Azure RMS and SharePoint Online

EMS Landing page

Have a look a this document which describes in detail how to configure Information Rights Management for SharePoint Online.

Set up Information Rights Management (IRM) in SharePoint admin center

Sign in to the Office 365 Admin Center

http://portal.microsoftonline.com

 

Choose Admin > SharePoint. You’re now in the SharePoint admin center.

Choose Settings. On the Settings page, in the Information Rights Management (IRM) section, choose "Use the IRM service specified in your configuration".

Then choose Refresh IRM Settings.

Go to the list or library for which you want to configure IRM.

On the ribbon, click the Library tab, and then click Library Settings (If you are working in a list, click the List tab, and then click List Settings).

Under Permissions and Management, click Information Rights Management.

On the Information Rights Management Settings page, select the "Restrict permission to documents in this library on download" check box.

To apply additional restrictions to the documents in this list or library, click Show Options.

That's it. You have now configured Information Rights Management to protect SharePoint Online documents - simple.

 

RMS Protection Tool

EMS Landing page

Have a look at the RMS Protection Tool which was announced as generally available this week. See the announcement here 

"The RMS Protection Tool contains PowerShell Cmdlets designed for developers and IT professionals who want to use scripting mechanisms to bulk protect and unprotect documents".

With this release, you can do the following:

• Use admin-defined templates and ad-hoc policies to protect documents.
• Protect documents of any type - Office file formats, PDFs, text, images, and generic file protection.
• Use the Cmdlets on Azure RMS and on-premises AD RMS.
• Service-to-service authentication for Azure RMS scenarios - for server workloads, it is important that the application is authenticated silently, which can be achieved using these Cmdlets.

Download the tool from:

https://www.microsoft.com/en-us/download/details.aspx?id=47256

The download includes x86 and x64 installers and a PDF file explaining the PoSH cmdlets.

Prerequisites
.Net 3.5
AD RMS Client 2.1

Now run the appropriate installer for the tool and the cmdlets are installed under the module "RMSProtection". Get-Help gets you further information on each cmdlet.

The available cmdlets are as follows:

Get-RMSFileStatus (returns RMS protection status of the specified file or files)

Get-RMSServer (returns the list of all AD RMS servers that can issue templates for the user)
  
Get-RMSTemplate (returns a list of AD RMS templates)

New-RMSProtectionLIcense (creates and returns a new ad-hoc license from scratch. The license object returned can be used by Protect-RMSFile to encrypt a file or files)

Protect-RMSFile (protects using RMS encryption the specified file or the files in a specified folder)

Unprotect-RMSFile (unprotects using RMS encryption the specified file or the files in a specified folder)

Get-RMSServerAuthentication (gets the status of the S2S credentials - shows the credentials previously set by Set-RMSServerAuthentication)

Set-RMSServerAuthentication (sets the status of the S2S credentials)


 

 

An Overview of Azure RMS including custom templates

EMS Landing page

Simon May presented an excellent Microsoft Virtual Academy session yesterday. The session described and demonstrated Azure Rights Management Services. You can find the video in the Enterprise Mobility Core Skills section.

Azure Rights Management Services Core Skills Jump Start
 
The following areas were discussed:

• Activating Azure RMS
• Protecting the files your users share
• Tacking and revoking usage of protected files
• Building and managing templates
• Integrating with on-premises services

This is the Microsoft description of that particular session:

Learn how to protect your organization's data with Azure Rights Management Services (RMS), and share securely inside and outside your organization. Plus, find out why information protection is a 100-percent "must have" for your organization, and get hands-on experience and technical know-how from Microsoft experts. 

Azure RMS looks like a really exciting technology. Have a look at some TechNet Library documents for some RMS details.

What is RMS

Activating RMS
 
As soon as the service is activated, you have two default templates that administrators and users can select to quickly and easily apply information protection to files. But you can also create your own custom templates for additional options and settings.

After I watched the session I dived right in to test the technology and it's really cool. Let's see what it looks like. It's so easy to configure and use. I've separated this blog into the following sections:

• Activate RMS
• Assign Licenses to user
• Create RMS template
• Use RMS template to protect email 

Activate RMS

Launch your Azure Portal and open Azure Active Directory.

Select "Rights Management".

Select "Activate". I have already Activated in the screenshot above. Note that you can also "deactivate" RMS if you wish. You are now ready to assign RMS licenses to users.


Assign RMS Licenses to users

There are two ways to do this.

Assign licenses associated with your Office 365 subscription...... or.....

......you can assign your Enterprise Mobility Suite (EMS licenses). Just drill into the EMS license.....

.....and add the required users.


Create RMS Template

OK. let's get started. Open Rights Management again and select your organization.

 The "Getting Started with Rights Management" wizard is launched. Choose to create a new template.

Choose your language and enter a name and description.

The template has been created. Now choose to "Manage templates". 

See the default templates and the custom template that we created. Select the new template for configuration.

Choose "Configure rights for users and groups".

Click "Get Started Now".

Select the users or groups that will be allowed to use the template. Note that Groups must be mail-enabled to be available for selection.

I've chosen some test users.

Now we must assign the required RMS rights to our users. You can choose one of the pre-configured roles (or create a custom role) 

Viewer: View, Reply, Reply All

Reviewer: View, Edit, Reply, Reply All, Forward

Co-Author: View, Edit, Copy, Print, Reply, Reply All, Forward

Co-Owner: All Rights

Custom: Assign Right Individually

I've chosen Custom this time as I want to see how securely I can send emails. 

I've chosen the very minimum here. I just want the recipient to be able to "View Content".

Now select Configure so that we can publish the template. Click to Publish.

We can configure other options like "Content Expiration" and "Offline Access".

 

The template status is now "Published". We're not quite finished yet. I have to refresh the templates so that my users can see them. I'm testing with Outlook Web App so I need to use PowerShell.

 

Launch Azure PowerShell and connect to your subscription. Execute the following command to refresh the templates:
  

Import-RMSTrustedPublishingDomain -Name "RMS Online - 1" -RefreshTemplates -RMSOnline 

Verify that the template has been added:

Get-RMSTemplate -TrustedPublishingDomain "RMS Online - 1" -Type All

Finally, for each imported template that you want to be available in the Outlook Web App, you must use the Set-RMSTemplate cmdlet and set the Type to Distributed

Set-RMSTemplate -Identity "<name of the template>" -Type Distributed 

To refresh templates for Office 2013 users: 

Office 2013 refreshes templates every 7 days by default. You can speed that up by using a registry editor and deleting the data for the LastUpdatedTime value 

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\MSIPC\<MicrosoftRMS_FQDN>\Template 

Restart your Office applications

Users will see new template immediately. 

To refresh templates for Office 2010 users: 

Just log off and back on again.

Use RMS template to protect email.

Now we come to the business end. What is the experience like for users?

A user creates a new email and chooses Options > Set Permissions. See all the available templates (including my custom template).

I've chosen the custom template and the email can be sent.

The recipient gets the email and can only view the content. This is really cool and highly secure. Note that any attachments would be "rights protected" also. Test some scenarios and see what you think.

Remember that I was testing here using Exchange Online. If you use Exchange On-premise you must install the RMS Connector. I'll be reviewing that shortly.

In my next blog I'll be having a look at the RMS Sharing App and RMS Document Tracking.

Azure RMS Sharing App & RMS Document Tracking

EMS Landing page

In the last blog we looked at Azure RMS and how it can be used to protect emails. We saw an example of a "rights protected" email using Outlook Web App. However the solution is only supported using Microsoft email clients. What happens if we want to send an email to a colleague and they wish to open that protected email on an Android or iOS device. Enter the Azure RMS Sharing App. Microsoft released the RMS Sharing App at the end of 2014. The announcement was made in the Official RMS Team Blog. You can read that article here

This is an extract: 

"First, we know that you desire built-in support for RMS into Microsoft Office on all platforms. We currently support RMS in Office 2010, Office 2013, and Office 365 but lack comprehensive support on other platforms.

We’ve come up with a way of supporting the sharing of secured Office documents in advance of the native Office support. We’ve done so via the RMS application’s Share Protected button. When you invoke Share Protected to share Office documents we send your email recipients both an RMS protected version of the Office document and a protected PDF copy of the same file. 

The Share Protected button is added to Outlook, Word, Excel, and PowerPoint (v2010 and 2013) when you install the RMS app for Windows"

So how does this work. Download the App from the Microsoft Download Center

http://www.microsoft.com/en-ie/download/details.aspx?id=40857  

Install the App.

The installation requires a restart.

See the new "RMS Share Protected" button in Outlook. Create an email and click on the Share Protected button.

Log in using your Azure credentials (essentially your email address) so that your RMS license rights can be verified.

Choose the RMS rights. 

See the other configurable options:

• Set expiration date
• Email notification when someone opens the attached document
• Allow revoking of the document

The mail is then RMS protected. See that we now have two attachments - a protected Word document as normal and also a protected PDF document which can be opened on any device. Send the email..........

......and you get an immediate notification with a link to the RMS Document Tracking Site. Unfortunately this link doesn't work for me yet as it is currently just available in North America. When the site is available I will be able to track the document to see who has opened it and when. I will also be able to revoke the document at any time.

I will also be able to access the Document Tracking site from here.

The recipient receives the email. See that Word Online is not supported.

The recipient tries another app (Word in this case) and is given instructions on how to access the document. The user should select "Download" to install their version of the RMS Sharing App.

The recipient logs into the RMS Site........

....and is prompted to select and install the correct version of the app for their device. They can now open the document (I have no screenshots of this as they are disabled by RMS).

Finally I get an email to tell me that the recipient has opened the mail (with a link to the Document Tracking Site). 

This app is seriously cool.