Windows Azure Active Directory Rights Management Preview now available

re: Windows Azure Active Directory Rights Management Preview now available

Enrique Saggese — Thu, 04 Apr 2013 03:17:32 GMT

@Nick: I can't say for sure without more data, but the error you are seeing is consistent with your O365 tenant being running on the previous version (v.14), not 2013 (v.15). The command you are trying to use is only available on 2013. If you created your tenant more than a few weeks ago you might still be on that version.

re: Windows Azure Active Directory Rights Management Preview now available

Nick Cerbini — Tue, 02 Apr 2013 18:16:55 GMT

Having issues with IRM and Exchange Online:

I have a Hybrid Deployment with all mailboxes in the cloud, using MSDSO (Azure AD) and Dirsync. I have a few Educational A3 licenses which have the RMS feature, see below. I enabled AADRM but cant run Enable-OrganizationCustomization which I assume because it was enabled during Hybrid configuration. The next road block seems to be Set-IRMConfiguration –RMSOnlineKeySharingLocation "sp-rms.na.aadrm.com/.../ServicePartner.svc". There is no command for -RMSOnlineKeySharingLocation when I tab through set-irmconfigurations commands. What am I missing here? Thanks in advance for any information.

Get-MsolUser -UserPrincipalName "UPN").Licenses[0].ServiceStatus

ServicePlan ProvisioningStatus

----------- ------------------

RMS_S_ENTERPRISE PendingInput

OFFICESUBSCRIPTION Success

MCOSTANDARD Success

SHAREPOINTWAC_EDU Success

SHAREPOINTENTERPRISE_EDU Success

EXCHANGE_S_ENTERPRISE Success

re: Windows Azure Active Directory Rights Management Preview now available

Dan Plastina, MSFT IP Team — Fri, 27 Jul 2012 22:56:04 GMT

Hi Alexey,

We're focused the core, volume use patterns. Over time we'll light up many other capabilities. We'll post more about bootstrapping and the client licensing model in a future post.

PS: The commands you call out have to do with Exchange's use of RMS or migrating out of AADRM.

re: Windows Azure Active Directory Rights Management Preview now available

Alexey Goldbergs — Wed, 25 Jul 2012 19:28:36 GMT

Hey Dan,

Thanks for your reply. It's really interesting.

Especially that you don't support TPD and TUD in AADRMS. Because here at AADRMS Tech Center (technet.microsoft.com/.../jj585001) we can find the example of using PowerShell commandlet for importing TPD. And another one quite interesting thing is listing and setting URL for migrating rights managed contend described here at technet.microsoft.com/.../jj584998. It seems like TUD scenarios. I can't say that I have the real case around this but I probably know how deeply I diving into AD RMS from my blog posts (e.g. blogs.technet.com/.../ad-rms-under-the-hood-server-bootstrapping.aspx) ;)

And the last one one question for now is about revoking RAC. Is it available with AADRMS?

re: Windows Azure Active Directory Rights Management Preview now available

Dan Plastina, MSFT IP Team — Tue, 24 Jul 2012 19:48:31 GMT

Hi Alexey,

Sorry for the delay. Thank you for your questions. Here are replied we hope cover your thoughts:

1) AADRM and cross organization scenarios: Our general philosophy is that if you can send unprotected email to someone you should be able to send them protected email. Most readers of this blog are likely to realize that this is not a quite seamless process given the involved identity providers must be federated for this flow to be authenticated. AADRM is currently focused at supporting the Office 365 deployments. In that environment we automatically 'federate' to all other Office 365 organizations to make for simple, secure collaboration. On-premises today AD RMS enables collaboration when two organizations enable trust of their RMS systems (TUD relationship; ADFS federation). The cross-type collaboration (on-premise to cloud; cloud to on-premise) is not yet supported through this same mechanism but is something we're focused on. As of now, if an organization setups up an Office 365 federation (DirSync) then they meet the prior cloud/cloud criteria. We're working on enabling companies to federate in this manner without having to purchase the fuller Office 365 suite (e.g.: email or SharePoint services). This is known as Azure Active Directory services and you can read more about this on Kim's blog at www.identityblog.com

2) AADRM and TUD/TPD: At this moment AADRM does not support TUD or TPD imports/exports to on-premises RMS deployments. Given the above, and the fact that our clients will make use of the sender's RM service, we're not seeing an urgent need. Is there a particular scenario you're looking to support?

3) AADRM and crypto mode 2: Windows Phone (and other mobile platforms) use the Exchange Active Sync method of support RMS. This lets it consume email protected with AADRM without modification. Windows Mobile 6.x does not support Cyptographic Mode 2 so it is not supported. We are in the processing of bringing our Rights Management SDK v2.0 (aka MSIPC) to other platforms as native implementations. We have no dates to share right now but we're well aware of information protection needing to be 'everywhere our users are'. Before too long we'll have support for Windows, WinRT/Metro, Windows Mobile, iOS, and Mac. In the meantime implementations using Exchange Active Sync work for most common cases. e.g.: I have a Kindle FIRE running Nitrodesk's TouchDown mail client that lets me read my protected emails.

Thanks again for given us the opportunity to share these details.

re: Windows Azure Active Directory Rights Management Preview now available

Alexey Goldbergs — Fri, 20 Jul 2012 06:45:50 GMT

Hi Dan,

Have a couple of questions for you.

1. Does Windows Azure Active Directory Rights Management (here and after AADRM) works the same way with AD FS in x-org scenarios? I mean the scenarios when Office 2013 or Office 265 Enterprise user protects document with AADRM for partner in another company.

2. Does AADRM supports TUD and TPD for migration cases and legacy infrastructures?

3. And the last question for the moment. In your comment for your another blog post at blogs.technet.com/.../enabling-windows-azure-rights-managment-in-office-365-enterprise-preview.aspx you said that AADRM uses Cryptographic Mode 2 (and thats why Mac isn't supported). But Windows Mobile also doesn't support Cryptographic Mode 2 (accordingly to the FAQ at technet.microsoft.com/.../hh867439(WS.10).aspx). And AFAIK it also doesn't support MS-ASRM protocol (msdn.microsoft.com/.../ff631362(v=exchg.80)) Can you clarify this point?

re: Windows Azure Active Directory Rights Management Preview now available

Dan Plastina, MSFT IP Team — Thu, 19 Jul 2012 16:42:58 GMT

Hi Lisa,

Thanks, we're excited too.

Mobile device support today is enabled either by an Exchange Active Sync (EAS) offer or a 3rd party solutions offer. Today Windows Mobile supports EAS in the native mail client. The Apple iOS native mail client does not enable this capability at this time but a recent Samsung Android phone does. Other vendors offer mobile applications to enable EAS on various platforms (e.g.: Nitrodesk) or offer solutions (e.g.: Gigatrust) to enable mobile phone support.

Regarding your topology question: That is correct. You can have an Exchange Online mailbox that is RMS enabled with no RMS deployment on premises.

Thanks for the comments.

re: Windows Azure Active Directory Rights Management Preview now available

Lisa Vanderveer — Thu, 19 Jul 2012 09:22:08 GMT

Hi Dan,

great new! When talking about mobile devices I assume you're talking about Windows Phone? I assume to use ADRMS on Blackberry, Android and IPhone/IPad customers should use 3rd party like rmsviewer.com?

Regarding the "Azure" in "Azure ADRMS" - is it integrated into the "Azure AD"? That means no need for any on premise AD/RMS to use RMS with Office 365?

Thanks!

Lisa