> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/protect/getting-started/protect-quick-start-guide.md).

# PROTECT Quick Start Guide

## Overview

GuardWare PROTECT encrypts and secures all file types, including MS Office documents, PDFs, images, videos, and AutoCAD files. It ensures files remain protected from unauthorised use and theft, whether stored locally or shared externally via USB, cloud drives, email, or other methods. Only authorised users and applications can open protected files. These users and applications are configured in the **GuardWare Management Console** by **administrators**.

End users interact with GuardWare PROTECT Client through the [Windows Explorer right-click menu](/protect/protect-features/protect-features.md). From there, users can protect sensitive files by applying classifications, restricting access to specific Security Groups, limiting file circulation, adding an expiry date, and so on.

For Microsoft Office files, PROTECT works with Microsoft Purview Information Protection (MIP) to apply protection based on the file's classification. See [PROTECT and MIP](/protect/encryption-and-policies/protect-and-mip.md) for more details.

### What this guide covers

* Console sign-in and admin access
* Microsoft 365 integration and key setup
* Agent download and endpoint rollout
* Security Groups and User Policies
* Applications and Office protection

{% hint style="warning" %}
Before getting started, make sure you have installed the GuardWare Server and can access the GuardWare Management Console URL.
{% endhint %}

{% stepper %}
{% step %}

### Log in to the Console

1. Open the GuardWare Management Console.
2. Sign in with your Super Admin or organisation admin account.
3. Complete 2FA, accept the EULA, and change the password if prompted.
   {% endstep %}

{% step %}

### Microsoft 365 integration

Before integrating, ensure you have:

* An active Microsoft Azure subscription. We recommend using a *Pay-As-You-Go* subscription.
* Access to the Microsoft Azure Portal with the required administrative permissions.

Without an active Azure subscription, GuardWare PROTECT cannot be implemented.

1. Navigate to ***ORGANISATION > Integrations.***
2. Click **Connect Microsoft 365**.
3. Sign in with a **Global Administrator** account.
4. Review the requested permissions.
5. Select **Consent on behalf of your organisation**.
6. Click **Accept**.

This creates the Azure application that PROTECT uses for Azure Key Vault setup.
{% endstep %}

{% step %}

### Set up Azure Key Vault and Key Server

We recommend creating the key vault from the Management Console.

1. Navigate to ***PROTECT > Key Vault***.
2. Click **Log in with Azure**.
3. Sign in with an account that has Azure admin permissions.
4. Select the **Subscription**.
5. Choose or create the **Resource group**.
6. Enter a unique **Key Vault name**.
7. Select the **Region** and **Pricing tier**.
8. Click **Create**.

See [Key Vault](/protect/reports-and-configs/office-add-in.md#set-up-azure-key-vault-through-the-management-console) for more details.
{% endstep %}

{% step %}

### Download the PROTECT Agent

1. Navigate to **Resources** > **Agent Download**.
2. Go to **PROTECT Agent**.
3. Enter your Azure external and internal domains and location.
4. Click **Submit**. The Download link only appears after the configuration is complete.

Once the installation settings are complete, the **Download Installer** link becomes available. Click it to download the agent with the configured settings.
{% endstep %}

{% step %}

### Whitelist PROTECT on endpoints

Whitelist PROTECT in the endpoints' AV, EDR, or XDR platforms.

1. Add `C:\Program Files\GuardWare\PROTECT` to the allowlist.
2. Add `C:\ProgramData\Guardware` to the allowlist.
3. Allow `GWProtectDesktop.exe` to reach `<KeyVaultName>.vault.azure.net` over the port `443`.

See [Whitelist GuardWare PROTECT](/setup-and-deploy/install-protect-agent/whitelist-protect.md) for the full list of files, services, and network exceptions.
{% endstep %}

{% step %}

### Install PROTECT Agent on endpoints

1. Run the PROTECT Agent installer on the endpoint.
2. Complete the setup wizard.
3. Install Azure CLI or Visual C++ if prompted.
4. Restart the device when installation finishes.
5. In the Welcome wizard, click **Login with Azure**.
6. Select the correct **Tenant ID** and **Subscription**.
7. Allow **GWProtectDesktop** through the Windows firewall if prompted.

After the agent is installed and the user signs in, the device appears in [PROTECT Devices](/protect/users-and-devices/protect-devices.md). From there, admins can enable or disable the agent, uninstall the agent, and open user details to enable or disable a user, enable or disable Force Encrypt, and decrypt files for that user.

See [Install PROTECT Agent](/setup-and-deploy/install-protect-agent/install-protect-agent.md) for full device setup.
{% endstep %}

{% step %}

### Create Security Groups and assign users

Security Groups define who can open protected files.

1. Navigate to ***PROTECT > Security Groups.***
2. Click **+New Security Group**.
3. Create the group manually or import it from AD.
4. Choose the encryption mode.
5. Save the group.
6. Click **+Assign Users** to add members.

Any new user who signs in successfully is added to **All Users** by default.

See [Security Groups](/protect/users-and-devices/security-groups.md) for more details.
{% endstep %}

{% step %}

### Create a User policy and assign users

User Policies control which client actions users can access.

1. Navigate to ***PROTECT > User Policies***.
2. Click **+New User Policy**.
3. Enter the policy title and description.
4. Enable the features your users need.
5. Save the policy.
6. Assign the policy to users.

See [User Policies](/protect/encryption-and-policies/user-policies.md#user-policies) for more details.
{% endstep %}

{% step %}

### Add applications

Applications define which programs can open, edit, and save protected files.

1. Navigate to ***PROTECT > Applications***.
2. Click **+New Application**.
3. Enter the **Executable Name** and **Application Suite**.
4. Add the **Folder Path** if needed.
5. Define which extensions the application can encrypt and decrypt.
6. Enable **Network Drive Support** if required.
7. Click **Save**.

See [Applications](/protect/encryption-and-policies/user-policies.md#applications) for more details.
{% endstep %}

{% step %}

### PROTECT Office

Choose how Office files are protected.

You can use:

* **MIP only**
* **MIP and PROTECT**
* **PROTECT only**

To configure this:

1. Navigate to ***ORGANISATION > Integrations***.
2. Enable **Protect Office files using MIP** if required.
3. Enable **Protect Office files using both MIP and PROTECT** if you want layered protection.
4. Click **Submit**.

See [Protection Mode](/protect/encryption-and-policies/protect-and-mip.md) for more details.
{% endstep %}

{% step %}

### Optional next steps

After the baseline setup, you can expand the rollout.

* Configure [Data Types and classifications](/data-governance/data-governance/data-classification.md)
* Configure [Websites](/protect/encryption-and-policies/user-policies.md#websites) and [Office Add-in](/protect/reports-and-configs/office-add-in.md#office-add-in)
* Set up [SCAN & ENCRYPT](/protect/encryption-and-policies/scan-and-encrypt.md) if you need to locate and encrypt files with sensitive data located in file servers and SharePoint.
  {% endstep %}
  {% endstepper %}

With these steps complete, PROTECT is ready to protect files across your organisation using the policies, groups, and applications you configured.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.guardware.com/protect/getting-started/protect-quick-start-guide.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.