The evolution of AIP

AIP has gone through an evolution in the last few years, and you may have encountered this technology under a different name. Some of the technology’s old names are Azure Rights Management Service (Azure RMS), Azure Active Directory Rights Management (AADRM), Windows Azure Active Directory Rights Managements, Information Rights Management (IRM), or to some, simply “The New Microsoft RMS.” You’ll do yourself and Microsoft a great favor by forgetting all those old names and just sticking with AIP.

The latest iteration of this cloud technology now offers classification and labeling capabilities that can, in turn, apply rights management to protect files. At a high level, AIP protects your data in three key steps:

1. First, data is classified and labeled. For example, if a document is classified as confidential and should be available only to the recipients of the email, the label might be Confidential — Recipients Only.”
2. Next, data is protected through encryption, access control, and policies based on the label. Continuing with the preceding example, a document marked with the Confidential — Recipients Only label will be encrypted so that only the recipients can read it.
3. Finally, documents can be tracked, and access can be revoked if necessary. From the preceding example, the sender of the email may decide that one of the recipients should no longer have access to the document. In that case, the sender can revoke access for a specific user.

Office 365 Message Encryption, or OME, is one of the features in AIP. In Chapter 6, I cover the details of OME and provide step-by-step instructions for sending encrypted email by using Outlook. In this chapter, I focus on AIP features you can use in Office applications such as Word and Excel.

If you have the AIP Premium P2 license, you can avail yourself of additional functionalities, such as automatic classification for cloud and on-premises data. In this chapter, however, I cover the features available in the AIP Premium P1 license.

Activating AIP

To start using AIP, the first thing you need to do as an IT admin is to activate the service in your Microsoft 365 Business tenant. Even if you think the service is already enabled, it doesn’t hurt to verify. Here’s how:

1. Log in to https://admin.microsoft.com with your global admin credentials.

2. In the left navigation, under the Settings group, click Services & Add-ins.

   The Services & Add-ins page is displayed, as shown in Figure 12-1.

3. Select Microsoft Azure Information Protection.

   The Microsoft Azure Information Protection window is displayed on the right.

4. In the Microsoft Azure Information Protection window, click Manage Microsoft Azure Information protection settings.

   The Rights Management page is displayed, as shown in Figure 12-2.

5. Confirm that Rights Management is activated. If it isn’t, click the Activate button.

   In this example, the tenant is already activated for AIP.

After you’ve confirmed the status of your AIP settings, you can safely close the browser window or navigate back to Microsoft 365 Admin Center from the app launcher.

Getting familiar with labels

AIP comes preconfigured with default policies and labels that are applicable for most organizations, including small businesses. Before you start thinking about configuring custom labels and policies for your organization, take the time to become familiar with the default settings. You might save yourself a lot of work creating and testing custom policies.

If your tenant was provisioned after February 2018, the following labels and corresponding descriptions are already available:

• Personal: Non-business data, for personal use only.
• Public: Business data that is specifically prepared and approved for public consumption.
• General: Business data that is not intended for public consumption but can be shared with external partners as required. Examples include a company internal telephone directory, organizational charts, internal standards, and most internal communication.
• Confidential: Sensitive business data that could cause damage to the business if shared with unauthorized people. Examples include contracts, security reports, forecast summaries, and sales account data. The Confidential label is further broken down into two sub-labels:
  • Recipients Only: Confidential data that requires protection and that can be viewed only by the recipients. This label will only appear in Outlook and will apply the Do Not Forward policy.
  • All Employees: Confidential data that requires protection that allows all employees full permissions. Data owners can track and revoke content.
  • Anyone (not protected): Data that does not require protection. Use this option with care and with appropriate business justification.
• Highly Confidential. Very sensitive business data that would cause damage to the business if it was shared with unauthorized people. Examples include employee and customer information, passwords, source code, and pre-announced financial reports. The Highly Confidential label is further broken down into three sub-labels:
  • Recipients Only: Highly confidential data that requires protection and that can be viewed only by the recipients. This label will only appear in Outlook and will apply the Do Not Forward policy.
  • All Employees: Highly confidential data that allows all employees to view, edit, and reply permissions to this content. Data owners can track and revoke content.
  • Anyone (not protected): Data that does not require protection. Use this option with care and with appropriate business justification.

If your Office 365 tenant was provisioned before March 21, 2017, you’ll find that the General and Highly Confidential labels are missing. Their equivalent in the older tenants are Internal and Secret, respectively.

To further explore these labels and corresponding policies, you need to navigate to the Azure portal and access the Azure Information Protection service settings. Here’s how:

1. Follow Steps 1-4 in the preceding section (“Activating AIP”).

2. On the Rights Management page, click the Advanced Features button.

   A new browser window launches and the Azure Information Protection — Labels page is displayed, as shown in Figure 12-3.

The Confidential and Highly Confidential labels are collapsed by default. To view their sublabels, click the arrow to the left of the label to expand the selection.

A few words about policies

On the Azure Information Protection — Labels page, referenced in the preceding section, note that the labels all have Global under the Policy column. By default, AIP comes with a Global policy that is applied to all users in the tenant. You can edit this policy, but you can’t delete it. You can also create new policies and configure them to your heart’s content, but the Global policy will always be there.

To view the details of the Global policy, follow these steps:

1. Follow Steps 1-4 in the previous section (“Activating AIP”).

2. On the Rights Management page, click the Advanced Features button.

   A new browser window launches and the Azure Information Protection — Labels page is displayed (refer to Figure 12-3).

3. In the left menu, under the Classifications group, click Policies.

   On the right, the Configure Administrative Name and Description for Each Policy blade is displayed.

4. In the Policy column, click Global.

   The Policy: Global blade is displayed, as shown in Figure 12-4.

Be careful about changing the default settings in the Global policy because it is applicable to everyone in your organization. You might want to create another policy first and test it out. If you decide to change the Global policy, make sure to save your changes. (If you forget and simply close the blade, the system will prompt you to save your changes.)

Installing the AIP client

You can have the greatest policies and labels for AIP in Azure, but they’ll be no good if your end users can’t see and apply them. The AIP client, a program that is run on the end users’ devices, solves this problem.

Before you install the AIP client, make sure Office ProPlus is already installed but not running on the device. When you’re ready to install the AIP client, do the following:

1. Navigate to the AIP client download page at https://www.microsoft.com/en-us/download/details.aspx?id=53018.

   The Microsoft Download Center appears.

2. Click the Download button.

   The Choose the Download You Want window is displayed.

3. Select AzInfoProtection.exe by selecting the box, as shown in Figure 12-5, and then click Next.

4. From the notification that pops up at the bottom of your screen, click (or double-click) Run.

   The system performs a security check on the download. When the check is complete, the Microsoft Azure Information Protection window pops up, as shown in Figure 12-6.

5. Click the I Agree button.

   You can opt to install a demo policy (not recommended because it will clutter your user interface) or send usage statistics to Microsoft or both.

6. In the User Account Control window that displays, click Yes to start the installation.

   You see the progress of the installation.

7. When the Microsoft Azure Information Protection window displays Completed Successfully, click the Close button.

   The installation window disappears, and you’re now ready to check that the AIP client was successfully installed.

To verify the installation, open a blank document in Word. You see the labels below the ribbon, as shown in Figure 12-7.

Applying a label to a document

Now that the AIP client is installed, and the labels are displayed in the Office applications, it’s time to put it to the test.

1. Create a Word document and pretend that it’s highly confidential.

2. On the Sensitivity bar, click Highly Confidential and select All Employees as shown in Figure 12-8.

   The label is applied, and the other labels will disappear.

3. Run Outlook, start a new email, and attach the Word document.

   Note that Outlook displays the Sensitivity bar with the same labels you saw in Word.

4. Enter the email address of a user in your organization.

5. Enter an email address outside your organization, and then click Send.

   Outlook sends the email to the recipients with the Highly Confidential/All Employees label.

In this exercise, the email will still go out to both the internal and external user. The internal user will be able to open and read the document from the sharing invitation. The external user, however, will be blocked from opening the document and will be presented with the message shown in Figure 12-9.

Revoking access to information

As illustrated in the preceding section, AIP protects your company information from falling into the wrong hands — even after it has fallen into the wrong hands.

For example, suppose you realize that you accidentally sent a document to the wrong people and want to remedy the situation by revoking all access to the document. Here’s what you can do, continuing from the example in the preceding section:

1. Open the protected Word document from the preceding exercise.

   A yellow bar appears, indicating the sensitivity of the document and containing a button to view the permissions for the document.

2. On the Ribbon, click Home, and then click the Protect button.

   A submenu appears below the Protect button, as shown in Figure 12-10.

3. On the submenu, click Track and Revoke to launch the document-tracking site.

   Your browser launches to take you to the document-tracking site.

4. If this is the first time you’ve visited the site, log in with your Microsoft 365 Business credentials.

   After a successful login, the document-tracking site displays a summary of views of your document, as shown in Figure 12-11. Explore the tabs to see the robust features in AIP.

5. At the bottom of the document-tracking site, click the Revoke access button.

   The Revoke access page is displayed.

6. Click the Confirm button at the bottom of the page.

   The Revoke Complete window is displayed.

7. Click Continue to go back to the document-tracking page.

   In the Summary view, the document displays the Revoked stamp.

One of the features I find amazing in this solution is that in the Map tab, you can see where around the world users tried to access your document! So, if you ever find that someone from, say, Russia or Timbuktu tried to open your document even though all your users are in the United States, you’ll know that access to the document should be revoked.