Chapter 15. Configuring Azure Information Protection Solutions

After working through the theory and the detection and identification of sensitive information, we will work through some practical tips from our projects to help you to attain a better understanding of the technology and the associated processes. Always attempt to start projects with classification and without protection to avoid data loss and bad project marketing, because business processes don't work when users can't access the information they regularly use. In addition, always align training to your end users. This chapter will extend your lab environment and provide you with the important PowerShell cmdlets to administer your solution. Finally, we will configure Azure Information Protection (AIP) through some practical examples.

The chapter is divided into the following sections:

• Preparing to configure and manage AIP
• Azure RMS management with PowerShell
• Configuring AIP

Yeah! Let's start with the preparation tasks.

Preparing to configure and manage AIP

To configure and manage our AIP solution, we need to prepare the administrative Windows 10 workstation with the necessary tools. We need to have the following PowerShell modules installed on the workstation:

• Azure AD Preview: Install-Module -Name AzureADPreview
• Azure RMS: Install-Module -Name AADRM

Additionally, we install the AIP client on the machine from the following source: https://bit.ly/2ccqSu0.

For our use cases and the lab challenge, we need to create the required email-enabled groups. We choose to use Office 365 dynamic groups. You can use the following PowerShell cmdlets to create the required groups.

The first bunch of groups is required and the second one is optional:

# Connect to Azure AD and provide global administrator credentials
Connect-AzureAD

New-AzureADMSGroup -Description "Finance and Accounting Department Users" -DisplayName "Finance and Accounting" -MailEnabled $true -SecurityEnabled $true -MailNickname "financeandaccounting" -GroupTypes...

Azure RMS management with PowerShell

In the following section, we will discuss and use the most important PowerShell commands to configure and manage Azure RMS. You will get a good overview of the features and how to start the configuration.

Azure RMS super users

We will start with the connection to the Azure RMS service and the management of the super users feature. This feature is disabled by default. To use its functionality, we need to enable the feature and assign a mail-enabled group to it. We highly recommend adding the AIP Scanner account permanently to the group, and all the other required users as and when required. It doesn't matter when the user is added to decrypt information from the past.

The Azure RMS super users feature provides the following functionality in Azure RMS:

• Full control over all rights-protected content that is managed by rights management
• Full owner rights to super users for all user licenses that are issued by the subscriber's organization
• Decryption of any rights...

Configuring AIP

Configuring and managing AIP should always start with the global approach for all users. The most important task to do before you start touching the technology is to work on a clear classification schema and the associated policies. Doing the configuration is the smallest part in a classification and information project. You should consider the default labels based on your classification schema, and start without encryption and a lot of automatic classification rules. Start with the global users that understand and work with the new technology. Keep in mind to use a step-by-step approach and work through the specific requirements in the most sensitive departments, such as human resources, legal, or finance. Don't overwhelm your users and don't teach them to lie to your concept and classification system.

Here are some additional tips for data classification:

• Gather the support of the management and employees who will use the system
• Tagging and categorizing everything is nearly...

Summary

Working through this chapter enabled you to start to optimize your Information Protection solutions inside your organization or with your customers. We provided a starting lab environment to test all the required functionality and processes of AIP. With the key PowerShell cmdlets, you should be up and running, and ready to start your configuration tasks. Furthermore, with the overview of typical configuration tasks, we provided you a few examples of the experiences we learned during our many projects.

In the last chapter of the book, we will work through an AIP-enabled example application to give you more insights into the AIP technology.