Your offline grace period has expired

I had the need to work on a Word document on a plane, from my iPad. I opened Word and normally, the last document I was working opens. But I was faced with the following message:
“Offline Grace Period Expired. Connect to the internet to continue the access your work or school account in the app.”

This puzzled me? The last time I had opened Word on my iPad was just over 24 hours before. I was working on a document stored in OneDrive for Business. I had closed Word and used my iPad for other things that day.
On that flight, I opened Word expecting to be able to continue to work on a document.

I began to think it was a licensing issue. I know that Office Pro Plus for desktop checks the Activation and Validation Service to verify the license status and extend the offline grace period. You must be online and use Office at least once every 30 days, or Office will enter reduced functionality mode.
Did the same rules apply to Office apps on the iPad? Surely the offline grace period for Office apps wasn’t less than 30 days? It appeared to be 24 hours, given that I opened Word 24 hours beforehand.

How Office app licensing works

Office apps are free to use on screen sizes equal to or less than 10.1 inches and only if the apps are being used for non-commercial purposes.
• If you want to use the Office apps on Android and iOS devices for commercial purposes, you require an Office 365 account with an Office Pro Plus license.
• Add your account to the app (while online of course.) You can add multiple accounts. (I have added two from different Office 365 tenants, both with Office Pro Plus enabled.)
• Adding your account to Office is firstly added to the Authenticator app. The Authenticator app is used with all apps that authenticate with Office 365, Microsoft accounts and Azure AD.
• The app is licensed to use Office.
• When you open a document, the app checks to see if the device is online. It will open a local copy of the document and sync any recent changes from the online copy.
• If the device is offline, it will start an offline grace period. The guidelines are that you should make sure you’re online at least once a month while using Office apps.

So it wasn’t a licensing issue. That’s when I started to investigate access policies.

InTune App Protection Policy

InTune provides Mobile Device Management and Mobile Application Management to protect corporate data. By using device enrolment and app policies, a personal or corporate device can ensure that data doesn’t fall into the wrong hands. When a device is enrolled, policies are applied that enforce password usage, prevent copy and paste from programs, and lock data if a device has been offline for a period of time.
Think through this scenario. A mobile device is stolen. It may be offline as soon as it moves out of range of the wireless network it was connected to. Or if is connected to a mobile network, it will remain online till you contact your mobile network provider, report the theft and get the connection locked. The data is still on the device and accessible. But when the device has an app protection policy, it can lock the data after a specified period of time.

I had recently enrolled my iPad with an InTune subscription. It applied a device policy for iOS and an app protection policy. There weren’t many changes to the default settings in the app protection policy. I discovered that one default setting was doing it’s job very well.

An Offline grace period allows a protected app to run while offline till the period expires. The default is 720 minutes (12 hours.)
I had not opened the Word app for over 12 hours. I opened it during the flight where there was not internet connection. The app protection policy took effect and I was prevented from opening Word and the document I was working on. It protected the app and the data.
If I had begun to work on the document in the departure lounge while tethered to my mobile, I would have restarted the offline grace period and been able to continue work during the flight.

I learned a few lessons from my inconvenience. It prompted me to find out how Office apps are licensed.
I now know the effect of default settings for an application protection policy, in respect of access requirements and the offline grace period.
When I implement application protection policies in our production tenant, I’ll communicate the best practise for making a document available offline. Open the document shortly before getting on a plane. 😉

Also published on Medium.