Configure copy and paste from Office documents opened in Application Guard

UserNeeds changes for IntuneL_TurnOffClipboardAccessInApplicationGuard

Supported on SUPPORTED_Windows_10_0 (defined in the Windows templates)

5568.1000

What it does

This policy setting allows you to control whether users can copy and paste content from Office to and from documents opened in Application Guard, as well as the allowed formats. This policy setting only applies to Word, Excel, and PowerPoint. If you enable this policy setting, you must choose from the following behaviors: - Enable clipboard functionality between the host and Application Guard (default). - Disable clipboard functionality completely between the host and Application Guard. - Enable the clipboard to copy content from Application Guard to the host. - Enable the clipboard to copy content from the host to Application Guard. Note: Application Guard only allows copying text and images and doesn’t allow copying of rich content. Important: We recommend that you don't enable copying from the host to Application Guard. If you enable this functionality, a potentially compromised Application Guard session will have access to the host device’s clipboard and its content. You can also choose the type of content that can be copied, by using the content options: - Allows text copying (default). - Allows image copying. - Allows both text and image copying. If you disable or don't configure this policy setting, users can copy and paste content to and from documents opened in Application Guard to other locations outside Application Guard. Note: Application Guard only allows copying text and images and doesn’t allow copying of rich content. Note: This policy setting only applies to Microsoft 365 Apps for enterprise.

What it writes

Hive: HKEY_CURRENT_USER
Registry key: software\policies\microsoft\office\16.0\common\security\applicationguard

Why it needs changes for Intune

Policy references a Windows supportedOn definition.
ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE

Options

Option	Type	Registry value	Allowed values
Clipboard behavior setting.Default: Enable clipboard operation both directions (default)	Drop-down list	`clipboarddirection`	Enable clipboard operation both directions (default)`0` Enable clipboard operation only from the host to the isolated session`1` Enable clipboard operation only from an isolated session to the host`2` Disable clipboard operation both directions`3`
Clipboard content options.	Drop-down list	`clipboardformats`	Enable only text operations in the clipboard (default).`0` Enable only image operations in the clipboard.`1` Enable image and text operations in the clipboard.`2`

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Enabled · User · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\security\applicationguard]
"clipboarddirection"=dword:00000000
"clipboardformats"=dword:00000000

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Configure copy and paste from Office documents opened in Application Guard
# Name: L_TurnOffClipboardAccessInApplicationGuard
# Scope: User
# State: Enabled
# Source: office16.admx

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\security\applicationguard' -Name 'clipboarddirection' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\security\applicationguard' -Name 'clipboardformats' -PropertyType 'DWord' -Value 0

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.
The generated payload is incomplete because one or more ADMX element values were not supplied: L_AppGuardClipboardTypeValue

ADMX profile candidate (OMA-URI)

./User/Vendor/MSFT/Policy/Config/ADMX_office16/L_TurnOffClipboardAccessInApplicationGuard

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Configure copy and paste from Office documents opened in Application Guard
# Name: L_TurnOffClipboardAccessInApplicationGuard
# Scope: User
# State: Enabled
# Source: office16.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\security\applicationguard' -Name 'clipboarddirection' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\security\applicationguard\clipboarddirection') | Out-Null
}

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\security\applicationguard' -Name 'clipboardformats' -Kind 'DWord' -Expected 0
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\security\applicationguard\clipboardformats') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Configure copy and paste from Office documents opened in Application Guard
# Name: L_TurnOffClipboardAccessInApplicationGuard
# Scope: User
# State: Enabled
# Source: office16.admx

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\security\applicationguard' -Name 'clipboarddirection' -PropertyType 'DWord' -Value 0

Set-RegistryValue -Path 'Registry::HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\security\applicationguard' -Name 'clipboardformats' -PropertyType 'DWord' -Value 0

History 1 retained release

5568.100010 Aug 2026
- Already present in the first release ChangeIntel keeps.

Template

Internal name: L_TurnOffClipboardAccessInApplicationGuard
Namespace: office16.Office.Microsoft.Policies.Windows
Template file: office16.admx
Release: Microsoft 365 Apps 5568.1000 · file set 8be05d876aae137d…

Definition, editor controls and support

Definition

<policy class="User" displayName="$(string.L_TurnOffClipboardAccessInApplicationGuard)" explainText="$(string.L_TurnOffClipboardAccessInApplicationGuardExplain)" key="software\policies\microsoft\office\16.0\common\security\applicationguard" name="L_TurnOffClipboardAccessInApplicationGuard" presentation="$(presentation.L_TurnOffClipboardAccessInApplicationGuardPresentation)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="office16.Office.Microsoft.Policies.Windows:L_ApplicationGuard" />
      <supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_Windows_10_0" />
      <elements>
        <enum id="L_AppGuardClipboardDirection" valueName="clipboarddirection">
          <item displayName="$(string.L_AppGuard_ClipboardSettings_DropdownList_Option_BothDirectionsEnabled)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.L_AppGuard_ClipboardSettings_DropdownList_Option_HostToContainerEnabled)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.L_AppGuard_ClipboardSettings_DropdownList_Option_ContainerToHostEnabled)">
            <value>
              <decimal value="2" />
            </value>
          </item>
          <item displayName="$(string.L_AppGuard_ClipboardSettings_DropdownList_Option_OperationDisabled)">
            <value>
              <decimal value="3" />
            </value>
          </item>
        </enum>
        <enum id="L_AppGuardClipboardTypeValue" valueName="clipboardformats">
          <item displayName="$(string.L_AppGuard_ClipboardType_TextOnly)">
            <value>
              <decimal value="0" />
            </value>
          </item>
          <item displayName="$(string.L_AppGuard_ClipboardType_ImageOnly)">
            <value>
              <decimal value="1" />
            </value>
          </item>
          <item displayName="$(string.L_AppGuard_ClipboardType_ImageAndText)">
            <value>
              <decimal value="2" />
            </value>
          </item>
        </enum>
      </elements>
    </policy>

Editor controls

<presentation id="L_TurnOffClipboardAccessInApplicationGuardPresentation" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <dropdownList defaultItem="0" noSort="true" refId="L_AppGuardClipboardDirection">Clipboard behavior setting.</dropdownList>
        <dropdownList defaultValue="0" noSort="true" refId="L_AppGuardClipboardTypeValue">Clipboard content options.</dropdownList>
      </presentation>

Supported platforms and category

office16.Office.Microsoft.Policies.Windows:category:L_ApplicationGuard
<category displayName="$(string.L_ApplicationGuard)" name="L_ApplicationGuard" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="office16.Office.Microsoft.Policies.Windows:L_trustcenter241" />
    </category>
office16.Office.Microsoft.Policies.Windows:category:L_MicrosoftOfficeSystem
<category displayName="$(string.L_MicrosoftOfficeSystem)" name="L_MicrosoftOfficeSystem" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
office16.Office.Microsoft.Policies.Windows:category:L_SecuritySettings
<category displayName="$(string.L_SecuritySettings)" name="L_SecuritySettings" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="office16.Office.Microsoft.Policies.Windows:L_MicrosoftOfficeSystem" />
    </category>
office16.Office.Microsoft.Policies.Windows:category:L_trustcenter241
<category displayName="$(string.L_trustcenter241)" name="L_trustcenter241" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="office16.Office.Microsoft.Policies.Windows:L_SecuritySettings" />
    </category>
office16.Office.Microsoft.Policies.Windows:unresolved:Microsoft.Policies.Windows:SUPPORTED_Windows_10_0
<unresolved reference="Microsoft.Policies.Windows:SUPPORTED_Windows_10_0" />
office16.Office.Microsoft.Policies.Windows:category:L_ApplicationGuard
<category displayName="$(string.L_ApplicationGuard)" name="L_ApplicationGuard" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="office16.Office.Microsoft.Policies.Windows:L_trustcenter241" />
    </category>
<strings><string id="office16.Office.Microsoft.Policies.Windows:L_ApplicationGuard">Application Guard</string></strings>
office16.Office.Microsoft.Policies.Windows:category:L_MicrosoftOfficeSystem
<category displayName="$(string.L_MicrosoftOfficeSystem)" name="L_MicrosoftOfficeSystem" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="office16.Office.Microsoft.Policies.Windows:L_MicrosoftOfficeSystem">Microsoft Office 2016</string></strings>
office16.Office.Microsoft.Policies.Windows:category:L_SecuritySettings
<category displayName="$(string.L_SecuritySettings)" name="L_SecuritySettings" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="office16.Office.Microsoft.Policies.Windows:L_MicrosoftOfficeSystem" />
    </category>
<strings><string id="office16.Office.Microsoft.Policies.Windows:L_SecuritySettings">Security Settings</string></strings>
office16.Office.Microsoft.Policies.Windows:category:L_trustcenter241
<category displayName="$(string.L_trustcenter241)" name="L_trustcenter241" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="office16.Office.Microsoft.Policies.Windows:L_SecuritySettings" />
    </category>
<strings><string id="office16.Office.Microsoft.Policies.Windows:L_trustcenter241">Trust Center</string></strings>