Merge pull request #19310 from c-demello/patch-76

Clarify cut, copy, and paste restrictions

Author: nicholasswhite

intune/intune-service/apps/app-protection-policy-settings-android.md

@@ -34,7 +34,7 @@ There are three categories of policy settings: data protection settings, access
 |**Receive data from other apps** |Specify what apps can transfer data to this app: <ul><li>**Policy managed apps**: Allow transfer only from other policy-managed apps.</li><li>**All Apps**: Allow data transfer from any app.</li><li>**None**: Don't allow data transfer from any app, including other policy-managed apps. </li></ul> <p>There are some exempt apps and services from which Intune can allow data transfer. See  [Data transfer exemptions](app-protection-policy-settings-android.md#data-transfer-exemptions) for a full list of apps and services. |**All Apps** |
 |<ul><b>**Open data into Org documents** |Select **Block** to disable the use of the *Open* option or other options to share data between accounts in this app. Select **Allow** if you want to allow the use of *Open*. <br><br>When set to **Block** you can configure the **Allow user to open data from selected services** to specific which services are allowed for Org data locations.<br><br>**Note:**<ul><li><i>This setting is only configurable when the setting **Receive data from other apps** is set to **Policy managed apps**.</i></li><li><i>This setting is "Allow" when the setting **Receive data from other apps** is set to **All Apps**.</i></li><li><i>This setting is "Block" with no allowed service locations when the setting **Receive data from other apps** is set to **None**.</i></li><li><i>The following apps support this setting:</i><ul><li><i>OneDrive 6.14.1 or later.</i></li><li><i>Outlook for Android 4.2039.2 or later.</i></li><li><i>Teams for Android 1416/1.0.0.2021173701 or later.</i></li></ul></li></ul> |<br><br> **Allow** |
 |<ul><b><ul><b>**Allow users to open data from selected services** |Select the application storage services that users can open data from. All other services are blocked. Selecting no services prevents users from opening data.<br><br>Supported services:<ul><li>OneDrive for Business</li><li>SharePoint Online</li><li>Camera</li><li>Photo Library</li></ul>**Note:** Camera doesn't include Photos or Photo Gallery access. When selecting **Photo Library** (includes Android's [Photo picker](https://developer.android.com/training/data-storage/shared/photopicker) tool) in the **Allow users to open data from selected services** setting within Intune, you can allow managed accounts to allow *incoming* image/video from their device's local storage to their managed apps. |**All selected**  |
-|**Restrict cut, copy and paste between other apps** |Specify when cut, copy, and paste actions can be used with this app. Choose from: <ul><li>**Blocked**:  Don't allow cut, copy, and paste actions between this app and any other app.</li><li>**Policy managed apps**: Allow cut, copy, and paste actions between this app and other policy-managed apps.</li><li>**Policy managed with paste in**: Allow cut or copy between this app and other policy-managed apps. Allow data from any app to be pasted into this app.</li><li>**Any app**: No restrictions for cut, copy, and paste to and from this app.</ul>**Note**: When using third-party keyboards, users may see the message “Your organization's data cannot be pasted here” in the keyboard’s clipboard preview during copy actions. This occurs if the keyboard app is not integrated with Intune and hence cannot decrypt the encoded clipboard text. Users can still copy and paste data as expected using the paste text action within managed apps if allowed by the organization. |**Any app** |
+|**Restrict cut, copy and paste between other apps** |Specify when cut, copy, and paste actions can be used with this app. Choose from: <ul><li>**Blocked**:  Don't allow cut, copy, and paste actions between this app and any other app.</li><li>**Policy managed apps**: Allow cut, copy, and paste actions between this app and other policy-managed apps.</li><li>**Policy managed with paste in**: Allow cut or copy between this app and other policy-managed apps. Allow data from any app to be pasted into this app.</li><li>**Any app**: No restrictions for cut, copy, and paste to and from this app.</ul>**Note**: <ul><li>When using third-party keyboards, users may see the message “Your organization's data cannot be pasted here” in the keyboard’s clipboard preview during copy actions. This occurs if the keyboard app is not integrated with Intune and hence cannot decrypt the encoded clipboard text. Users can still copy and paste data as expected using the paste text action within managed apps if allowed by the organization.</li><li>Some third‑party keyboards provide their own clipboard or text suggestion capabilities that can insert text directly into an app. When this occurs, the app receives the text as standard user input, and paste restrictions do not apply to these keyboard‑initiated insertions.</li>|**Any app** |
 |<ul><b>**Cut and copy character limit for any app** |Specify the number of characters that can be cut or copied from org data and accounts. This allows sharing of the specified number of characters to any app, including unmanaged apps, when it would be otherwise blocked by the "Restrict cut, copy, and paste with other apps" setting.<p>Default Value = 0<p>**Note**: Requires Intune Company Portal version 5.0.4364.0 or later. |**0** |
 |**Screen capture and Google Assistant** |Select **Block** to block screen capture, block **Circle to Search**, and block **Google Assistant** accessing org data on the device when using this app. Choosing **Block** also blurs the App-switcher preview image when using this app with a work or school account.<p>**Note**: Google Assistant might be accessible to users for scenarios that don't access org data. |**Allow**|
 |**Approved keyboards**  |Select *Require* and then specify a list of approved keyboards for this policy. <p>Users who aren't using an approved keyboard receive a prompt to download and install an approved keyboard before they can use the protected app. This setting requires the app to have the Intune SDK for Android version 6.2.0 or later. |**Not required** |