A method, comprising: receiving by a file management service executed by at least one computing device, from a client device, a request to obtain a file (136, 155) from a data store on behalf of a user account; determining by the file management service that a content policy (137, 157) specifies that the requested file (136, 155) must be protected at rest on the client device using a first information rights policy; applying by the file management service the first information rights policy to the requested file (136, 155) to generate a protected file in response to a determination that the content policy (137, 157) specifies that the requested file (136, 155) must be protected at rest on the client device; transmitting by the file management service the protected file and the content policy (137, 157) to the client device in response to generating the protected file; and characterized by detecting by a management service, which executes the file management service, an enrolment of the client device with the management service; upon enrolment of the client device, generating by the management service a configuration profile for the client device; then transmitting the configuration profile to the client device; then causing the configuration profile to be installed on the client device, the configuration profile comprising an administrator credential, wherein the administrator credential is accessible by a file management application of the client device, wherein the administrator credential is inaccessible by a user of the client device, and wherein access to the transmitted file (136, 155) when the transmitted file (136, 155) is protected according to the content policy (137, 157) is permitted based on the administrator credential. receiving by a file management service executed by at least one computing device, from a client device, a request to obtain a file (136, 155) from a data store on behalf of a user account; determining by the file management service that a content policy (137, 157) specifies that the requested file (136, 155) must be protected at rest on the client device using a first information rights policy; applying by the file management service the first information rights policy to the requested file (136, 155) to generate a protected file in response to a determination that the content policy (137, 157) specifies that the requested file (136, 155) must be protected at rest on the client device; transmitting by the file management service the protected file and the content policy (137, 157) to the client device in response to generating the protected file; and characterized by detecting by a management service, which executes the file management service, an enrolment of the client device with the management service; upon enrolment of the client device, generating by the management service a configuration profile for the client device; then transmitting the configuration profile to the client device; then causing the configuration profile to be installed on the client device, the configuration profile comprising an administrator credential, wherein the administrator credential is accessible by a file management application of the client device, wherein the administrator credential is inaccessible by a user of the client device, and wherein access to the transmitted file (136, 155) when the transmitted file (136, 155) is protected according to the content policy (137, 157) is permitted based on the administrator credential.