Technical Reference Manual

Introduction

Companies across industries, including automotive, aviation, and high-tech manufacturing, create and manage valuable intellectual property (IP) in the form of CAD drawings. These drawings are often shared with customers, suppliers, and partners to support business operations. Sharing sensitive design data, however, introduces security risks that can lead to unauthorized access, modification, or distribution.

HaloCAD helps organizations protect CAD files by integrating with Microsoft Purview Information Protection (MPIP). It applies sensitivity labels and protection policies to CAD files, helping organizations safeguard their intellectual property throughout its lifecycle.

How does HaloCAD protect your data?

HaloCAD integrates with Microsoft Purview Information Protection, formerly known as Microsoft Information Protection (MIP), to provide Enterprise Digital Rights Management (EDRM) capabilities for CAD files. HaloCAD applies Microsoft Purview Information Protection sensitivity labels to CAD files and enforces the associated protection policies. Protected files can be accessed only by authorized users according to the permissions defined in the applied sensitivity label.

HaloCAD Add-on for CAD can operate as a standalone solution or integrate with HaloCAD for PLM. When integrated with a supported PLM system, HaloCAD automatically protects downloaded files, decrypts files during upload, and stores them securely in the PLM vault.

HaloCAD Add-on for CAD applications

About this Manual

This manual provides the common information shared across all HaloCAD products, including product architecture, prerequisites, licensing, and shared configuration requirements. For product-specific installation, configuration, administration, and operating procedures, refer to the appropriate Installation Manual and Operations Manual.

This manual covers the following products:

• HaloCAD Add-on for CAD

• HaloCAD for Viewers

• HaloCAD for TCAI

• HaloCAD for PLM

• HaloCAD for SOLIDWORKS PDM

Terminology

Throughout this manual, the following terms are used to refer to supported HaloCAD products and integrations.

Terminology

Acronyms

The following acronyms are used throughout this manual.

Acronyms

Features

HaloCAD provides the following capabilities:

1. Integration with Existing Infrastructure
   Integrates with your existing CAD and PLM environments without requiring significant infrastructure changes.

2. CAD File Protection
   Extends Microsoft Purview Information Protection to supported CAD applications by applying sensitivity labels and protection policies to CAD files.

3. Rights Management
   Protects CAD files by applying Microsoft Purview sensitivity labels together with user-defined permissions.

4. Persistent Data Protection
   Protects sensitive files wherever they are stored or shared, including cloud and mobile environments.

5. Policy-Based Access Control

   1. Controls who can access protected files.

   2. Controls the actions users can perform, such as viewing, editing, copying, printing, exporting, relabeling, or modifying permissions.

   3. Supports watermarking for sensitive documents.

6. PLM Integration
   Automatically protects files during download and removes protection from files during upload before storing the unprotected files in the PLM vault.

Related Documentation

The following documents provide additional information about HaloCAD products.

HaloCAD-related documentation

HaloCAD Add-on for CAD

HaloCAD Add-on for CAD is a standalone solution that provides the HaloCAD PROTECT feature. It enables users to access protected CAD files, enforces the permissions defined in the applied sensitivity labels, and allows authorized users to apply or modify MPIP sensitivity labels.

Architecture

HaloCAD Add-on for CAD integrates with Microsoft Purview Information Protection to provide persistent protection for CAD files. When creating a CAD file, users authenticate with MPIP. After successful authentication, HaloCAD downloads the available sensitivity labels. Users then select an appropriate sensitivity label and apply it to the file. In standalone mode, users apply sensitivity labels manually.

Only authorized users can open or modify protected files. The applied protection remains with the file regardless of where it is stored or shared. User permissions are determined by the applied sensitivity label and its associated protection policy. The following figure illustrates the HaloCAD Add-on for CAD operating as a standalone solution.

HaloCAD as a standalone add-on

Note: When HaloCAD Add-on for CAD is integrated with HaloCAD for PLM, files are automatically protected according to the configured action rules before they are made available to users.

Quick Start

The following figure illustrates the high-level process for setting up the HaloCAD Add-on for CAD.

Quick start installation steps for HaloCAD Add-on for CAD

Prerequisites

Refer to the section “Prerequisites”.

HaloCAD for PLM

HaloCAD extends data protection to supported Product Lifecycle Management systems. The supported integrations include:

• HaloCAD for Teamcenter

• HaloCAD for Windchill

• HaloCAD for Autodesk Vault

HaloCAD for PLM integrates with supported PLM systems and combines the capabilities of HaloCAD PROTECT and HaloCAD MONITOR while utilizing Microsoft Purview Information Protection (MPIP) to provide Enterprise Digital Rights Management (EDRM) for CAD files. It automatically protects files during download and removes protection from protected files during upload.

Architecture

HaloCAD for PLM continuously monitors file upload and download operations within the PLM environment. It integrates with Microsoft Purview Information Protection to download sensitivity labels and perform file encryption and decryption.

• During file upload, HaloCAD for PLM checks whether the file is protected. If the file is encrypted, HaloCAD for PLM decrypts it before storing it in the PLM Vault.

• During file download, HaloCAD for PLM applies protection based on the configured action rules before delivering the file to the user.

For file uploads, HaloCAD for PLM performs file processing independently. For file downloads, HaloCAD for PLM relies on HaloENGINE GenNXT to evaluate the configured classification and action rules.

The following figure illustrates the high-level architecture of HaloCAD for PLM.

HaloCAD for PLM

HaloENGINE GenNXT integrates with Microsoft Purview Information Protection to download sensitivity labels and make them available for configuration. It evaluates metadata based on the configured classification and action rules to determine the appropriate protection action. All file downloads must comply with these rules.

During a file download, HaloCAD for PLM sends the relevant file metadata to HaloENGINE GenNXT. HaloENGINE GenNXT evaluates the metadata, determines the required protection action and sensitivity label, and returns the result to HaloCAD for PLM. HaloCAD for PLM then applies the appropriate protection before delivering the file to the user.

Quick Start

The following figure illustrates the high-level process for setting up HaloCAD Add-on for CAD with HaloCAD for PLM.

Quick start installation steps for HaloCAD for PLM

Prerequisites

Refer to the section “Prerequisites”.

HaloCAD for SOLIDWORKS PDM

HaloCAD for SOLIDWORKS PDM integrates with SOLIDWORKS PDM and combines the capabilities of HaloCAD PROTECT and HaloCAD MONITOR while utilizing Microsoft Purview Information Protection (MPIP) to provide Enterprise Digital Rights Management (EDRM) for CAD files.

Architecture

HaloCAD for SOLIDWORKS PDM continuously monitors SOLIDWORKS PDM folders to protect CAD files during file operations.

• When users copy or move files from a SOLIDWORKS PDM folder to a non-SOLIDWORKS PDM location, HaloCAD for SOLIDWORKS PDM automatically protects the files before they reach the destination.

• When protected SOLIDWORKS CAD files or PDF files are copied or moved into a SOLIDWORKS PDM folder, HaloCAD for SOLIDWORKS PDM detects the protected files, decrypts them, and stores the decrypted files in the SOLIDWORKS PDM vault.

HaloENGINE GenNXT evaluates the configured classification and action rules to determine the protection to apply during copy and move operations. Its role is the same as described in HaloCAD for PLM.

The following figure illustrates the high-level architecture of HaloCAD for SOLIDWORKS PDM.

HaloCAD for SOLIDWORKS PDM

Quick Start

The following figure illustrates the high-level process for setting up the HaloCAD Add-on for CAD with HaloCAD for SOLIDWORKS PDM.

Quick start installation steps for HaloCAD for SOLIDWORKS PDM

Prerequisites

Refer to the section “Prerequisites”.

HaloCAD for Viewers

HaloCAD for Viewers enables users to access HaloCAD-protected CAD files in supported CAD viewer applications. It integrates with Microsoft Purview Information Protection to enforce the permissions defined in the applied sensitivity labels.

Architecture

HaloCAD for Viewers provides view-only access to HaloCAD-protected CAD files. It prevents users from modifying, copying, or taking screenshots of protected content.

The application is intended for external users, such as suppliers and partners, who need to access protected CAD models or drawings without installing the HaloCAD Add-on for CAD. The following figure illustrates the high-level architecture of HaloCAD for Viewers.

HaloCAD for Viewers

Quick Start

The following figure illustrates the high-level process for setting up HaloCAD for Viewers.

Quick start installation steps for HaloCAD for Viewers

Prerequisites

Refer to the section “Prerequisites”.

HaloCAD for TCAI

HaloCAD for TCAI uses Microsoft Purview Information Protection to decrypt HaloCAD-protected CAD files during bulk loading operations in Teamcenter Integration for Autodesk Inventor (TCAI). This enables the TCAI Bulk Loader to scan and process protected Inventor files before importing them into Teamcenter.

Architecture

The Teamcenter Integration for Autodesk Inventor Bulk Loader imports Inventor files into Teamcenter. However, the Bulk Loader cannot recognize or process protected (encrypted) Inventor files directly. HaloCAD for TCAI decrypts protected Inventor files before they are processed by the Bulk Loader. This enables the Bulk Loader to scan and import the files into Teamcenter.

HaloCAD for TCAI uses the same decryption mechanism as HaloCAD for Viewers and is designed specifically to support bulk loading operations in the TCAI environment. The following figure illustrates the high-level architecture of HaloCAD for TCAI.

HaloCAD for TCAI

Quick Start

The following figure illustrates the high-level process for setting up HaloCAD for TCAI.

Quick start installation steps for HaloCAD for TCAI

Prerequisites

Refer to the section “Prerequisites”.

Prerequisites

This chapter describes the prerequisites for installing and configuring HaloCAD components.

Prerequisites by Product

Register an Application in Microsoft Entra ID - Public client/native

This section describes how to register an application in Microsoft Entra ID, obtain the Application (client) ID and Directory (tenant) ID, assign the required API permissions, and upload the certificate required for MPIP authentication.

Create an Application

Follow the instructions below to register an application:

1. Log in to the Microsoft Entra admin center using an account that has administrator privileges.

2. If you have access to multiple tenants, click the Settings icon in the top menu. From Directories + subscriptions, select the tenant in which you want to register the application.

3. The application homepage opens.

   

   Selecting Microsoft Entra ID

4. In the left navigation pane, select Entra ID > App registrations.

5. On the App registrations page, click New registration or Register an Application. The Register an Application button appears only if no applications have already been created.

   

   New application registration

6. On the Register an application page, configure the following:

   

   Application details

7. Name: Enter an appropriate name for the application.

8. Supported account types: Select which account you would like your application to support. For detailed information on these types, please see Microsoft documentation.

   1. Single tenant only – <your tenant>: For users or guests in your tenant.

   2. Multiple Entra ID tenants: For users from any Microsoft Entra tenant.

   3. Any Entra ID Tenant + Personal Microsoft accounts: For users from any Entra tenant and personal Microsoft accounts.

   4. Personal accounts only: For personal Microsoft accounts only.

   5. Redirect URI: Select Public client/native (mobile & desktop), and enter a valid redirect URI. For example, https://localhost.

9. Click Register.

10. The Overview page of the newly registered application opens.

    

    Application ID and Tenant ID

11. Once registration is complete, the portal displays the following values. To copy and save the ID value in a text editor, hover your cursor over it and click the Copy to clipboard icon.

    1. Application ID – also known as Client ID.

    2. Directory ID – also known as Tenant ID.

Add Required Permissions

To protect content using the MIP SDK, you need to provide the following API permission(s) for the created application ID.

1. In the left navigation pane of the application, select API permissions.

2. Click Add a permission. The Request API permissions page appears.

3. Under the Select an API setting, select APIs my organization uses. A list appears, containing the applications in your directory that expose APIs.

4. Type in the search box or scroll to find the required API that is mentioned in the table below, “Required Permissions”.

5. For example, type Microsoft Information Protection Sync Service. You can see the API listed as shown in the figure below:

   

   Searching for permissions

6. Now, click on the displayed API. You can see two permissions on the page − Delegated permissions and Application permissions.

7. Click the Delegated permissions button and then, under the Permission section, select the check box against "Read all unified policies a user has access to".

   

   Adding permission

8. Click Add permissions. Repeat the steps outlined above to add the other required permissions listed in the table below.

9. The API permissions page opens, and the added permissions appear in the table. Administrator consent is not required for Delegated Permissions.

   

   API Required permissions

10. The following table lists the required permissions.

Required permissions

Register an Application in Microsoft Entra ID - Web

Creating an application in Microsoft Entra ID is similar to the steps in the previous section. However, for HaloCAD for PLM, some variations apply.

1. Under Redirect URI, select Web.

2. Add the permissions listed in the following table.

3. Click Grant admin consent for your <company>.

4. When the confirmation dialog appears, select Yes to approve.

5. After the consent is granted, the Status column changes to Granted.

Required permissions #1

Additional Permission (Only for Decryption)

The permissions mentioned above are adequate for applying the MPIP label to a file with the owner as SPN (Service Principal Name) ID or any user email ID. Additionally, the HaloENGINE GenNXT Tomcat Service requires the following superuser privilege for the decryption function when the owner is not as SPN.

Required permissions #2

Upload the Certificate

The HaloENGINE GenNXT Tomcat Service uses certificate-based authentication to access MPIP services. Therefore, you must upload the certificate to the registered application before proceeding with the configuration.

Prerequisites: 

1. Certificate: 

   1. Ensure that you have a valid certificate containing the following key properties: -KeyExportPolicy Exportable and -KeySpec Signature.

   2. The certificate can also be self-signed. As a best practice, use a self-signed certificate only in a test environment.

2. Local Computer certificate store: The certificate required for MPIP authentication must be installed in the Local Computer certificate store, along with the Root CA and Intermediate CA certificates.

   1. If the certificate is CA-signed, install all related certificates in their respective stores (Root, Intermediate, and Personal).

   2. If the certificate is self-signed, install it in both the Trusted Root Certification Authorities and Personal stores of the Local Computer.

To upload the certificate, follow these steps:

1. In the sidebar of the application page, select Certificate & secrets. 

2. Under Certificates, click Upload certificate. The Upload certificate dialog box opens.

   

   Upload certificate #1

3. Click the folder icon, select the certificate, and click Open. For example, the file DESKTOP001.cer is used.

4. Click Add. The certificate is uploaded, and its thumbprint appears on the page.

   

   Upload certificate #2

The following table lists the Microsoft Entra ID application types that must be registered when using HaloCAD Add-on for CAD, HaloCAD for Viewers, HaloENGINE GenNXT, or HaloCAD for PLM.

Create and Configure the Sensitivity Labels

As an administrator, you can create, configure, and publish sensitivity labels for various levels of content sensitivity based on your organization's classification taxonomy. Use names or terms that are familiar to your users. Consider starting with label names like Personal, Public, General, Confidential, and Highly Confidential if you don't already have a taxonomy in place. For more information, see the Microsoft documentation.

Office 365 Subscription Details

1. Fully configured Microsoft Purview Information Protection.

2. An Office 365 subscription is required to use Azure RMS and MPIP functionality.

3. A working Microsoft Entra ID service must be available.

4. Transport Layer Security (TLS) 1.2 or higher must be enabled to ensure the use of cryptographically secure protocols at all client workstations. Please refer to the section “Enable Support for TLS 1.2 at the Client Workstation for Microsoft Entra ID”.

5. To use the Revoke Access feature, the user must be assigned an Azure Information Protection Premium P1 or P2 license. This license is not required for the Viewer Add-on.

6. Monitor logging: Your subscription must include Log Analytics on the same tenant as Microsoft Entra ID.

Recommended URLs, Addresses, and Ports for MPIP

MIP SDK does not support the use of authenticated proxies. So, make sure you set the Microsoft 365 endpoints to bypass the proxy. View a list of endpoints at “Microsoft Online Documentation”. However, Microsoft recommends the following:

Recommended endpoints

Sovereign cloud: For Microsoft 365 U.S. Government GCC High and DoD environments, configure the required Microsoft service endpoints. For endpoint details, see Microsoft 365 U.S. Government GCC High endpoints.

Secude License Manager for HaloCAD

To communicate with Secude License Manager for HaloCAD, the following URL and port must be whitelisted in the customer's proxy:

Recommended license manager endpoint

Enable TLS 1.2 for Microsoft Entra ID Authentication

To improve tenant security and comply with industry standards, Microsoft Entra ID stopped supporting the following Transport Layer Security (TLS) protocols and ciphers:

1. TLS 1.1

2. TLS 1.0

3. 3DES cipher suite (TLS_RSA_WITH_3DES_EDE_CBC_SHA)

To authenticate with Microsoft Entra ID, TLS 1.2 must be enabled on the client workstation. For instructions, refer to the Microsoft documentation on enabling TLS 1.2 in the following link: Microsoft article to enable TLS 1.2.

Complete the following steps:

1. Update the Windows Operating System

2. Update .NET Framework

3. Set the following registry settings:

Registry entries

License Administration

HaloCAD uses license keys to enable product features. Obtain a valid license key from Secude Support before installing HaloCAD. For information about purchasing or renewing licenses, contact your Secude representative.

HaloCAD supports the following license activation methods:

1. Secure Installation (Recommended): Uses an encrypted configuration file (hc.conf.enc) that contains the license key and Microsoft Entra ID application details. During installation, HaloCAD automatically initializes the application and activates the license. For more information, refer to the “Secure Installation” section.

2. UI-based manual license activation: Allows administrators to activate the license manually after installation by entering the license key through the HaloCAD user interface. For more information, refer to the “UI-based Manual License Activation” section.

3. License Activation in Silent Mode: Uses an encrypted configuration file to automatically initialize the application and activate the license during a silent installation. For more information, see the Installation Manual.

4. License activation via Microsoft System Center Configuration Manager: Uses an encrypted configuration file together with the installer to deploy and activate HaloCAD across multiple workstations. For more information, refer to the Installation Manual.

The following figure illustrates the license activation process.

License activation

Secure Installation (Recommended Method)

To protect sensitive configuration information, HaloCAD supports secure installation by using an encrypted configuration file.

The HaloCAD Admin Utility encrypts the Microsoft Entra ID application details, cloud configuration, and license key into an encrypted configuration file (hc.conf.enc). During installation, HaloCAD automatically reads the configuration from the encrypted file, initializes the application, and activates the license without requiring users to enter the Microsoft Entra ID application details manually.

Administrators can securely distribute the encrypted configuration file without exposing tenant information or license details.

HaloCAD Admin Utility Tool

The HaloCAD installation package includes the hc.admintool.exe utility.

Prerequisites

Before running the utility, collect the following information:

• Microsoft Entra ID application details

• Cloud type

• License key

  Note
  A license key is not required for HaloCAD for Viewers or HaloCAD for TCAI.

How to Encrypt the Configuration File

1. Copy the admintool folder from the installation package to a local directory. For example, C:\Users\superdocs\Desktop\admintool.

2. Open Command Prompt as an administrator (Run as Administrator).

3. Navigate to the directory of the admintool folder and type hc.admintool.exe and press Enter.

   

   Admin tool with help command

4. Enter the required details. For example, 
   Cloud type: Commercial - hc.admintool.exe v6ca776-c74e-437d-98ef-662ecb5751tt https://localhost 9c1cfc28-1ec6-44ea-bec6-e3492ef0cd16 B27N-CMTO-LWGH-AKEQ Commercial
   Cloud type: US_DoD - hc.admintool.exe v6ca776-c74e-437d-98ef-662ecb5751tt https://localhost 9c1cfc28-1ec6-44ea-bec6-e3492ef0cd16 B27N-CMTO-LWGH-AKEQ US_DoD
   Cloud type: Custom - hc.admintool.exe v6ca776-c74e-437d-98ef-662ecb5751tt https://localhost 9c1cfc28-1ec6-44ea-bec6-e3492ef0cd16 B27N-CMTO-LWGH-AKEQ Custom https://api.aadrm.com https://dataservice.protection.outlook.com

5. The output window appears as follows: 

   

   Admin tool displaying the output

6. HaloCAD add-on for Creo: The following help commands are specific to the HaloCAD add-on for Creo.

   

   Admin tool with help command for Creo add-on

   

   Admin tool displaying the output with ECTR integration (only for Creo add-on)

7. HaloCAD for SOLIDWORKS PDM: The following help commands are specific to HaloCAD for SOLIDWORKS PDM.

   

   Admin tool displaying the output for SOLIDWORKS PDM

8. HaloCAD for Viewers and TCAI: The following help commands are specific to HaloCAD for Viewers and TCAI.

   

   Admin tool displaying the output for Viewers and TCAI

Result:

• The utility replaces hc.conf.json with the encrypted hc.conf.enc file.

• Distribute hc.conf.enc with the HaloCAD installation package.

• Always use the version of hc.admintool.exe included with the current installation package. Configuration files created with earlier releases are not supported.

Next steps

1. Copy hc.conf.enc to the same directory as the HaloCAD installer.

2. Run the installer.

3. Complete the installation by following the Installation Manual.

UI-based Manual License Activation

This section explains how to activate a HaloCAD license using the user interface. If you experience problems activating the license, refer to the Troubleshooting chapter in the Operations Manual.

Prerequisite: Ensure that HaloCAD is installed.

1. Open the CAD application for which the add-on was purchased.

2. When the license warning message appears, click OK.

   

   HaloCAD license warning message

3. On the HaloCAD tab, click About.

4. Verify that the license status is None.

   

   License Status: None

5. Click Activate.

6. The HaloCAD License Activation screen appears:

   

   HaloCAD activation screen

7. Enter the license key provided by Secude.

8. Click Activate.

Result:

• The following confirmation message appears:

  

  Activation success message

• Click OK.

• The license status changes to Active.

  

  License Status: Active

Related tasks:

• If you click the pencil icon (Click to change label) to label the file, the Rights Management Service prompts you to sign in. Click OK, and then enter your credentials.

• After successful authentication, the labels can be retrieved from Microsoft Purview Information Protection, and the HaloCAD Ribbon is activated. For more details, please refer to the Operations Manual.

License Renewal After Expiration

HaloCAD licenses are valid until the specified expiration date. After a license expires, HaloCAD displays a warning message when the CAD application starts. To continue using HaloCAD, obtain and activate a new license key.

Prerequisite: Before reactivating the license, obtain a new license key from Secude.

Option 1: Automatic Activation Using the Admin Tool

1. Run the admin tool with the new license key, as explained in the section “How to Encrypt the Configuration File”.

2. Navigate to the configuration directory containing the old hc.conf.enc file and replace it with the one created in the previous step.

3. Restart the application.

Result:

• The HaloCAD license key is now automatically activated.

• You can start protecting CAD files.

Option 2: Manual Activation Using the About Dialog

1. Open the CAD application.

2. Go to the HaloCAD tab and click About.

3. Click Activate.

4. Enter the new key that Secude has provided.

Result:

• The HaloCAD license key is now manually activated.

• You can start protecting CAD files.

Appendix

Third-Party Libraries

Third-party software/code is included or bundled with Secude's products according to its appropriate license. Secude conducts testing to ensure that third-party products are compatible with and perform as intended with Secude applications.

The third-party libraries and dependencies used by the HaloCAD Add-on for CAD are shown in the table below.

Third-party libraries

The third-party libraries used by HaloCAD for Viewers, HaloCAD for TCAI, HaloENGINE GenNXT, HaloCAD for Teamcenter, HaloCAD for Windchill, HaloCAD for Autodesk Vault, and HaloCAD for SOLIDWORKS PDM are documented in their respective Installation Manuals.

Last updated: October 26, 2026