The Solution:

The Solution:

The Solution:

The Mail Flow Rule

1. Log into https://outlook.office365.com/ecp/ as either a Office 365 Global Admin or Exchange Admin
2. On the left side, click mail flow
3. This will default to the rules pane
4. In the rules pane, click the  and click Apply Office 365 Message Encryption and rights protection to messages...
5. In the new rule pane, name the rule Credit Card Data and select the drop-down under *Apply this rule if... and hover over This message... and click contains any of these types of sensitive information
6. In the Contains any of these sensitive information types dialog, click on the  , scroll down and select Credit Card Number. Click the Add -> button, and click OK. NOTE: You can add multiple types of sensitive information types to a single rule through this dialog.
7. In the Contains any of these sensitive information types dialog, you can now set additional settings related to each sensitive data type.  We will leave it at the defaults and click OK.
8. Under *Do the following..., next to Apply Office 365 Message Encryption and rights protection to the message with..., click *Select one...
9. In the select RMS template dialog, click the drop-down below RMS template: and select Encrypt and click OK
10. The completed rule should look like the image below. Click Save to finish creating the first mail flow rule.

The User Experience

1. This first image shows a credit card number being sent to a Gmail user with no protection.
2. In the Gmail mailbox you can see that the message came in and the wrapper data is all that can be seen of the content.
3. The standard OME wrapper format is shown below.  As you can see in this image, the text, branding icon and color can be customized.  Details on that are available at https://aka.ms/OMEBranding.
4. After clicking Read the message, the user is sent to an authentication portal based on the social email service.  In this case it is Google, but Outlook.com, Yahoo, and several others also have dedicated authentication.  For other email providers that may not have their own authentication platform (who still has their Prodigy email?), they will be given the common option of a one-time passcode.
5. In this case I authenticated with Google and it took me directly to the message in the OME Portal.
6. If the user clicks sign in with a one-time passcode, they will be forwarded to the page below
7. The one-time passcode will be sent to the same email and they can use this to authenticate to the OME Portal.

The Solution:

1. Click on the start menu and type PowerShell, then right-click on Windows PowerShell and select Run as administrator
2. In the admin PowerShell window run the command Set-ExecutionPolicy RemoteSigned and type y and enter if prompted.
3. Next, type $UserCredential = Get-Credential and provide the username of your exchange or global admin
4. Next, run $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection to create the session.  If you have any errors, you may have one of the more picky tenants (Germany, 21Vianet, Proxy configurations) then you should see https://aka.ms/EXOPowerShell for additional details.
5. Finally, run Import-PSSession $Session -DisableNameChecking to complete the connection to EXO PowerShell.
6. Now that you are connected, you can run Set-IRMConfiguration -DecryptAttachmentFromPortal $true to enable the feature I described earlier.

The Solution:

The Label

1. Log into https://portal.azure.com as an O365 Global Admin or Security Admin with rights to the AIP Portal
2. In the search bar at the top of the portal, type Inform and click on Azure Information Protection
3. In the AIP Portal, you should see the list of labels similar to the image above.  If you do not, under Classifications on the left, select Labels
4. Assuming you have a top level label similar to Confidential, click the ... on the right and click Add a sub-label
5. In the new Sub-label, give it the name Encrypt and the description This message is encrypted. Recipients can't remove encryption. and Save.  We are using this specific name and description because it mirrors the native Encrypt protection verbiage. Do not add any protection to this label (we will do that with the mail flow rule).
6. You should now have an unprotected sub-label that looks similar to the image at the beginning.

The Mail Flow Rules

1. In the AIP Portal, click on the Encrypt label and scroll to the bottom where the label ID is shown
2. Copy this Label ID into a new notepad document and add the words MSIP_Label_ and _Enabled=True around the Label ID. In my case, I have MSIP_Label_18acc54a-e84e-4add-9fe5-36781d02b550_Enabled=True.
3. Next, log into https://outlook.office365.com/ecp/ as either a Office 365 Global Admin or Exchange Admin
4. On the left side, click mail flow
5. This will default to the rules pane
6. In the rules pane, click the  and click Create a new rule...
7. In the new rule pane, name the rule Encrypt and click the More options... link
8. After clicking More options..., select the drop-down under *Apply this rule if... and hover over A message header... and click includes any of these words
9. Click on the *Enter text... link and type msip_labels in the specify header name box and click OK
10. Next, click on the Enter words... link and copy/paste the label information you have stored in the notepad document and click the  then click OK
11. Click the drop-down below the *Do the following... and hover over Modify the message security... and click Apply Office 365 Message Encryption and rights protection
12. In the select RMS template dialog, click the drop-down below RMS template: and select Encrypt and click OK
13. The completed rule should look like the image below. Click Save to finish creating the first mail flow rule.
14. Now, back in the rules panel, highlight the Encrypt rule and click the  button.
15. In the new rule panel, change the name to Encrypt (attachments)
16. Select the drop-down under *Apply this rule if... and hover over Any attachment... and click on has these properties, including any of these words.
17. In the select attachment properties dialog, click the  to add a new property/value pair.
18. This should bring up a new window where you can specify a custom attachment property (this only worked properly in IE for me but YMMV).  For the Property, enter the same metadata string from the first rule up to Enabled. For the Value, enter True. For me this Property value was MSIP_Label_18acc54a-e84e-4add-9fe5-36781d02b550_Enabled.
19. Click Save and your select attachment properties dialog should look similar to the image below
20. Click OK to close the dialog and your completed rule should look like the image below
21. Click Save on the new rule to finish the creation process.

The Solution:

Installation:

Prerequisites:

• A Windows Server 2012 R2 or 2016 Server to run the service
  • Minimum 4 CPU and 4GB RAM physical or virtual
  • Internet connectivity necessary for Azure Information Protection
• A SQL Server 2012+ local or remote instance (Any version from Express or better is supported)
  • Sysadmin role needed to install scanner service (user running Install-AIPScanner, not the service account)
  • If using SQL Server Express, the SQL Instance name is ServerName\SQLExpress
  • If you cannot be granted the Sysadmin role or your organization policies require databases to be created and configured manually, see Deploying the scanner with alternative configurations
• Service account created in On Premises AD and synchronized with Azure AD (I will call this account AIPScanner in this document)
  • Service requires Log on locally right and Log on as a service right (the second will be given during scanner service install)
  • Service account requires Read permissions to each repository for discovery and Read/Writepermissions for classification/protection
• AzInfoProtection.exe available on the Microsoft Download Center (The scanner bits are included with the AIP Client)

Binary/Service Installation:

1. Log onto the server where you will install the AIP Scanner service using an account that is a local administrator of the server and has permission to write to the SQL Server master database.
2. Run AzInfoProtection.exe on the server and step through the client install (this also drops the AIP Scanner bits)
3. Next, Right-click on the Windows  button in the lower left-hand corner and click on Command Prompt (Admin)
4. Type PowerShell and hit Enter
5. At the PowerShell prompt, type the following command and press Enter: Install-AIPScanner
6. When prompted, provide the credentials for the scanner service account (YourDomain\<AIPScanner Service Account>) and password
7. When prompted for SqlServerInstance, enter the name of your SQL Server and press Enter You should see a success message like the one below NOTE: If you get any errors at this point, verify network connectivity and resolve any permissions issues with the SQL Database before proceeding!
8. Right-click on the Windows  button in the lower left-hand corner and click on Run
9. In the Run dialog, type services.msc and click OK
10. In the Services console, double-click on the Azure Information Protection Scanner service
11. On the Log On tab of the Azure Information Protection Scanner Service Properties, verify that Log on as: is set to the YourDomain\AIPScanner service account

Scanner Configuration:

Authentication Token:

1. On the server where you installed the scanner, create a new text document on the desktop and name it something like Set-AIPAuthentication.txt
   • In this document, paste the line of PowerShell code below and save Set-AIPAuthentication -webAppId <ID of the "Web app / API" application> -webAppKey <key value generated in the "Web app / API" application> -nativeAppId <ID of the "Native" application>
2. Open Internet Explorer and browse to https://portal.azure.com
3. At the Sign in to Microsoft Azure page, enter the your tenant global admin credentials
4. In the Microsoft Azure portal, click on Azure Active Directory in the left-hand pane
5. Under Manage, click on App registrations
6. In the App registrations blade, click the + New application registration button
7. In the Create blade, use the values in the table below to create the registration

   Name	AIPOnBehalfOf
   Application type	Web app / API
   Sign-on URL	https://localhost

   
8. Click the Create button to complete the app registration
9. In the AIPOnBehalfOf blade, hover the mouse over the Application ID and click on the Click to copy icon when it appears
10. Minimize (DO NOT CLOSE) Internet Explorer and other windows to show the desktop
11. On the desktop, return to Set-AIPAuthentication.txt and replace <ID of the "Web app / API" application> with the copied Application ID value and Save WARNING: Ensure there is only a single space after the Application ID before -webAppKey
12. Return to the browser and click on the Settings button
13. In the Settings blade, under API ACCESS, click on Keys
14. In the Keys blade, add a new key by typing AIPClient in the Key description field and your choice of duration (1 year, 2 years, or never expires)
15. Select Save and copy the Value that is displayed WARNING: Do not dismiss this screen until you have saved the value as you cannot retrieve it later
16. Go back to the txt document and replace <key value generated in the "Web app / API" application> with the copied key value and Save WARNING: Ensure there is only a single space after the Application Key before -nativeAppId
17. In the Microsoft Azure portal, click on Azure Active Directory in the left-hand pane
18. Under Manage, click on App registrations
19. In the App registrations blade, click the + New application registration button
20. In the Create blade, use the values in the table below to create the registration

    Name	AIPClient
    Application type	Native Application
    Sign-on URL	https://localhost

    
21. Click the Create button to complete the app registration
22. In the AIPClient blade, hover the mouse over the Application ID and click on the Click to copy icon when it appears
23. Replace <ID of the "Native" application > in the Set-AIPAuthentication.txt document with the copied Application ID value and Save
24. Return to the browser and in the AIPClient blade, click on Settings
25. In the Settings blade, under API ACCESS, select Required permissions
26. On the Required permissions blade, click Add, and then click Select an API NOTE: It may take a few moments for each of these blades to load
27. In the search box, type AIPO and click on AIPOnBehalfOf, and then click the Select button
28. On the Enable Access blade, check the box next to AIPOnBehalfOf, click the Select button
29. Click Done
30. In the Required permissions blade, click Grant permissions
31. In the popup window, click Yes
32. Click on the Start menu and type PowerShell, right-click on the PowerShell program, and click Run as a different user.
33. In the Run as different user dialog, insert the Scanner Service credentials
34. In the Scanner Service context PowerShell window, paste the completed command from Set-AIPAuthentication.txt and press Enter
35. When prompted, enter the user AIPScanner@yourdomain.com and the password NOTE: Replace yourdomain with the your tenant
36. You will see the message below in the PowerShell window once complete

Configuring Repositories:

1. To add a file share repository, open a PowerShell window and run the command below Add-AIPScannerRepository -Path \\fileserver\documents
2. To add a SharePoint 2013/2016 document library run the command below Add-AIPScannerRepository -Path https://sharepoint/documents
3. To verify that the repositories that are configured, run the command below Get-AIPScannerRepository

Sensitive Data Discovery:

Bulk Protection:

The Situation:

The Solution:

The Mail Flow Rule

1. Log into https://outlook.office365.com/ecp/ as either a Office 365 Global Admin or Exchange Admin
2. On the left side, click mail flow
3. This will default to the rules pane
4. In the rules pane, click the  and click Create a new rule...
5. In the new rule pane, name the rule #Encrypt and click the More options... link
6. After clicking More options..., select the drop-down under *Apply this rule if... and hover over The subject or body... and select subject or body includes any of these words
7. In the specify words or phrases dialog, add #Encrypt (and optionally #ENC) and press then OK once finished
8. Click the drop-down below the *Do the following... and hover over Modify the message security... and click Apply Office 365 Message Encryption and rights protection
9. 
10. In the select RMS template dialog, click the drop-down below RMS template: and select Encrypt and click OK
11. The completed rule should look like the image below. Click Save to finish creating the mail flow rule.

Even for the organizations that use HYOK protection, it is typically suitable for a small number of documents that need to be protected. As guidance, use it only for documents and when they match all the following criteria:

• The content has the highest classification in your organization ("Top Secret") and access is restricted to just a few people
• The content is not shared outside the organization
• The content is only consumed on the internal network

The Solution:

Creating the "Top Secret" Label and Scoped Policy

Gathering Data from the AD RMS Server

Adding Protection to the HYOK Label

The Solution: