specify the number of characters that may be cut or copied from org data and accounts.  This will allow sharing of the specified number of characters when it would be otherwise blocked by the "Restrict cut, copy, and paste with other apps" setting.<p>Default Value = 0<p>**Note**: Requires Intune Company Portal version 5.0.4364.0 or later.  | **0** |
 | **Screen capture and Google Assistant** | Select **Block** to block screen capture and the **Google Assistant** capabilities of the device when using this app. Choosing **Block** will also blur the App-switcher preview image when using this app with a work or school account.| **Block** |