Assessing the Alternatives for Sharing Protected Documents Between Organizations

Applies To: Windows Server 2008, Windows Server 2008 R2

In most scenarios where you want to share protected content, more than one of the alternatives described might apply. Deciding which to use requires carefully balancing the provided functionality and implementation cost of each solution, as well as the constraints imposed by the environment.

The key factors to consider when making such a decision are:

• Can each organization implement its own Active Directory Rights Management Services infrastructure? Additionally, can the organizations exchange server certificates and private keys? If the answer to both of these questions is yes, a trusted publishing domain is often the most powerful and simple alternative to implement. On the other hand, if distributed AD RMS is possible, but sharing of private keys is not desired, a trusted user domain is most likely the best approach.

• If a distributed AD RMS deployment across organizations or forests is not desired, AD FS is often an excellent solution, especially when considering its applicability to other services, such as extranet access. Nevertheless, if group expansion or mobile device access are necessary, AD FS is an unlikely option.

• For a limited number of external users, using Windows Live ID accounts for the external users can be the most simple option.

• If the number of external users is large, federation cannot be implemented and the external organization cannot implement their own AD RMS infrastructure, hosting the user accounts can be the best option. However, the cost of managing such accounts (for both the IT department and each user) must be considered.

The following table summarizes the different alternatives:

Requirement	Trusted User Domains	Trusted Publishing Domains	Active Directory Rights Management Services with AD FS
Office IRM Protection Document Protection	Supported	Supported	Supported
Office IRM Protection Document Consumption	Supported	Supported	Supported
MOSS IRM usage Document Protection (Server certification)	Supported	Supported	Supported when MOSS servers exist in the same forest as the AD RMS server
Windows Mobile 6 IRM	Supported	Supported	Not supported. Windows Mobile cannot be configured to use AD RMS with AD FS (from another forest) to activate, protect, or read protected documents.
XPS IRM Protection	Supported	Supported	Not supported. The XPS client included in the .NET Framework cannot locate Active Directory Rights Management Services with an AD FS server; the XPS Essentials client does not support applying protection.
XPS IRM Consumption	Supported	Supported	Partially supported. XPS Essentials client can locate Active Directory Rights Management Services with AD FS; the .Net Framework client does not support AD FS.
IE RMA	Supported	Supported	Supported in the latest version of the RMA client; legacy RMA clients cannot locate Active Directory Rights Management Services with AD FS servers.
Group Expansion	Supported	Supported	Not supported