some file

Enterprise Workspace

The Enterprise Workspace runs native Windows applications, such as Microsoft Office, in an isolated workspace on the user's own device. Business data stays inside the workspace, separate from the personal environment around it, and controls such as clipboard and screen-capture restrictions apply to the applications inside. It is part of Netzilo's Secure Workplace.

You configure it in an Enterprise Workspace component of a profile under Endpoint > Profiles. See the Enterprise Workspace configuration guide.

The Enterprise Workspace exists only on Windows x64 devices with the full (administrator) install of the Netzilo client. Windows on ARM, non-admin installs, macOS and Linux get no workspace, whatever the profile says. Saving profiles needs the Enterprise plan on Netzilo Cloud; self-hosted servers include it.

The problem it solves

The Enterprise Browser secures work that happens in a browser. Much business work happens in native desktop applications instead. On a contractor's or a personal laptop, those applications and their files sit on an unmanaged device, mixed with everything personal. Virtual desktop infrastructure solves this with a full remote desktop per user, which is heavy, costly and slow to provision. The Enterprise Workspace gives the same separation on the device the user already has.

How it works

  1. A profile with an Enterprise Workspace reaches a Windows x64 device in one of the profile's groups.
  2. The Netzilo client creates the workspace and places shortcuts for the work applications on the Desktop and under Start Menu > Programs > Netzilo, in the folder the profile names. The applications must already be installed on the device; profiles do not distribute software.
  3. The user starts work applications from those shortcuts. They run isolated from the rest of the device, under the profile's restrictions.

What it does

  • Isolation. Work applications run in an isolated environment. With an Encryption Key, the workspace's data lives on an encrypted disk image (or, with Use Workspace Filesystem, in an encrypted folder). Without a key, the applications are isolated but their data is not on a separate encrypted disk.
  • Data controls. Restrict the clipboard between work and personal applications, printing, screen sharing and key-logging; add a watermark or a coloured border; record the desktop while work applications are open; and harden the applications against debugging and memory injection.
  • Its own network identity. With a setup key, the workspace joins your network as its own peer, named <host>-WORKSPACE, and its traffic reaches only what that peer's groups and policies allow.
  • Posture checks. Optional checks are evaluated continuously. When one fails, the work-application windows are blurred until the device passes again.
  • Wipe on close. Optionally, everything created in the workspace is deleted when the last work application closes.

What users see

  • Work applications start from the shortcuts folder on the Desktop and in the Start menu, not from their usual icons.
  • Windows may carry a watermark or a coloured border; copying and pasting may be blocked; the windows may not appear in screen shares.
  • Blurred windows mean a posture check is failing, for example disk encryption or the screen lock is off.
  • When an administrator changes the workspace settings, users see Your workspace will be restarted in N seconds. and should save their work.