Compliance and supporting information for the Azure Rights Management service

Microsoft Purview service description

The Azure Rights Management service supports other services and also relies on other services. If you’re looking for information that is related to this encryption service but not about how to use the service, check the following resources:

Suitability for different countries/regions

Given the variability between laws and regulations in different countries/regions, different use cases and scenarios, and the varying requirements between different business sectors, consult your legal adviser to help you answer whether the Azure Rights Management service is suitable for your country/region.

However, some relevant information that can help your legal adviser make a determination:

  • The Azure Rights Management service uses AES 256 and AES 128 to encrypt documents. For more information, see Cryptographic controls, algorithms, and key lengths.

  • All encryption keys used by the Azure Rights Management service are protected with a customer-specific root key that uses RSA 2048 bits. RSA 1024 bits is also supported for backwards compatibility. For more information, see Cryptographic controls, algorithms, and key lengths.

  • Customer-specific root keys are either managed by Microsoft or provisioned by the customer in a nCipher HSM by using "bring your own key" (BYOK). The Azure Rights Management service also supports features for on-premises encryption, for content that cannot be encrypted with a cloud-based key. For more information, see Managing the root key for your Azure Rights Management service.

  • The Azure Rights Management service is hosted in regional data centers across the globe. The Azure Rights Management service keys always remain within the region in which the service was originally deployed.

  • The Azure Rights Management service doesn't transmit document contents from clients to the Azure Rights Management service. Content encryption and decryption operations are performed in-place in the client device. Or, for service-based rendering, these operations are performed within the service that’s rendering the content. For more information, see How the Azure Rights Management service works.

Security, compliance, and auditing

See the Security, compliance, and regulatory requirements section in the Learn about the Azure Rights Management service article, for information about specific certifications for the Azure Rights Management service. In addition:

For in-depth technical information about how the encryption technology works, see How the Azure Rights Management service works: Technical details.

Service level agreements (SLAs)

The following service level agreement resources apply to the Azure Rights Management service and its dependencies:

Documentation

For related product documentation, see the following resources:

  • Last updated on