[How to]Configure Azure RMS for Exchange Online /O365

On my previous blog, I have shared my knowledge regarding the security of the Organization with DLP on Document Fingerprints. As all of know how crucial email has been these days, even for any official approval or submission or information circulation we use email. If such critical information on email gets leaked, it might burn down all the organization. Hence, we need to have a proper security with emails. Here today, on this blog we will be configuring Azure RMS (Right Management Service) for Exchange Online / O365. The questions may be why do we need RMS for Exchange Online / O365 or how will RMS secure email on Exchange Online / O365. RMS is the functionality that allows user to protect sensitive emails by not allowing recipient to Forward, copy, print or take snapshot of that emails. Azure RMS can be configured for office products and On-Premises Exchange server too, wait until the blog comes for it. J

Before Starting this blog, let me inform you to use this security feature you need to have Azure Information Protection Plan1 at least. Below is the snap with the information of Azure Information Protection Plan 1. For the blogging purpose, I am in the trial function. Even though you are on trial, you will have full functionalities with limit of 30 days.

To have a trial license, it is quite easy. You just go to your subscription menu, Click on Add Subscriptions and select ‘Azure Information Protection Plan 1‘ as on the below snap.

Once you subscribe the plan, you will have something like below on the Subscription page. This is the confirmation that you have subscribed the ‘Azure Information Protection Plan‘

Now after the subscription, we need to assign the license to the user’s whom we would like to provide these kinds of the features.

Once license is assigned to the user, it’s time for few configuration needs to make change to activate RMS Features for the users. To configure the RMS, first need to have Azure PowerShell tool and install on your machine. Which will help us to connect Exchange Online /O365 using PS cmdlet. To download Azure PowerShell tool, Click here .

After the installation of the of Azure PowerShell, Open it with Administrative privilege and run the below command to

$UserCredential = Get-Credential

This command will prompt to enter you, your credentials of Exchange Online/ O365 administrative privilege.

After providing the credentials, run below command to access the PS session of your Exchange Online/ O365

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://ps.outlook.com/powershell/ -Credential $UserCredential -Authentication Basic –AllowRedirection

Import-PSSession $Session

After Session of your Exchange online / O365 is imported, you need to Enable the customization of your Organization. Which can be done by below cmdlet.

Enable-OrganizationCustomization

During the configuration, we need to be careful with our next cmdlet. This cmdlet will configure the RMS for our emails, and should be applied as per the region. Below is the cmdlet that I have used on Asia region.

Set-IRMConfiguration -RMSOnlineKeySharingLocation "https://sp-rms.ap.aadrm.com/TenantManagement/ServicePartner.svc"

If I have to configure the RMS for European Union, I have to re-write this cmdlet as of below:

Set-IRMConfiguration -RMSOnlineKeySharingLocation "https://sp-rms.eu.aadrm.com/TenantManagement/ServicePartner.svc"

This is the table that can help you to identify the RMS key Sharing location according to your organization location.

Now we need to import the Trusted Publishing Domain (TPD) for our RMS. A TPD contains the settings needed to use RMS features in your organization. For e.g. Users can apply RMS templates to email messages. To import TPD below cmdlet is used.

Import-RMSTrustedPublishingDomain -RMSOnline -name "RMS Online"

After importing TPD and before confirming the customization, we can make a test for the configuration with below cmdlet.

Test-IRMConfiguration -RMSOnline

If the result of the IRM configuration test is found to be Pass, we can set the configuration with below cmdlet. And that’s all you have configured RMS for your Exchange online/ O365

Set-IRMConfiguration -InternalLicensingEnabled $true

You can get the default templates of the RMS with below cmdlet

Get-RMSTemplate

Testing…

After the configuration of RMS on the Exchange Online/ O365, whenever user tries to send a sensitive email. They can select on more à Set Permissions à and required restriction for that email.

Once, the restriction on the email has been selected, there appear a notification with the restriction applied to that email.

When the email is received from the recipient, he will get the notification on email with special restriction. As well notification on the email.

I hope this was easy configuration. If need any assistance on this regard, please leave comment. J