Skip to main content

conversion

Feature Details​

warning

Please be informed that there are some restrictions on data access.
Detailed information about the file conversion feature isnextYou can check it at.

Right-click menu for files/folders​

1. When selecting a single file​

User ScreenContentNote
imgSingle Security Document Right ClickAdd menu to convert to MIP document
imgRight-click on the single MIP documentAdd MIP label deletion menu

2. Multiple File/Folder Selection​

User ScreenContentNote
imgMultiple Folder/File Right ClickCustom Policy (DS_MIP_SHELL_MENU) Settings

3. Right-click menu execution screen​

User ScreenContentNote
MIP label creationTarget Document: General Document MIP, Security Document, General Document with Password Set are excluded from the conversion list. Converted to MIP labeled documents specified by ZTCAP policy. Integration Log: Used. SCI Log: Not Used.
imgDelete MIP LabelTarget document: MIP General, security documents are excluded from the conversion list Custom policy DS_MIP_SHELL_MENU:SHELL_AIP_DELETE when setting, menu addition Integrated log: Used SCI log: Not used
imgConvert to MIP documentTarget Document: Security Document MIP, General documents are excluded from the conversion list. Converted to MIP labeled documents as specified by ZTCAP policy. Integration Log: Used. SCI Log: Not used (Release log of the original security document not sent).
imgConvert to DRM documentTarget Document: MIP Document General, Security documents are excluded from the conversion list Conversion Integrated Log: Use SCI Log: Use (Send log of created converted security documents)

4. Right-click Menu by Item​

info

Reference
Some items may vary depending on policy settings.

DivisionDetail
General Document•Creating MIP└ MIP, security documents, documents with password protection are excluded from the conversion list •General Document Encryption
DRM Document•Convert to MIP document└ MIP, general documents are excluded from the conversion list • Security document destruction • Security document decryption • Change of access target • Creation of external transfer secure files
MIP Document•Convert to DRM document└ General, security documents are excluded from the conversion list •Delete MIP Label└ General, security documents are excluded from the conversion list • General document encryption
Multi-Select•MIP label creation└ Only general documents are subject to conversion •Delete MIP Label└ MIP Document Conversion List Applicable •Convert to DRM document└ MIP document corresponds to the conversion list •Convert to MIP document└ DRM document is included in the conversion list └ MIP, general documents are excluded from the conversion list • General document encryption
Folder•MIP label creation└ Only general documents are subject to conversion •Delete MIP Label└ MIP Document Conversion List Applicable •Convert to DRM document└ MIP document corresponds to the conversion list •Convert to MIP document└ DRM document corresponds to the conversion list •File Encryption in Folder└ Encrypted Supported Extensions (Localset) •Decryption of files in the folder • Simple Encryption of Files in a Folder└ Unsupported encryption extension (Localset)

5. (Old) Right-click Menu Execution Screen​

If the DS365Agent64.exe file is not present in the C:\Windows\SOFTCAMP\Security365\DS365\x64\ path, perform the action.

User ScreenContentNote
imgCreate AIP LabelTarget Document: General Document Converted to AIP Label Document Designated by ZTCAP Policy Integrated Log: Used SCI Log: Not Used
imgDelete AIP LabelTarget Document: AIP Document Custom Policy DS_MIP_SHELL_MENU:SHELL_AIP_DELETE Setting When Adding Menu Integrated Log: Used SCI Log: Not Used
imgConvert to AIP documentTarget Document: Converted to AIP labeled document as specified by the security document ZTCAP policy Integrated Log: Used SCI Log: Not used (Release log of the original security document not sent)
imgConvert to DRM documentTarget Document: AIP Document Converted to Security Document as Designated by ZTCAP Policy Integrated Log: Used SCI Log: Used (Log Transmission for Created Security Document)

MIP Document Conversion Owner Retention Feature​

info

The feature that retains the Owner Id of the original MIP document when converting a MIP document to a DRM document and then back to a MIP document.

1. Overview​

If user A creates and has owner permissions on an MIP document locally, and user B converts that document to MIP after DRM conversion, the final document will be converted to an MIP document with owner permissions for user B.
A user ownership feature that allows user A to have owner permissions even if the document is ultimately converted multiple times.

2. Flowchart​

3. Others and Limitations​

  • The user ownerId information of the MIP document is not retained when the MIP is released. When converted to a DRM document, the information is linked.
  • ownerId information is included in the DRM document header VFI (DSBSDT_VFI_MIP_OWNER_ID) and can be checked in the secure document header feature in SDSWizard version 6.0.0.13 or higher.
  • Currently, in DS 6.0, document conversion uses the access token issued by the ssevtr app instead of a user token, and that app must have the InformationProtectionPolicy.Read.All permission set in Microsoft Entra ID. This setting must be properly applied for the ownerId retention feature to function correctly.

Cloud Download Document Conversion​

info

Performs conversion functions for documents downloaded from cloud storage (OneDrive, SharePoint, Teams).

  • The definition of the conversion method follows the Ztcap policy.

1. Overview​

  • Provides conversion functionality for documents downloaded from cloud storage (OneDrive, SharePoint, Teams).
  • The policy regarding conversion follows the Ztcap policy.

This feature detects the download timing of the browser and Teams app by hooking the ZoneIdentifier (MoTW) record afterDownloadFile_FromCloudEvent), handling file copying in OneDrive/SharePoint sync folderControlWhen downloading from the 'external storage' of the categoryCopyFileFrom_OneDrive / CopyFileFrom_Sharepoint) is a separate feature with a different trigger and path.

danger

This policy value is required. If it is missing, the download timing may not be detected, and the download conversion feature may not function.

HOOK_LOAD_DYNAMICA custom policy must be set for the hooking module to be loaded into the browser and Teams processes to detect the download timing. Detailed policy values such as module injection strings areConversion DetailsManage on the page.

3-1 Example of decisionFactors queried by ztcap at the Endpoint during function operation​

// 단일 문서(docx Mip문서) 다운로드시 문서에 대한 질의 json
{
    "decisionFactors": [
  {
    "category": "document",
    "target": {
      "info": {
        "ext": "docx",
        "zoneIdentifier": "https://softcamp-my.sharepoint.com/personal/jaekwon_lee_softcamp_co_kr/_layouts/15/download.aspx?UniqueId=ed4e27ad%2Dda48%2D476b%2Da99a%2Dd517a54ad6db"
      },
      "type": "mip"
    }
  },
  {
    "category": "storage",
    "target": {
      "info": {
        "folder": "%USERS%\\Downloads"
      },
      "type": "local"
    }
  },
  {
    "category": "fileEvent",
    "target": {
      "info": {
        "event": "DownloadFile_FromCloud"
      },
      "type": "local"
    }
  }
]
}

// 여러문서 선택시 Zip파일에 대한 질의 json
{
    "decisionFactors": [
        {
        "category": "document",
        "target": {
            "info": {
                "ext": "zip",
                ...
                "zoneIdentifier": "https://japaneast1-mediap.svc.ms/transform/zip?cs=fFNQTw"
            },
            "type": "zipArchive"
        }
        },
        {
        "category": "storage",
        "target": {
            "info": {
                "folder": "%USERS%\\Downloads"
            },
            "type": "local"
        }
        },
        {
        "category": "fileEvent",
        "target": {
            "info": {
                "event": "DownloadFile_FromCloud"
            },
            "type": "local"
        }
        }
    ]
}

3-2 ztcap Policy Configuration Precautions​

⚠️When setting the policy, the following items must be considered for the Ztcap policy to be set so that the function operates.

  • The policy settings for target.info.zoneIdentifier of the json object with category document in decisionFactors are required.

    • The policy value of target.info.zoneIdentifier in the json object where category is document in decisionFactors should be set to a value that can include the ZoneIdentifier Url entered in the downloaded document during download.
    • Example) The URL of the downloaded document ishttps://japaneast1-mediap.svc.ms/transform/zip?cs=fFNQTwWhen assuming that the policy value of target.info.zoneIdentifier in the json object with category document among the decisionFactors set in the Ztcap policy should be "*mediap.svc.ms/transform/zip*" Set by attaching wildcards (*) before and after a part of the URL, as shown.

  • It is not recommended to include the policy value of **"ds"** for the target.type of the json object where the category is document in decisionFactors (assuming there are DRM documents in the cloud, but this feature is fundamentally for converting general documents and mip documents in the cloud into DRM documents).

  • the target.info.event of the json object with category fileEvent in decisionFactors must be**"DownloadFile_FromCloud"**Set as value

    //Ztcap 정책 예시
    "category": "document",
      "targets": [
        {
          "type": "normal",
          "use": true,
          "operation": "AND",
          "info": {
            "ext": [
              "pptx",
              "zip",
              "xlsx",
              "pdf",
              "ppt",
              "doc",
              "xls",
              "docx"
            ],
            "zoneIdentifier": [ // 다운로드 받은 문서의 zoneidentifier url이 정책에 포함되어야함
              "*microsoftonline.com*",        
              "*sharepoint.com*",
              "*mediap.svc.ms/transform/zip*"
            ]
          }
        }

        ....
        {
          "category": "fileEvent",
          "targets": [
            {
              "type": "local",
              "use": true,
              "operation": "OR",
              "info": {
                "event": [
                  "DownloadFile_FromCloud" // 파일 이벤트는 DownloadFile_FromCloud가 설정되어야함함
                ]
              }
            }
          ]
        }

3-3 ztcap policy settings default included policies​

info

When downloading documents from cloud storage (OneDrive, SharePoint, Teams), the URL information entered in the document Zone.identifier must be included in the default ztcap policy, and additional URL policies may be required depending on future changes from the client or the cloud side.

  • The URL value of the ztcap policy below must be included in the policy.
    • *mediap.svc.ms/transform/zip*
    • *sharepoint.com*
    • *microsoftonline.com*
info

How to Add Cloud Storage URL Policy

  1. Check the Zone.Identifier file of the downloaded file
# 명령 프롬프트(cmd)에서 확인
more < "filename:Zone.Identifier"
  1. Add policy based on URL information found in the Zone.Identifier file
  • Check the values of the ReferrerUrl or HostUrl fields.
  • Add the domain part of the URL to the policy
    • When adding a policy, a wildcard (*) will automatically be added to the front and back of the domain during registration.
  • example
    • https://example-cloud.com/download → example-cloud.comInput →*example-cloud.com*Completed after application :::

4. Application Method​

  1. Module Patch
  2. Ztcap policy settings (3. Application of items related to Ztcap policy is mandatory)
  3. Custom Policy Settings

5. Constraints​

  1. browser'sSecret WindowNot supported when using.
  • Reason: In secret mode, the browser does not leave the downloaded URL information in the ZoneIdentifier area. Therefore, due to the conditional policy that operates based on the download URL, the download conversion policy cannot function, and thus the download conversion feature is not supported in secret mode.
  1. Cloud storage other than OneDrive, SharePoint, and Teams is currently not supported.
  2. This feature was developed to capture the download point using a hook method, so if the logic for writing zoneidentifier information is changed in browsers other than the supported versions below or in later versions, the functionality may not work.
programversion
Msedgeimg
Chromeimg
TeamsAppimg
  1. Custom Policy Settings for Windows and Document Security
  • The ZoneIdentifier usage On/Off Windows setting (registry) should be set as follows.
    • Registry path: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments
    • Registry value:SaveZoneInformation : 2 (or the item must not exist for the document conversion function to work during download)
SaveZoneInformation valueZone Identifier (MoTW) Save StatusSecurity Warning Display Status (Generally)
1 (Enabled)Not savedNot displayed
2 (Disabled/Not Configured)storage boxDisplayed
  • Document Security Custom Policy
    • DS_NOT_USE_SENDLOG_ZONE_IDF custom policy 0 or policy not used (removed)
      • If the above custom policy is set to 1, the ZoneIdentifier will not be registered in the downloaded document file. (SaveZoneInformation: set to 1)
      • The cloud download document conversion feature operates through hooking at the time of ZoneIdentifier registration.

Check detailed reasons for failure in case of conversion failure​

1. Overview​

This is a feature that allows users to directly check which policy and reason caused the conversion to fail for documents that are blocked by policy during the document conversion process.

Previously, only a simple failure message was displayed in case of conversion failure, making it difficult for users to identify the cause. However, this feature allows for the provision of evaluation results by policy and localized reasons, enabling users to perform self-diagnosis.

2. Operation Flow​

  1. The user executes the document conversion task.
  2. When the conversion is complete, the success/failure status for each document will be displayed in the conversion results list.
  3. exposed in the failure document**[View Details]**When you click the button, a detailed modal of the failure reason will be displayed.
  4. In the modal, you can check the evaluation results of the policies applied to the document in order of priority.

3. Conversion Result List​

After performing the conversion task, visually distinguish and display the success/failure status for each document in the result list.

User ScreenContentNote
To the right of the failure item**[View Details]**Button ExposureLimited to policy-based failure items

4. Failure Reason Detail Modal​

Failure Document's**[View Details]**When you click the button, a modal will be displayed where you can check the policy evaluation results for the corresponding document.

4.1 Policy List

  • List of policies applied to this documentPriority 순It is displayed sorted by.
  • Each policy is basicFolded stateIt is indicated as 로, and you can click to expand and check the detailed evaluation results.
  • The policy that determines the conversion result is highlighted separately for user identification.

4.2 Evaluation Results by Policy

When each policy item is expanded, the evaluation results of the next item are displayed step by step.

Evaluation CriteriaExplanation
ConditionMatching conditions for policy application (file extension, path, user, group, etc.)
Excluded ConditionMatching conditions for exclusion from the application of the policy
Decision FactorFactors that ultimately determine the application or blocking of the policy (e.g., label, classification result, etc.)

4.3 Display by Match Reason (matchReason) Type

The UI is branched to provide clear guidance to users based on the matching reason types returned as a result of the policy evaluation.

Conversion Progress Guide at Document End​

1. Overview​

In a structure where grade application and document conversion are performed together at the end of the document, if multiple files (about 10) are closed simultaneously, the tasks come in all at once and are processed sequentially (the others wait while one is in progress). Regardless of whether grade settings are applied, a large number of tasks can accumulate just from the conversion.

This feature is for the user at this point.**Which file is being processed and how far along is it?**It guides through a separate notification window, visualizing to prevent the user from attempting other tasks or force quitting during processing.

2. Feature Summary​

When you end the user task process (such as Office), the conversion progress notification window will automatically appear.

  • Guide Window Configuration
    • Title: Dynamic transition between in progress / completed two states
    • Target File List: File 1 line = 1 document. File format icon + file name + status badge
    • Status Badge: Converting (spinner) / Success (green check) / Failure (red exclamation mark) 3 types
    • Guide text: During the process, the message "Program execution and document opening are temporarily restricted during conversion" will be displayed. If there are any failed items, a separate notification message will be shown.
    • Help link: "Need help?" button — Open external URL configured by the administrator
    • Confirm Button: Deactivate during progress → Activate when all tasks are completed + Automatically close after 5 seconds
  • Multilingual support for 6 countries (KOR / ENG / JPN / CHN / DEU / RUS)
  • Even when multiple PIDs are terminated simultaneouslyAccumulate all items in a single host window(Prevent separate window pop-ups)
  • If all task completion signals do not arrive within a certain period, the notification window will automatically switch to a completed state and close itself (to prevent permanent display).

3. Operation Flow​

  1. The user closes the last document of the workflow, such as Office, or ends the process.
  2. The client detects the termination and starts conditional policy evaluation for each document that is closing.
  3. Before the first policy evaluation — Display guide window (if a window has already been displayed, accumulate items)
  4. When each file processing is complete — the Badge for that item changes from "In Progress" to "Success" or "Failure"
  5. When all policy processing of the closing process is completed — change the title of the notification window to completed status, activate the confirm button.
  6. 5 seconds later — The notification window will automatically close (users are also allowed to close it directly with the confirm button)

4. User Screen​

statusscreen
In progress of conversion
Conversion complete
info

During the process, the confirm button is disabled, preventing the user from closing the window before the task is completed. Once all items are finalized, the confirm button is activated and will automatically close after 5 seconds.

5. Resource Information —DSRes*.iniadditional key​

Common to 6 country resource files[DocCloseProgress]Add a section. Each key is first looked up in the INI file corresponding to the system locale of the operating environment, and if the key is empty or the INI is an old version, the prompt safely falls back to the English default.

keyPurposeNote
TITLE_IN_PROGRESSGuide Window Title — In Progress StatusFor example) "After document completion, applying document conversion and security level"
TITLE_DONENotification Window Title — Completion StatusFor example) "Document conversion and security level application completed"
INFO_IN_PROGRESSIn-progress notification message — 2 sentences (\nseparated by1. Notice that program execution and document opening are temporarily restricted. 2. Notice that it may take time depending on the number and size of files.
INFO_FAILEDMessage displayed when there are failed items upon completionExample) "There is a failed file. Please try again later or contact the administrator."
BUTTON_CONFIRMConfirm Button LabelExample) "Confirm"
BUTTON_HELPHelp Button LabelExample) "Do you need help?"
STAGE_CONVERTINGItem Badge — Converting TextFor example) "Converting"
STAGE_SUCCESSItem Badge — Success TextExample) "Success"
STAGE_FAILEDItem Badge — Failure TextExample) "Failure"
HELP_URL"Need help?" External URL that opens when the button is clicked.Language agnostic. Administrator configuration
  • When a key is missing: Fallback to the English default for that key only (use INI values for other keys)
  • INI itself is an old version ([DocCloseProgress](No section itself): The entire dialog box is displayed in English by default, and the conversion and policy processing actions themselves are not affected.

White List Document Conversion​

According to the whitelist policy1:1 mappingThis is a feature for converting documents in a way. DS 6.0 ENT'sappAuthWorks only in mode.

1. Overview​

defined by the operatorSource → TargetConversion is allowed only for documents registered in the mapping policy. Conversion of documents not registered in the policy isBlock AllIt will be done. Set the conversion policy to a custom policy.

itemvalue
IDDS_MIP_DOC_CONV_WHITE_LIST
TYPEEDIT
Policy Value FormatTARGET_DOC_TYPE:ID|DEST_CONVERT_DOC:ID

3. Policy Format Description​

  • TARGET_DOC_TYPE— Type of the original document
  • DEST_CONVERT_DOC— Type of the document to be converted
  • ID— Document Identifier (MIP Label ID, Grade Document ID, Category Document ID, etc.)

4. Document Type (Type)​

typeExplanation
MIPDocument labeled with MIP
MACCategory (MAC) Document
GRADEDocument with Assigned Grade
DACPersonal Document (ID can be omitted — converted to the personal document of the logged-in user)

5. Policy Example​

Example 1 — ABCDMIP document with label ID to grade document IDGRADEID0001Allow Roman conversion:

MIP:ABCD|GRADE:GRADEID0001

Example 2— Category Document IDMAC000002to MIP label IDEFGHAllow Roman conversion:

MAC:MAC000002|MIP:EFGH

Example 3— Simultaneous application of two policies (semicolon;Separated by:

MIP:ABCD|GRADE:GRADEID0001;MAC:MAC000002|MIP:EFGH

6. Constraints​

  • Since it is a WhiteList method, the conversion of all documents not registered in the policy is blocked.
  • In DS 6.0 ENT, the Linker feature is used when directly converting to personal, grade, or category documents, allowing the converted documents to be displayed with the Linker document icon.

Endpoint Pre-conversion When Uploading Files Using the Teams Copilot Tab​

1. Overview​

Microsoft Teams Desktop App'sCopilot tabWhen the user attaches a security document via file upload / drag and drop / paste method,Pre-conversion on the user's PC (Endpoint) sideThis is a feature that delivers it to Teams.

1-1. The reason why this feature is needed​

This feature is fundamentally**Teams Copilot's prompt cannot directly read the contents of DRM protected documents.**was developed to solve the constraints. If you attach DRM secure documents to the Copilot tab, Copilot will not recognize the content of the document, resulting in broken answers or failed queries.

To avoid this, this feature allows users to attach security documents at the time they are in the Copilot tab.**Pre-conversion to a format that Copilot can read on the user PC just before sending to the cloud.**It will also resolve the following two issues that were occurring due to conversion delays.

  • Cloud-side conversion delay due toCopilot Query Error
  • Before the conversion is completed, Copilot partially reads the contents of the security document.The phenomenon of broken responses

1-2. The conversion direction can be freely set with conditional policies.​

The conversion direction of this feature isIt is not fixed.. The operator can freely decide how to configure the ZTCAP conditional policy.

  • Standard Scenario — DRM → MIP Conversion: Convert DRM-secured documents that Copilot cannot read into documents with MIP (Microsoft Information Protection) labels. The main use case for this feature.
  • Example — MIP → DRM Conversion: According to the operational policy, the scenario of attaching MIP documents to Copilot and converting them back into DRM secure documents for delivery. If the transformation direction item of the ZTCAP policy is configured that way, it is possible.
  • Other conversion directions supported by ZTCAP (e.g., general documents → DRM, etc.) can also be applied in the same policy configuration manner.

In other words, this feature is**"Perform pre-transformation at the Endpoint when attaching the Copilot tab."doingTrigger·Infrastructure**provides,Actual conversion directionThe administrator freely decides the transformation direction item of the ZTCAP conditional policy.

1-3. Relationship with Download Conversion​

This feature performs pre-conversion on the Endpoint side during cloud download.Cloud Download Document Conversion FeatureofUpload Direction Symmetrical Plateand reuses the same conditional policy (ZTCAP) infrastructure and the SCRA·SCPD module structure.

📌 Summary: When you attach a security document to the Teams Copilot tab, Teams will only upload the result that has been automatically converted on the PC according to the ZTCAP conditional policy just before sending it to the cloud. The standard usage is DRM → MIP conversion, and depending on the policy configuration, other directions such as MIP → DRM are also possible.

This feature isTwo custom policiesWorks with. Both are set in the policy management screen of the SHIELD DRM admin page. The detailed policy value of HOOK_LOAD_DYNAMIC (module injection string) is managed in the conversion details.

2-1. DS_MIP_INIT.CopilotDocuConv— Copilot Tab · Path Identification Enhancement Policy (Optional)​

This feature measures the window caption pattern of the Teams Copilot tab at the time of shipment.Copilot | Microsoft Teamsetc) and user document path patterns (excluding system folders)Built-in within the clientand is doing so. However, the captions in Teams may change in future updates, or the client company may need to use or block specific non-standard paths.Reinforcement through policy only without client redeploymentThis policy has been implemented to enable you to do so.

IDDS_MIP_INIT(Existing policy'sCopilotDocuConvkey)
TYPEJSON
Policy Value FormatDS_MIP_INITas a sub-object of JSONCopilotDocuConvAdd
Application MethodUnion— The fallback value embedded in the client is the pattern specified in the policy.additionalOkay. The operator only needs to specify the new pattern to be added (no need to duplicate the fallback).

Policy Value Example (JSON):

{
  "CopilotDocuConv": {
    "captionPatterns": [
      "Copilot | Microsoft Teams",
      "Copilot 그룹 채팅 | Microsoft Teams"
    ],
    "excludePathPatterns": [
      "c:\\users\\public\\share-temp\\"
    ]
  }
}
  • captionPatterns: A list of window caption patterns that EnumWindows must find when the Copilot tab is activated. Partial matching.
  • excludePathPatterns: User document path in this conversionList of path prefixes to exclude. System Folder(c:\windows\ / c:\program files) is always excluded and cannot be changed by policy.

📌 Action when policy is not set: It works normally with only the built-in fallback value of the client. This policy should only be set when caption or path change response is needed.

⚠️ Korean Pattern: Policy data is correctly interpreted with UTF-8 encoding even if it contains Korean. Fallback processing is applied to ensure it works in an ANSI (CP949) encoding environment at the time of shipment.

3. Conditional Policy Event Definition​

This feature is the conditional policy (ZTCAP) engine of SHIELD DRM.A new event triggeradds.

itemvalue
Frontend (Admin UI Label)Upload Files with Teams Copilot Tab
Backend (Event Key)UploadFile_ToTeamsCopilot
ExplanationEvents that occur when a file is uploaded to the Copilot tab in the Teams desktop app. The determination of whether it is the Copilot tab is made on the client side based on the window caption.

UI Layout:

[조건부 정책] > [Endpoint] > 정책 등록 > 정책 기본 정보 > 문서 이벤트 > CloudIt will be displayed as a single checkbox item under the category. ExistingCloud에서 파일 다운로드It is at the same level as the item.

Document Events > Cloud  
├─ Downloading Files from Cloud              (Existing, DownloadFile_FromCloud)  
└─ Uploading Files to Teams Copilot Tab     (New, UploadFile_ToTeamsCopilot)

💡 A separate URL list management tab will not be introduced. The identification of the Copilot tab is performed by the internal logic of the client (window caption + user path + three-layer defense of revalidation just before conversion).

4-1. Example of decisionFactors queried to ZTCAP at the Endpoint during function operation​

The form of JSON that the client queries the ZTCAP engine at the time of attaching a single docx DRM secure document with the Teams Copilot tab.

{
  "decisionFactors": [
    {
      "category": "document",
      "target": {
        "info": {
          "ext": "docx",
          "zoneIdentifier": ""
        },
        "type": "ds"
      }
    },
    {
      "category": "storage",
      "target": {
        "info": {
          "folder": "%USERS%\\Documents"
        },
        "type": "local"
      }
    },
    {
      "category": "fileEvent",
      "target": {
        "info": {
          "event": "UploadFile_ToTeamsCopilot"
        },
        "type": "local"
      }
    }
  ]
}

📌 Difference with the download path: Unlike download conversion, this upload conversion isOriginal Security Document of Local Diskfor the targetzoneIdentifierThe value is generally empty,category=documentoftypeisds(DRM Security Document) ornormal / mipis.

4-2. Precautions When Setting ZTCAP Policy​

⚠️ When downloading, it is necessary to share common execution policies when bundling conversion policies.

  • decisionFactorsoffileEventkeyUploadFile_ToTeamsCopilotWowDownloadFile_FromCloudSpecifying together is allowed on the ZTCAP engine (event multiple selection). However, what can be bundled in one policy are two events.Common Execution Policy(For example: Sharing the conversion from DRM to MIP). If the enforcement policies are different, register them as separate policies.
  • decisionFactorsofdocument.target.typepolicy value =ds(DRM Security Document) ornormal / mipSelected according to operational requirements. Unlike downloading,dsAvailable (The main scenario for this feature is converting local DRM documents to MIP).
  • document.target.info.ext= List of target file extensions. This specifies the extensions supported by this feature (13 in total). See § 7.

ZTCAP Policy Example:

"category": "document",
"targets": [
  {
    "type": "ds",
    "use": true,
    "operation": "AND",
    "info": {
      "ext": ["pptx","ppt","pps","ppsx","pptm","xlsx","xls","xlsb","xlsm","docx","doc","docm","pdf"]
    }
  }
],
...
{
  "category": "fileEvent",
  "targets": [
    {
      "type": "local",
      "use": true,
      "operation": "OR",
      "info": {
        "event": ["UploadFile_ToTeamsCopilot"]
      }
    }
  ]
}

4-3. Default Included Policies When Setting ZTCAP Policy​

This feature targets local security documents, so the cloud URL whitelist (*sharepoint.com*etc.) isNot needed.. This is the key difference with the download conversion feature.

5. Application Method​

The steps the operator must follow to activate this feature are as follows.

  1. Module Patch— Check if the module version that supports this feature is deployed on the user's PC (refer to conversion details for specific module and version).
  2. Custom Policy Settings — HOOK_LOAD_DYNAMICpolicymsedgewebview2.exeCheck if the target includes 4 items (refer to conversion details for specific policy values).
  3. (Optional) Caption·Path Reinforcement— If the Teams caption has changed from the shipment fallback or if exclusion of non-standard paths is necessary,DS_MIP_INIT.CopilotDocuConvSets up __PH_0__ (§ 2-1).
  4. ZTCAP Conditional Policy Registration— Admin PageTeams 코파일럿 탭으로 파일 업로드Register a new policy with an event and specify the transformation action and label (§ 4).
  5. Restart the Teams app after waiting for the policy update on the user PC.— Teams app is newHOOK_LOAD_DYNAMICTo recognize the policy, a restart of the Teams App is required.

6. Summary Table of Actions by Policy Combination​

This feature has three policies (HOOK_LOAD_DYNAMIC / ZTCAP UploadFile_ToTeamsCopilot / DS_MIP_INIT.CopilotDocuConv) operates as follows depending on the combination.**The rows marked in bold are the standard configuration for this feature to operate correctly.**is.

#HOOK_LOAD_DYNAMIC(Module Injection)ZTCAP UploadFile_ToTeamsCopilot(Conversion Policy)DS_MIP_INIT.CopilotDocuConv(Caption·Path Reinforcement)Operation Result
1✅ Settings✅ Registration(omitted)✅ Normal operation— Teams Copilot tab attachment → Pre-conversion → MIP document upload → Copilot normal response
2✅ Settings✅ Registration✅ Settings✅ Normal operation— Same as above, recognizing caption and path addition patterns.
3❌ Not set✅ Registration(Non-related)❌ Not working — The hook module is not loaded in Teams WebView2, so the event itself does not occur.
4✅ Settings❌ Unregistered(Non-related)⚠️ Partial Operation — The endpoint detects the event but has no transformation policy to apply, so no transformation is performed. It is uploaded as is.
5✅ Settings✅ Registration (Extension Limit)(Non-related)⚠️ Select Action — ZTCAPextOnly convert extensions included. Extensions not included should be uploaded as is.
6✅ Settings✅ Registration❌ Caption pattern changed (policy not reinforced)⚠️ Temporary Malfunction — After the Teams update that changed the captions, there may be no conversion due to the failure to identify the Copilot tab. Resolved by policy reinforcement (§ 2-1)
7✅ Settings✅ Registration(Non-related)⚠️ Temporary Guard Action — The same path that failed to convert within 30 seconds is blocked from retrying for 30 seconds (§ 8-3). Automatic recovery after 30 seconds.

💡 After changing the policy combination, the user must restart the Teams App on their PC for some changes to take effect immediately.

7. Supported Extensions​

The extensions supported as conversion targets for this feature are as follows:13 itemsis. The operator of the ZTCAP policydocument.target.info.extOnly the extensions included in the list must be specified for the conversion to be performed.

Classificationextension
Word Series.docx, .doc, .docm
Excel Series.xlsx, .xls, .xlsb, .xlsm
PowerPoint Series.pptx, .ppt, .pps, .ppsx, .pptm
PDF.pdf

📌 This list is shared memory within the client(shmSupportExt) managed by __PH_0__, and cannot be changed arbitrarily by the operator (client patch required when extended).

8. Transformation Operation Characteristics​

8-1. Conversion Time​

  • In-house measurements: Teams Copilot tab attachment point to completion takes about __PH_0__2.8 seconds(Log capture ON environment standard).
  • Operating Environment: In a general user environment where log capture is OFF, it is shorter than the above measurement and is at a practically acceptable level.
  • After attaching, the progress status will be briefly displayed in the Teams UI, and then the Copilot response will start normally.

8-2. Temporary File Management​

This feature saves the conversion results to a secure temporary folder and then delivers them to Teams. Temporary files are automatically cleaned up according to the following rules.

  • FIFO Queue Method: The converted temporary file is up to5 itemswill be preserved in the queue, and when the limit is exceeded, from the oldest item2 eachIt will be automatically deleted.
  • PC Shutdown / Teams App Shutdown Timing: This function module cleans up the remaining items in the queue in bulk when it is normally detached (DLL_PROCESS_DETACH).
  • Therefore, immediately after the conversion, Copilot does not delete the temporary file right away to recognize the temporary file correctly, and even when multiple files are attached, they are safely organized in order after being preserved for a certain period of time.

8-3. Retry Guard on Temporary Failure​

If a specific file conversion temporarily fails (e.g., external SDSEnc environment issues, etc.),Block conversion retries for the same file on the same path for 30 secondsdoes.

  • After 30 seconds, automatic retry will be possible.
  • This guard action simultaneously prevents infinite retries due to environmental temporary issues and the risk of exposing DRM originals.
  • If a user re-attaches the same file while the conversion is blocked, it will not be uploaded as the original but will follow the conversion block flow.

9. Main Flow​

9-1. Administrator Policy Registration Flow​

  1. Access the SHIELD DRM admin page.
  2. Log in with an account that has administrator privileges.
  3. LNB menu조건부 정책→ SubmenuEndpointSelect.
  4. 정책 등록Click the button.
  5. 문서 이벤트in the itemCloud > Teams 코파일럿 탭으로 파일 업로드Select.
  6. Target Document · Members · Document Execution Policy(MIP 로 암호화+ Configure existing conditional policy items such as label selection).
  7. Save the policy and wait for the client PC side policy update.

9-2. User Attachment Action Flow​

  1. The user launches the Teams app and activates the Copilot tab.
  2. Attempts to attach the security document using one of the methods: file upload / drag and drop / paste.
  3. The endpoint is as follows3 Line DefenseDetermines whether the feature is applicable based on __PH_0__.
  • 1st step — Check if the file path is the user's document path + if the extension is a supported extension (fastest filter)
  • 2nd Step — Check if the Teams Copilot tab is active (Windows caption check)
  • 3rd Stage — Re-verify the same conditions just before the transformation (Prevent Race)
  1. If all three stages are passed, query the ZTCAP policy to determine whether the transformation action will occur.
  2. If determined to be a target for conversion, it decrypts the security document and creates a temporary file with the MIP label applied.
  3. Teams sends the conversion result temporary file to the cloud instead of the original.
  4. Copilot recognizes the converted MIP document correctly and responds to user queries.

10. Constraints​

  • Teams web upload not supported: Teams web exposes the same URL for all tabs, making it impossible to identify the Copilot tab. This feature is excluded from the scope.
  • Teams Chat / Channel Board Upload Not Supported: Outside the primary scope. Future separate events(UploadFile_ToTeamsChat, UploadFile_ToTeamsChannel) can be separated.
  • Mobile / iOS / Android Teams app not supported: This feature is limited to Windows Endpoint.
  • Re-upload Block (PDF): If a PDF that has been uploaded once is re-uploaded as a secure document, it will be blocked by Teams itself, and this feature cannot intervene.
  • Copilot Tab Identification Dependency: If the Copilot tab caption pattern changes due to a Teams update, this feature may temporarily not work. In this caseDS_MIP_INIT.CopilotDocuConvYou can add new caption patterns through policy registration to respond to operations without redeploying the client.
  • MIP Certification Dependency: If the application of the MIP label fails to obtain the Teams user authentication context, the conversion fails. In this case, a 30-second retry guard is activated, and it automatically normalizes after authentication recovery.
  • Unsupported by browsers other than Edge / Chrome: Teams uses WebView2 (based on Edge) internally for this feature, and other browsers are not related to this feature.