Chapter 16. Azure Information Protection Development

This chapter is a good starting point for anyone who wants to dive deeper into the Azure Information Protection technology to get more information for troubleshooting or supporting a solution. This chapter will also help you write an application to help your customers to fulfill your organization's needs. Using the development resources of Azure Information Protection will give you more in-depth knowledge about this technology.

In this chapter, we'll provide you with an overview of the different development resources to help you start your journey into the different Azure Information Protection development options. We'll offer you the starters to prepare your development environment and give you some examples so you can start analyzing this excellent service. You'll get information about the Microsoft Information Protection SDK, the use of PowerShell, and the other SDKs that are available to help you begin your journey.

This chapter is organized...

Technical requirements

In this chapter, you can use the YD1APP01 server, on which Visual Studio 2017 is already installed in Chapter 7, Deploying Solutions on Azure AD and ADFS. Additionally, you need to install the Information Protection SDK 2.1 from https://bit.ly/298QzMn to run any development. Also, download the examples from https://bit.ly/2CBVvoE, https://bit.ly/2RHCjjO,and https://bit.ly/2HtYKEj to the server in your Visual Studio project directory, such as C:\Users\cloudadmin.INOVITDEMOS\Documents\Visual Studio 2017\Projects>, which you can use to experiment with the framework.

In the next section, we'll dive into the Microsoft Information Protection solutions to get the knowledge about all the related technologies.

Microsoft Information Protection solutions

Azure Information Protection itself is built to classify, label, and protect files in Office 365 and many other applications. The following list shows the different solution components and their relation to Azure Information Protection:

• Microsoft Cloud App Security: For protecting cloud applications with direct integration of Azure Information Protection.
• Conditional Access: To control access to sensitive information where no direct integration into Azure Information Protection is required.
• SharePoint: To deliver RMS-protected libraries and groups to provide access control.
• Office 365 Message encryption: To send encrypted emails inside or outside your organization with a direct integration into Azure Information Protection.
• Office 365 Data Loss Prevention: Is built to prevent data loss over Exchange and SharePoint Online, including OneDrive for Business with a direct integration into Azure Information Protection.
• Office 365 Advanced Data Governance: Provides...

Understanding the Microsoft Information Protection SDK

The Microsoft Information Protection SDK extends labeling and protection functionality so you can provide a consistent experience in cross-platform scenarios, and it provides a comprehensive set of capabilities. With the SDK, you can extend the classification, labeling, and protection to any other app and service. In general, Microsoft Information Protection solutions are compatible with traditional Active Directory RMS infrastructures. You experienced this with the Hold Your Own Key (HYOK) functionality.

The Microsoft Information Protection SDK is available on the following:

• macOS, Linux, and Windows
• A preview for Android, IOS, and other platforms

The SDK supports user and service applications, including support for multi-tenancy. User applications include common authoring tools, such as Office and Adobe. Labeling structured data is also supported. Service applications mostly run in the background, such as DLP, cloud access security brokers...

Preparing your Azure AD environment for tests

In this section, we'll adjust our Azure AD environment to run code from the Microsoft Information Protection SDK against our Azure Information Protection infrastructure. As usual, it starts with the creation of an Azure AD app:

1. Log in with global administrator credentials to the Azure portal at https://portal.azure.com.
2. Navigate to the Azure AD blade.
3. Click App registrations to create a new application.
4. Click New Applications registration.

5. Use the following settings:

Example app properties

6. Click the Settings button on the registered application:

App Settings option

7. Click the Required permissions section for API access.

8. Click Add:

Required permissions configuration

9. Click Select an API. If needed, use the search field to find Microsoft Rights Management Services.
10. Select the Microsoft Rights Management Services API:

Choosing the Microsoft RMS API

11. Under the Select permissions section, use the Create and access protected content for users permission under the DELEGATED...

Using MIP binaries to explore functionality

With the Microsoft Information protection binary from the SDK, we can explore the new functionalities of Microsoft's unified Information Protection solution. The binaries deliver all the examples needed to start using the different functions like gathering the actual status of a file, classifying and protecting a file, and bulk decrypting files. In the following section, we will focus on the file_example.exe binary which delivers all this basic functionality. This example will give you ideas for developing own applications that use the SDK and the Information protection functions.

We downloaded the MIP binaries to explore features. You can use the following steps to get more insight into features:

1. Open PowerShell and navigate to the sample files.
2. Execute the .\file_sample.exe binary to view the functionality you can test:

Application command-line options

With this binary, you can start with the following commands:

• Get a list of labels:

./file_sample ...

Using PowerShell with Azure Information Protection

PowerShell provides you managing capabilities for Azure Information Protection. In special, to handle custom classification and protection solutions you need to be able to use PowerShell to solve your challenges like, labeling and protecting files on a file share or single computer. With the following cmdlets you have the basic toolset to do the most administrative tasks with PowerShell. We used the cmdlets for example for providing a monitoring solution of a single folder and labeling and encrypting the files in the folder based on keywords. With the following commands, you can start to explore more about Azure Information Protection's capabilities and technology:

• Import-Module AzureInformationProtection
• Get-AIPFileStatus: Used to identify all files with a specific label
• Set-AIPFileClassification: Used to inspect file contents and automatically label unlabeled files
• Set-AIPFileLabel: Used to apply a specified label
• Set-AIPAuthentication: Used...

Overview of the RMS 2.1 and 4.2 SDKs

Two active generations of RMS SDKs are available to developers and used for the following developments:

• Microsoft Rights Management SDK 4.2 for Android, iOS/macOS, Windows devices, and Linux
• Microsoft Rights Management SDK 2.1 for Windows Desktop Client
• AD RMS SDK is superseded

The following improvements were included with the 4.2 version:

• Hybrid support AD RMS and Azure RMS (AD RMS' mobile device extension is needed to make AD RMS available on mobile devices and provides the required authentication methods)
• Access protected content offline
• Bring your authentication library
• Bring your user interface
• Redesigned API

You can use the following example design to develop your application:

Example of design for an application with the feature specification

 

 

The example above demonstrates how a user can encrypt a document. For this task, he needs to select an Azure RMS template or use an Azure RMS AdHoc-Protection. In order to get the template information from Azure Information...

Summary

In this final chapter, we first introduced you to the several PowerShell scripts and the related code of the SDK to gather more information about the whole Microsoft Information Protection solution framework, or to start developing your extensions or applications. It was never the intention to turn you into a developer in one chapter, but using these resources is a good source of knowledge for troubleshooting or administering such a solution. You should now be able to describe which SDKs are available and what they can be used for. Furthermore, you have enough code samples to start working. We wanted to provide you with a functional and ready work environment to help you get started easily.

Hopefully, the information in this book will help you with your current organization or project. I want to thank you very much sticking around till the end of this book. If you have any questions, don't hesitate to ask me under my blog jochennickel.ch or [e-mail].