Identity

The first time a user opens a right-protected document on a new device, a call is made to Azure RMS. This is an automatic and invisible check of the user’s identity, made against their Azure Active Directory. Once it’s determined the user is authenticated and authorized to access the document, the connection is, again, automatically redirected to the organization’s Azure Information Protection tenant. This will issue a certificate for the Azure RMS to retrieve the part of the document that has the authorization policy (green box in Figure 7-2). Azure RMS isn’t concerned about the contents of the document, just the policy. Your data isn’t passed through the service. Figure 7-3 shows the authentication flow.

Figure 7-3. Azure RMS Identity

Encryption

At rest, in transit, on-premise, in the cloud, or a hybrid setup—no matter what configuration you use, you can be assured that Azure RMS will protect your data. Azure RMS uses industry-standard cryptography, has worked diligently to pass many security compliances around the world, and uses a wide array of secure transmission technology to transmit your data securely. When your data is shared from SharePoint, copied to another cloud service, and even if a document is e-mailed as an attachment, your files will be protected. The protection and instructions on how to access the file travel with it.

Referring to Figure 7-4, your content (red box) is protected by an Advanced Encryption Standard (AES) symmetric encryption algorithm. This is used to encrypt and decrypt your documents. Briefly, AES symmetric encryption algorithms use one key for encryption and another key for decryption. You need both keys to access the contents of the document. If a user fails the authorization to Azure RMS, the document will be unreadable, as the user won’t receive the decryption key.

Figure 7-4. Azure RMS encryption keys

The encryption keys used are the unique keys that are generated for every document or e-mail you wish to protect (green key). Each document or e-mail protected by Azure RMS has its own key, and it travels with the document or e-mail. The decryption key (red key) is your Azure Information Protection Tenant Key. This key is common to all documents and e-mail that are protected by Azure RMS.

Authorization Policy

After the identification and authorization step is completed and a user has their authorization policy, Azure RMS decrypts and evaluates the policy to determine the user’s rights. The authorization policy is a wrapper around the document that details what can be done with the data and who can access it (see Figure 7-5).

Figure 7-5. User rights

The policy or policies for what can be done to the file can include whether it can be saved, edited, forwarded, or printed. Table 7-1 shows the rights that can be assigned and their descriptions.

Who can access the file is controlled by the permission polices. These policies can be assigned to an individual or group. Table 7-2 shows the permission polices that can be assigned and their operations.

Admin Activation

Here are the steps to activate the Admin features:

1. Browse to the SharePoint Admin page https://domain-admin.sharepoint.com/_layouts/15/online/TenantSettings.aspx .

2. Click settings on the left.

3. Select “Use the IRM service specified in your configuration.”

4. Click the Refresh IRM Settings button.

If you don’t click Refresh IRM Settings on activation (Figure 7-14), users won’t see Information Rights Management configuration settings on lists or libraries.

Figure 7-14. RMS in SharePoint Online

Library Activation

Document libraries and lists have additional settings that can be configured. Here are the steps to follow to achieve this:

1. Browse to the library or list you wish to activate.

2. Click the cog on the upper right of the library.

3. Click Library settings (Figure 7-15).

   

   Figure 7-15. Library settings options

4. Under Permissions and Management , click Information Rights Management (Figure 7-16).

   

   Figure 7-16. Information Rights Management settings

5. On the Information Rights Management Settings page, select the Restrict permission to documents in this library on download check box (Figure 7-17).

   

   Figure 7-17. Restrict permissions on library option

6. Choose a descriptive name for the policy title that coincides with the purpose of the policy. For example: A document library has Word Docs that contain the latest schematics for a new product, we don’t want our users to take screenshots of the document. We do not check the “Allow viewers to print” and name the policy “Newest Product no Print on Download” (Figure 7-18).

   

   Figure 7-18. RMS in SharePoint Online Document Library Settings

7. Click Show Options button to reveal what IRM protection can be applied. Options are listed in Table 7-6.

   Table 7-6. IRM Protection Options

   List Item	Description
   Do not allow users to upload documents that do not support IRM	Requires users to upload documents from IRM-enlightened applications only.
   Stop restricting access to the library at	Remove restricted permissions from this list or library on a specific date.
   Prevent opening documents in the browser for this Document Library	If a user doesn’t have a compatible application to view a document, Office Web Apps allows rendering of documents in the browser. Selecting this option renders the documents in the browser in Read Only Mode. Note: Screen capture prevention doesn’t work for browsers.
   Allow viewers to print	Enables printing of documents from the list or library.
   Allow viewers to run script and screen reader to function on downloaded documents	Allow people with at least the View Items permission to run embedded code or macros on a document.
   Allow viewers to write on a copy of the downloaded document	Allow users to edit the documents after download.
   After download, document access rights will expire after these number of days (1-365)	Prevents access to a downloaded document after the specified number of days.
   Users must verify their credentials using this interval (days)	Require users to re-authenticate at specific intervals.
   Allow group protection	Allow group protection, so that users can share with members of the same group.

Protecting E-mail with Outlook Client

In Outlook, start a new e-mail and click on the Options tab. Then, click the Permissions button and select the permission level you wish to protect the e-mail with (see Figure 7-19).

Figure 7-19. Protecting Outlook e-mails

Protecting a Document with Office Suite Client

In an MS Office Application, click the File Menu Option. Then click Protect Document and select the permission level you wish to protect the document with (Figure 7-20).

Figure 7-20. Protecting Office documents

Protecting Files with RMS Sharing App in Outlook and the Office Suite

Outlook and Office have different UIs, but the process is the same. Figure 7-21 shows the Outlook interface, and Figure 7-22 shows the Office interface.

Figure 7-21. Outlook and RMS Sharing App

Figure 7-22. Office and RMS Sharing App

Selecting the Share Protected option will bring up a dialog box with options to protect the file (shown in Figure 7-23). Table 7-7 lists these options and their descriptions.

Figure 7-23. RMS Sharing App dialog box

Confidential

When we assign this template to a document, the document will not be able to be shared outside your organization. Users have permission to interact with the file as they normally would; they just can’t share the file outside the organization.

Confidential View Only

When we assign this template to a document, the document will not be able to be shared outside your organization, and users have permission view to only the contents of the document.

Custom Templates

If the default templates don’t fulfill your organization’s needs, or you want to build off of them, you can create custom templates.

You can access your templates from either the Office 365 portal or the Azure portal. I have discussed both methods previously. Whichever method you choose, you’ll be taken to the same location: the Azure administration portal.

Adding New Template

Browse back to your active directory and select Rights Management (Figure 7-24).

Figure 7-24. Azure RMS Rights Management

From Manage, click Create a new rights policy template (Figure 7-25).

Figure 7-25. Create a new rights policy template

On the next window, enter the language, name of the policy, and description, then click the check mark (Figure 7-26).

Figure 7-26. Add a new rights policy template

You’ll see Azure working on creating your new template then take you back to the Azure RMS start screen. Click Manage your rights policy templates. The next screen, shown in Figure 7-27, shows the two default templates, as well as the custom template that was just created. Click the new Template.

Figure 7-27. New template creation

You can then choose to continue with the wizard to complete the next three tasks of configuring the rights, publishing the template, and other configurations. For this example, I’ll select Rights, at the top of the page (Figure 7-28).

Figure 7-28. Configuring rights

Configure Rights and Scopes for Users and Groups

Let us go back to the start screen for user rights. Click the Get Started Now link. If you have set up AD Sync, you will see a list of users and groups that are syncing from your on-premise AD. If this list is empty, AD Sync has not been set up. Select the users and/or groups you wish to add to the policy then click the check mark (Figure 7-29).

Figure 7-29. Selecting users and groups

Select the rights to the selected users and groups. You can mouse over the question mark to get more information about the right. Next, click the arrow at the lower right (Figure 7-30).

Figure 7-30. Assigning rights to selected users and groups

Azure will create the custom template and take you back to the Rights page, to display what you previously configured. Clicking Scopes will take you to a similar page as Rights. In this screen, you select the users or groups that will be able to apply this template. By default, all users and groups in your organization can apply this template.

Additional Configurations and Publishing Your Template

Clicking Configure takes us to the screen where we can Publish and select other configurations . The top of the page is where we can choose to Publish the template, making it accessible to users and groups within our organization, or we can choose to Archive the template, removing it from view from our Office Applications, Azure, and Office 365 (Figure 7-31 and Table 7-8).

Figure 7-31. Publishing a template

When all configuration items are set for the policy, scroll back to the top of the page and click Publish and then Click the Disk icon at the bottom of the page, to publish the template (Figure 7-32).

Figure 7-32. Saving publishing options

Once published, all users and groups selected during the template creation will now see this template (Figure 7-33).

Figure 7-33. Template status shown as “Publish”