Chapter 15.  Installing and Configuring Information Protection Features

In this chapter, we will configure information protection features with Azure RMS to secure access to sensitive data to provide an extended access management solution. We will start with the extension of the basic infrastructure that we already deployed in previous chapters. The focus of the starting configuration tasks will be on Exchange on-premise, Exchange Online, and SharePoint. Afterwards, we will configure and publish custom rights policy templates, enable RMS logging, and provide you with a first view on the new Azure Information Protection capabilities.

We will cover the following topics:

• Preparing your admin workstation to manage Azure RMS

• Configuring onboarding controls

• Delegating administrative permissions

• Enabling Azure RMS super users

• Configuring Exchange to use Rights Management capabilities

• Configuring Exchange Online to use Rights Management capabilities

• Configuring SharePoint to use Rights Management capabilities...

Preparing your admin workstation to manage Azure RMS

To manage our Azure RMS information protection solution, we need to prepare the administrative Windows 10 workstation with the necessary tools. You need to download and install the following setup files:

• Microsoft Online Services Sign-In Assistant (http://bit.ly/28Y8P9F)

• Azure Rights Management Administration Tool (http://bit.ly/28TYa0N)

After installing the administrative toolset, we test the correct installation and the connectivity to the activated Azure RMS service from the previous chapter:

1. Open an evaluated PowerShell and type the following command: Connect-AadrmService and provide your global administrator credentials.

2. Check the current state of the service with Get-Aadrm.

3. The expected result should be enabled.

In the next section, we will start with the configuration of the on boarding mechanisms you can use with Azure RMS.

Configuring onboarding controls

It's a recommended way to do a planned rollout of the RMS functionality in an organization. For this reason, Microsoft has implemented the on boarding controls feature.

You can check the default configuration with the following command: Get-AadrmOnboardingControlPolicy on an elevated PowerShell after you have established a connection to the Azure RMS service with the Connect-AadrmService command.

You should see a result like the following if you didn't touch it before:

To enable the onboarding controls, you can use the following command:

Set-AadrmOnboardingControlPolicy

Note

Practical note

You can run this command before or after you activate Azure RMS. But you must have at least version 2.1.0.0 of the Azure RMS Windows PowerShell module installed.

To check the version of your installed PowerShell module, you can run(Get-Module aadrm -ListAvailable).Version:

Let's start with the example that you only want to allow a specific group to be able to protect content...

Delegating administrative permissions

In this section, we will discuss and configure the delegation of administrative permissions, especially the question: are there global administrator permissions needed or can I delegate the tasks to other administrators?

By default, global administrators can obviously do all the administrative tasks for Azure RMS. But in fact, we don't want to use or assign global administrator rights to some individuals every time. With the command Add-AadrmRoleBasedAdministrator, you can assign this administrative role to a user account or a group.

Two roles are available:

• Global administrator: This will run all administrative tasks on Azure RMS without granting global administrator rights to other cloud services.

• Connector administrator: This will just run the RMS connector. First, we check the default configuration using the following steps:

1. Open an elevated PowerShell and type the following command:

   Get-AadrmRoleBasedAdministrator
   

2. Normally, if you didn't touch the...

Enabling Azure RMS super users

The super user feature is your fallback scenario to ensure that you can inspect and unprotect RMS secured information. The super user always has full owner rights.

Remember the following best practices:

1. Check that the super user feature is enabled with the following command:

   Get-AadrmSuperUserFeature
   

   The results will be disabled or enabled.

2. Limit and monitor the administrators who are assigned global administrator rights or in special assigned with the Add-AadrmRoleBasedAdministrator command.

3. You can check the actual configured administrators with the following command:

   Get-AadrmRoleBasedAdministrator
   

   

4. If you want to check which users and accounts are assigned to the super users, you can use the command Get-Aadrm-SuperUser:

   

5. To get the log information for all administrative tasks, you can use the Get-AadrmAdminLog -Path "C:\ActualLog.log" command and you will receive the whole details, as shown in the following example:

   

6. We recommend that the super user feature...

Configuring Exchange Online to use Rights Management capabilities

In the following section, we will configure Exchange Online to work with the Azure RMS capabilities. You need to perform the following steps:

1. Log on to your administrative workstation.

2. Open an evaluated PowerShell.

3. Type the following command:

   $Cred = Get-Credential
   

4. Enter your global administrator credentials.

5. Type the following commands:

   $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $Cred -Authentication Basic -AllowRedirection
   Import-PSSession $Session
   
   Enable-OrganizationCustomization
   

   Note

   Configuration note: Exchange needs a copy of your tenant keys in order to be able to work with protected content.

6. Type the following command with the correct tenant region:

   Set-IRMConfiguration -RMSOnlineKeySharingLocation "https://sp-rms.eu.aadrm.com/TenantManagement/ServicePartner.svc"
   

   Note

   Region note: Tenant regions - North America na; eu for Europe; ap for Asia...

Configuring Exchange to use Rights Management capabilities

With the following steps, we will configure Exchange Server 2010 and 2013 to use the Rights Management capabilities; the following Exchange roles are especially relevant for this configuration:

Hub transport server for:

• Transport Protection

• Journal Decryption

• Prelicensing

• Transport Decryption

Client access server for:

• Outlook Web Access IRM capabilities

• IRM capabilities in Search

  Note

  Practical Note

  On this server, the Rights Management Client needs to be installed and configured like a normal client.

Basically, there are two options to configure this scenario. The first option is to use the RMS connector administration tool and the other one is to do the steps manually. We will use the manual mode, so that you understand the steps under the hood:

1. The first step we need is to retrieve the Azure RMS URL for the tenant.

2. Open an elevated PowerShell and type Connect-Aadrm-Service.

3. Provide your global administrator credentials.

4. Type the following command...

Configuring SharePoint to use Rights Management capabilities

In this section, we will configure SharePoint 2010/2013 and SharePoint Online to use the Rights Management capabilities. As a prerequisite on SharePoint 2013 servers, the latest RMS client version 2.1 needs to be installed. For SharePoint 2010, the MSDRM client that includes support for RMS Cryptographic Mode 2 needs to be installed:

Note

Practical note

SharePoint 2010 needs the following additional prerequisites:

Windows 2012/R2 (http://bit.ly/29ror7U)

Windows 2008 R2 (http://bit.ly/29IrwwA)

Windows 2008 (http://bit.ly/29lrrR6)

In our scenario, we will use SharePoint 2013 and the already installed RMS Connector. Perform the following steps:

1. First, we need to retrieve the Azure RMS URL for your tenant.

2. Open an elevated PowerShell and type Connect-Aadrm-Service

3. Provide your global administrator credentials.

4. Type the following command: Get-AadrmConfiguration

5. You will receive the Microsoft RMS URL that you need to copy to your SharePoint...

Creating and publishing custom Rights Policy templates

To support additional use cases, we will configure custom rights policy templates in addition to the two default templates.

We want to reach the following configuration, where we configure one policy template for human resources and one for an external sharing scenario:

Creating a custom rights policy template

In the first step, we will configure the human resources policy template with the following steps:

1. Log in to the Azure Management Portal with global administrator credentials.

2. Navigate to Active Directory and choose RIGHTS MANAGEMENT.

3. Choose your active instance:

   

4. Click Create a new rights policy template to start the Rights Policy Template wizard:

   

5. Click your newly created template to configure the options.

6. Under Configure rights for users and groups, click Get started.

7. Configure the Human Resources group:

   

8. Configure the following custom rights:

   

9. If you like, you can also do the following:

   • Add the template name and description in additional...

Verifying Azure RMS logging

In this section, we will verify the by default enabled Azure RMS logging. Perform the following steps:

1. To verify the functionality, we will create one entry with these two commands:

   • Protect-RMSFile

   • Unprotect-RMSFile

   

2. Now you can use Get-AadrmUsageLog -Path "C:\ActualUsage.log" to download the usage logs to your local hard disk.

Now that we have tested the Azure RMS logging feature, we will have a preview look at the new Azure Information Protection features.

Preview of Azure Information Protection

In this section, we want to provide you with a short intro about the new upcoming capabilities of Azure Information Protection. The solution is based on the integrated solution of Secure Islands, an acquisition from last year. Microsoft builds up a solution that follows the following protection process:

Source: Microsoft

With this approach, Microsoft closes an existing gap in their solution. Now they are able to provide a complete process and make it usable for cloud services and on premise infrastructures.

We will receive the following key features from this solution:

• Automatic, user-driven, and recommended classifications

• Classification overrides and justifications

• Flexible policy and rules engine

• Protection using encryption, authentication, and use rights

• Document tracking and revocation

Now that we know the new key features, let's jump a bit in the new technology.

First of all, you can manage the new service over the new Azure Portal under https://portal...

SAP integration as a special scenario

This scenario is just a demonstration that RMS can happen in or around nearly every system. Halocore, a product of Secude, brings a native integration of RMS in SAP. We will provide examples for different data that gets out of SAP and will be protected based on classification with Azure RMS. We will provide the following examples:

• Financial information

• Personal information

For example, if you export defined content or information from specific transactions or tables, the content will be classified and you can choose the protection level. Halocore provides the best matching RMS policies to protect the information, as in the following example:

As a result, for example, you will get a protected Excel sheet:

The other way you can choose is that Halocore determines the best match and classifies and protects the information transparent to the user. The following configuration shows the different options - an activated Policy Selection UI and an Own Use Decision...

Configuring a BYOK scenario

For the configuration of the BYOK scenario for Azure RMS, we will use the following reference, where you will find a detailed configuration guide. With this reference, you will be able to configure this scenario:

• Whitepaper: BYOK with Azure Rights Management (http://bit.ly/28YVjF1)

Summary

Now that you have worked through this chapter, you will be able to configure a flexible information protection solution with on premises and online services. You will be able to provide security for several use cases in the main services of your environment. Furthermore, you received the needed information to configure Azure RMS logging, and a preview of the new Azure Information Protection functionality.

In the next chapters, we will provide further information that you need to know for complex and multi-forest environments to build suitable identity and access management solutions.