A method, comprising: receiving by a file management service executed by at least one computing device , from a client device , a request to obtain a file from a data store on behalf of a user account; determining by the file management service that a content policy specifies that the requested file must be protected at rest on the client device using a first information rights policy; applying by the file management service the first information rights policy to the requested file to generate a protected file in response to a determination that the content policy specifies that the requested file must be protected at rest on the client device ; transmitting by the file management service the protected file and the content policy to the client device in response to generating the protected file; and characterized by detecting by a management service , which executes the file management service , an enrolment of the client device with the management service ; upon enrolment of the client device , generating by the management service a configuration profile for the client device ; then transmitting the configuration profile to the client device ; then causing the configuration profile to be installed on the client device , the configuration profile comprising an administrator credential, wherein the administrator credential is accessible by a file management application of the client device , wherein the administrator credential is inaccessible by a user of the client device , and wherein access to the transmitted file when the transmitted file is protected according to the content policy is permitted based on the administrator credential. receiving by a file management service executed by at least one computing device , from a client device , a request to obtain a file from a data store on behalf of a user account; determining by the file management service that a content policy specifies that the requested file must be protected at rest on the client device using a first information rights policy; applying by the file management service the first information rights policy to the requested file to generate a protected file in response to a determination that the content policy specifies that the requested file must be protected at rest on the client device ; transmitting by the file management service the protected file and the content policy to the client device in response to generating the protected file; and characterized by detecting by a management service , which executes the file management service , an enrolment of the client device with the management service ; upon enrolment of the client device , generating by the management service a configuration profile for the client device ; then transmitting the configuration profile to the client device ; then causing the configuration profile to be installed on the client device , the configuration profile comprising an administrator credential, wherein the administrator credential is accessible by a file management application of the client device , wherein the administrator credential is inaccessible by a user of the client device , and wherein access to the transmitted file when the transmitted file is protected according to the content policy is permitted based on the administrator credential. <EOS>