Leverage the Rights Management Connector for your premises

Introduction

Every day, information workers use e-mail messages and collaboration solutions to exchange sensitive information such as financial reports and data, legal contracts, confidential product information, sales reports and projections, competitive analysis, research and patent information, customer records, employee information, etc.

Because people can now access their e-mail from just about anywhere, mailboxes have transformed into repositories containing large amounts of potentially sensitive information. Likewise, collaboration solutions enable people to share information within the enterprise but also across organizations. As a result, information leakage can be a serious threat to organizations. Leaks of confidential information can result in lost revenue, compromised ability to compete, unfairness in purchasing and hiring decisions, diminished customer confidence, and more. This risk demands effective Information Protection and Control (IPC) systems, which are not only secure but are also easy to apply, whether it's to e-mail messages sent or documents accessed inside an organization or outside the organization to business partner organizations.

Note    IPC is also known as a different set of names including: data leakage prevention, data loss protection, content filtering, enterprise rights management, etc. All of these categories aim to prevent an accidental and unauthorized distribution of sensitive information.

One should note that IPC has been available for more than a decade but only few organizations are using this kind of solution. This can be explained by previous lack of interest of Business Decision Makers or by the complexity generally observed when deploying such a far-reaching solution. Also user's expectation is high and they are not tolerating any downtime. Users would not be satisfied if the protected document they are trying to read couldn't be open because an Information Protection element is not responding or if it isn't supported on their devices. Deploying on-premises IPC can be challenging and/or require significant knowledge to be done right. This was notably the case for Microsoft Active Directory Right Management Services (AD RMS), an information protection technology that enables AD RMS-enlightened applications such as Microsoft Office to protect digital content from unauthorized use, both online and offline, inside and outside of the organization's boundaries.

Unlike AD RMS, the Azure Rights Management service (formerly known as Windows Azure Active Directory Rights Management or AADRM) provides a Software as a Service (SaaS) information protection solution for everyone. As a highly scalable and available cloud-based IPC solution run by Microsoft in data centers strategically located around the world, the Azure Rights Management service enables organizations of any size to minimize the effort required to implement an effective IPC to sustain the collaboration inside and outside of the organization's boundaries.

With the Azure Rights Management service, the implementation process is fast and straightforward. Thanks to the Rights Management connector, providing information protection capabilities to existing on-premises servers onto the corporate network such as those running Exchange Server, SharePoint Server or Windows Server 2008 R2 or Windows Server 2012 operating systems (File Classification Infrastructure) is now just few clicks away.

Objectives of this paper

This document provides information about the Rights Management connector and how it can be used to provide information protection within existing on-premises deployments that use Exchange Server, SharePoint Server or operating systems such as Windows Server 2008 R2 or Windows Server 2012.

Furthermore, by following the steps outlined in this document you should be able to successfully prepare your environment to deploy the Azure Rights Management service, install and configure the connector, and start using it within your organization to create and consume protected content.

Non-objectives of this paper

This document doesn't offer a full description of the Microsoft Rights Management services offerings. It rather simply focusses on key aspects in the context of this paper that aims at providing the readers an understanding on how to leverage and deploy the Rights Management connector on their on-premises corporate organization to benefit from the Azure Rights Management service with Exchange Server and SharePoint Server existing deployments.

Note    For an overview of the NEW Microsoft Rights Management service offerings, see the whitepaper Microsoft Rights Management services, the online documentation as well as the posts on the RMS Team blog.

This document doesn't cover the configuration of Exchange Online and SharePoint Online with the Azure Rights Management service.

Note    For information on how to protect information in Office 365 subscriptions, please refer to the whitepaper Information Protection and Control (IPC) in Office 365 with Azure Rights Management.

The Rights Management connector recently adds the support of the File Classification Infrastructure (FCI) available in Windows Server 2008 R2 and above versions.

Note    FCI is controlled and exposed through the File Server Resource Manager (FSRM). FSRM is a feature of the File Services role in Windows Server 2008 R2 and above. It can be installed as part of the File Services role, using Server Manager. For more information on the FCI technology, see the white paper File Classification Infrastructure, videos on Channel 9 and of course the Storage Team Blog's post's on FCI.

FCI is a capacity that enables the server to scan local files and assess their content to determine if they contain sensitive data, and if they do classify them accordingly by tagging them with classification properties you define. Once files are classified, FCI can also automatically take action on these files, such as applying adequate rights management protection to the files to prevent them from leaking beyond their intended audience.

This document doesn't cover the configuration of FCI with the Rights Management connector.

Note    For information and instructions on how to leverage this additional workload with the Rights Management connector, see the Microsoft TechNet article Configuring a file server for File Classification Infrastructure to use the connector.

Organization of this paper

To cover the aforementioned objectives, this document is organized by themes, which are covered in the following sections:

• Azure Rights Management service at a glance.

• Overview of the Rights Management connector.

• Deploying the Rights Management connector.

• Testing and evaluating the Rights Management connector installation.

• Administering the Rights Management connector.

About the audience

This document is intended for IT professionals and system architects who are interested in understanding the various options for protecting and controlling on-premises information assets in their environment based on the Azure Rights Management service's foundation and how to leverage in this context the Rights Management connector related capabilities.

Azure Rights Management service at a glance

The Azure Rights Management service is a service designed to provide Information Protection and Control (IPC) capabilities that work with your devices, services and applications. As such, secure collaboration is enhanced and extended to organizations and individuals using computers and mobile devices.

Unlike Active Directory Rights Management Server (AD RMS) which is based on on-premises infrastructure, the solution is available as a Software as a Service (SaaS) solution in the Cloud. Hosted in Windows Azure, it's offered in the same regions as Office 365.

Note        As it is a cloud-hosted service, deploying Azure Rights Management does not require an on-premises deployment to provide the core functionality for Information Protection, though certain pre-requisites and integration services (e.g. the DirSync tool for Azure Active Directory integration and the Rights Management services connector for integration with on-premises servers) are required to obtain the maximum benefit out of the service.

The Azure Rights Management service provides continuous data protection during all the lifecycle of the information; the protection is persistent when the data is stored or shared between people and applications.

It is important to note that the Azure Rights Management service offering is location and device independent so once a document or email is protected it stays protected as it travels between clients, devices, servers and online services, even if the document travels outside of the organization's boundaries.

The Azure Rights Management service is focused at this time on organizations that don't have existing IPC capabilities in place. In other words, in the context of this paper, the Azure Rights Management service is aimed at those that don't have on-premises Active Directory Rights Management infrastructure. It must be noted that, unlike AD RMS, Azure Rights Management service can be subscribed and activated in a couple of minutes.

The Azure Rights Management service is used to achieve the following key scenarios:

• Limit e-mail and file access to only a specific list of individual users or groups identified by their e-mail addresses.

• Limit the use of e-mail and/or files to only a limited set of rights such as the right to view the document while blocking other actions such as copying or printing.

The Azure Rights Management service is responsible for secure electronic key exchange operations between the involved client devices, servers and/or other systems. In such a context, the Azure Rights Management service also requires authentication and authorization information and thus leverages Azure Active Directory and associated services, and notably Directory Synchronization and Federation. These enable authentication using Azure Active Directory with credentials matching those in the on-premises directory or through federation with an on-premises identity infrastructure – such as Active Directory with Active Directory Federation Services (AD FS). Support for additional identity sources, including Microsoft account, is planned for the future.

Protecting content

The Azure Rights Management service provides two ways to protect content: templates-based and user-defined rights.

Default rights policy templates

The Azure Rights Management service supports the application of policies to documents based on pre-defined rights policy templates which define restrictions such as user rights, expiration and offline access for the content they protect. Templates are predefined policies that enable users to easily apply permissions to IRM-protected content. Microsoft RMS provides default rights policy templates which represent commonly used policies.

The following default templates help restricting access to users within a company are provided:

• Company - Confidential. This template, when applied to content, helps to prevent recipients (or users of the content) to copy and print the content, whereas all other usage type is allowed.

• Company - Confidential View Only. This template, when applied to content, only enables recipients (or users of the content) to read or view the content but do not allow content modification in any way from its original published form.

Important note    When either of these Azure Rights Management service templates is applied to content, only users within the organization are able to open the content.

Important note    The name of the default templates reflects the name of the company specified when signing-up to an Azure Active Directory/Office 365 Enterprise subscription. "Company" is indeed replaced by the company name. If a tenant is named "DemoRMS" the two templates above are consequently named "DemoRMS - Confidential" and "DemoRMS – Confidential View Only".

Custom rights policy templates

The Azure Rights Management service provides the ability to create custom rights policy templates that let you define the protection policies you would like to roll out within your organization.

Note    For information and instructions on how to configure custom rights policy templates, see the blog post Create custom templates in Azure RMS with the Azure Management Portal and the Microsoft TechNet article Foo.

User defined rights

When users need to restrict content for specific audiences or need to apply specific rights which don't match the existing rights policy templates, end-users can also apply permission manually by defining their own rights. Users can enter users or groups that will get defined on the policy as well as define specific usage rights on content.

There's one special case for this scenario which is the protection of email through the Do Not Forward option available in mail clients. When the Do Not Forward option is applied, the content is protected with a custom policy that grants limited usage rights to the intended recipients of the email automatically so only those users can open it, and certain rights are restricted such as that of copying or forwarding the content, effectively limiting the audience of the email to its original recipients.

What can Microsoft see

Similarly to on-premises AD RMS infrastructure, the Azure Rights Management service works with the policy that was attached to a document (the Publishing License), where it looks up rights information and constructs a use license for the authorized recipient/user.

Note        For additional information on licenses, see the blog post Licenses and Certificates, and how AD RMS protects and consumes documents.

The Azure Rights Management service never sees the data that you protect or consume. This is an important point. You manage your data in accordance and compliance with your security and IT policies. In the primary use case for the Rights Management connector, you run Exchange Server or SharePoint Server on your premises, and your documents flow between those servers and the client applications, so no part of Microsoft's online services (including but not limited to the Azure Rights Management service) ever has access to your data unless you explicitly send or upload the documents or email to a Microsoft-hosted service.

**You use the Azure Rights Management service to control access to your content by issuing content-access licenses to authorized parties, both internal and external to your organization, but this user access is also dependent on the users having physical access to the documents themselves. Even if Microsoft Rights Management issues licenses for a user to access a specific document, that user won't be able to consume the document unless the user also has a copy of the document itself.
**

The Azure Rights Management service handles the following assets for your organization:

• Your tenant root keys (optionally protected by a Hardware Security Module, which marks the key non-exportable and non-recoverable)

• User-specific keys and certificates

• Centralized policies

• Configuration of your tenant

• Access logs for your tenant

Microsoft uses these assets solely for the purpose of providing you the Azure Rights Management service. Microsoft is deeply committed to our customers' privacy and security.

Note        For additional information on this topic, see the Microsoft Rights Management Privacy Statement and
Windows Azure Privacy statement.

Using RMS-enlightened applications

The Azure Rights Management service is built to work in conjunction with RMS-enlightened applications, i.e. applications that are enhanced to consume and/or publish RMS protected files such as Microsoft Office, Microsoft Office 365, Foxit Enterprise Reader, SECUDE End-to-End Information Security for SAP, etc.

Such applications offer data protection and rights enforcement capabilities by leveraging the RMS clients and Software Development Kits (SDKs) that are available on most important platforms: Windows and Mac OS/X computers, Windows RT and Windows Phone devices, iOS, and Android devices. Applications in other environments can interact with Microsoft RMS by utilizing the service's RESTful APIs directly.

Overview of the Rights Management connector

Many pre-existing on-premises solutions that provide Information Rights Management (IRM) functionality such as Microsoft Exchange and Microsoft SharePoint leveraged for that purpose RMS SDKs and clients that were not aware of the Microsoft RMS cloud-based implementation.

Since the ability to interact with the cloud-hosted Azure Rights Management service has only been introduced in later versions of the RMS SDK, these existing on-premises environments consequently don't natively support direct communication with the Azure Rights Management service, which resides outside the organization's boundaries.

Note    Microsoft Office 2013 utilizes the RMS SDK 2.0 and fully supports interacting with the Azure Rights Management service without the need for additional software.

To help address this situation, the Rights Management connector can be used to quickly enable existing on-premises servers such as Microsoft Exchange or Microsoft SharePoint to use their IRM functionality with the cloud-hosted Azure Rights Management service.

For that purpose, the Rights Management connector is implemented as a small-footprint service that is installed on-premises on a Windows Server 2008 R2 or Windows Server 2012 server. Once installed and configured – as covered later in this document – the Rights Management connector will act as a communications interface between the on-premises IRM-enabled servers and the cloud service. In other words, the Rights Management connector will act as a pass-through to the Azure Rights Management service for IRM calls. The Rights Management connector is like a cloud proxy/relay, and will behave as an on-premises AD RMS server and relay any related call to the Azure Rights Management service.

When on-premises IRM-enabled servers call one of the exposed Web services - as it will with a classic AD RMS server -, the Rights Management connector checks the identity of the caller, verifies that it is authorized to use the connector and performs an identical call against the Azure Rights Management service, and after obtaining the results returns the results to the calling server.

When verifying that the caller is authorized, the Rights Management connector checks that the identity of the caller is present in the local list of authorized identities (specified as either an AD user account, service account, computer account or AD group). This list also contains accounts (called Service Principals) that are specifically created as each authorized entity is added in the Administration tool and that will be used to perform all operations in Azure Rights Management on behalf of the servers that are authorized.

At the time of this writing, you can configure the following supported products and technologies to use the connector:

• Exchange Server 2010 and Exchange Server 2013

• SharePoint Server 2010 and SharePoint Server 2013

The next few sections outline a plan for designing, deploying and testing your Azure Rights Management service infrastructure with the Rights Management connector.

Note    For additional information, see the Microsoft TechNet article Rights Management connector.

Deploying the Rights Management connector

Making High level plan

In order to get the best of the Azure Rights Management service offerings, you need to plan its deployment carefully. Even though the Azure Rights Management service is much easier to deploy and use than previous solutions for Information Protection, you still need to meet certain pre-requisites and follow certain steps in order. In particular, you need to plan to:

• Configure the Azure Rights Management service. To install the Rights Management connector, it is necessary to first set up and configure your Azure Rights Management service.

  • Create your tenant. While your users could individually sign-up for the Azure Rights Management service, in order to benefit from Enterprise features such as integration with Office 365 and on-premises servers, logging, key management and super user access and to simplify the end users sign-up and login experiences, you need to provision a Microsoft Rights Management's tenant for your organization.

  • Configure your tenant. This includes setting up Directory Synchronization and/or Federation to make your users experience seamless.

Note    For additional information, please refer to the Microsoft online documentation and/or the whitepaper Active Directory from on-premises to the Cloud.

• Obtain and install prerequisite software.

• Download and install the Rights Management connector software.

• Configure the Rights Management connector.

• Authorize servers to use the Rights Management connector.

• Configure servers to use IRM through the Rights Management connector.

• Test IRM features.

The following sections guide you through these steps.

Configure the Azure Rights Management service

Creating your tenant

This is done by using one of the following options.

• Signing up to a Microsoft Office 365 Enterprise tenant and enabling the Azure Rights Management service.

-or-

• Signing up to the Microsoft Rights Management stand-alone service.

Option 1 - Signing up to a Microsoft Office 365 Enterprise tenant and enabling the Azure Rights Management service

To sign up to a Microsoft Office 365 Enterprise tenant, follow the instructions at http://www.microsoft.com/office/preview/en/office-365-enterprise.

Note    For more information, see the article Sign in to Office 365.

Once you have signed up and established your organization with an account in Office 365 Enterprise, enabling the Azure Rights Management service capabilities within the Office 365 Enterprise just takes a few additional steps to enable and configure for use.

By default, the Azure Rights Management service is disabled when you sign up for your Office 365 account in Microsoft Office 365 Enterprise.

To enable the Azure Rights Management service for use your Office 365 Enterprise tenant, you need to:

• Use the Office 365 admin center. Proceed with the following steps:

1. Navigate to the Office 365 admin center at https://portal.microsoftonline.com and login with your administrative credentials.

2. In the left pane of the Office 365 admin center, click Service Settings.

3. From the Service Settings page, click Rights Management.

4. Under Protect your information, click Manage.

5. Under Rights Management, click Activate.

6. When prompted Do you want to activate rights management?, click Activate.

-or-

• Use the Azure Rights Management service from Windows PowerShell

Note        Windows PowerShell
is a task-based command-line shell and scripting language that is designed for system/service administration and automation. It uses administrative tasks called cmdlets. Each cmdlet has required and optional arguments, called parameters, that identify which objects to act on or control how the cmdlet performs its task. You can combine cmdlets in scripts to perform complex functions that give you more control and help you automate the administration of Windows, applications and online services in the Cloud. It has become a common way to manage the latest generation of Microsoft products and services.

For more information about Windows PowerShell, please see the Windows PowerShell Web site, the Windows PowerShell online help, and the Windows PowerShell Weblog
Windows PowerShell Software Development Kit (SDK) that includes a programmer's guide along with a full reference.

• Install the latest Azure Rights Management Administration Tool.

• From PowerShell run:

PS C:\Windows\System32> Import-Module aadrm
PS C:\Windows\System32> Connect-AadrmService

Provide Office365 Tenant Administrator or Microsoft RMS Tenant Global Administrator credential

PS C:\Windows\System32> Enable-Aadrm
PS C:\Windows\System32> Disconnect-AadrmService

Note    The Microsoft Rights Management administration module for Windows PowerShell should only be used as needed for administrators and users of other service portals. For more information on this advanced alternative procedure, see the Microsoft TechNet article Enabling the rights management service.

Once activated, the Azure Rights Management service can be then administered via Windows PowerShell and/or through the Microsoft Online Portal.

Option 2 - Signing up to the Azure Rights Management stand-alone service

To sign up to an Azure Rights Management stand-alone service, proceed with the following steps:

• For a trial version, click on https://portal.microsoftonline.com/Signup/MainSignUp15.aspx?&OfferId=A43415D3-404C-4df3-B31B-AAD28118A778&dl=RIGHTSMANAGEMENT

• To buy the service, click on https://portal.microsoftonline.com/Signup/MainSignUp15.aspx?&OfferId=9DF77AF9-DAAE-4d51-8E0E-EEEADD4866B8&dl=RIGHTSMANAGEMENT

Important note    As illustrated in the above screen shots, if you already have an Azure Active Directory tenant created for other purposes, you can add that account by selecting the sign in to add this subscription to your current account option during the sign-up process.

**Whichever option you choose, Azure Active Directory must be already provisioned and the Azure Rights Management service must be already activated before proceeding with the installation and the configuration of the Rights Management connector.
**

Configuring your tenant

Once the Azure Rights Management service is enabled, it is required that Azure Active Directory is set-up to work with the users and groups in your Active Directory. While it is possible to use Office 365 with manually created accounts in Azure Active Directory, the use of the Azure Rights Management service along with the Rights Management connector requires that the accounts in Azure Active Directory are synchronized with Active Directory.

Note    For instructions on how to configure your Azure Active Directory tenant, see Microsoft TechNet article Administering your Windows Azure AD tenant.

Note    For instructions on how to enable directory synchronization with Azure Active Directory using DirSync, see Microsoft TechNet article Directory synchronization roadmap.

**Optionally enabling federation between your Active Directory and Azure Active Directory.
**

You have the option of enabling identity federation between your on-premises directory and Azure Active Directory, which enables a more seamless user experience through single sign-on to the Azure Rights Management service.

Note    For instructions on setting up federation with AD FS between Active Directory and Azure Active Directory, see Microsoft TechNet article Configure single sign-on.

**Certain configurations, such as access to SharePoint 2013 protected libraries from Office 2013 clients, require that federation is enabled.
**

Once you have completed the prerequisites, use the following procedure to complete installation of the Rights Management connector in your environment.

Installing the Rights Management connector

You can download the Rights Management connector software from http://go.microsoft.com/fwlink/?LinkId=314106.

A separate install for the 32-bit version of the Rights Management connector administration tool is available in the same location.

Set up a computer to run the Rights Management connector. The computer must meet the following criteria:

• 64 bit physical or virtual computer running Windows Server 2008 R2 or Windows Server 2012.

• At least 1GB of RAM.

• A minimum of 64GB of disk space.

• At least one network interface.

• Access to the Internet via a firewall or proxy that doesn't require authentication.

Furthermore, the computer must be in a forest or domain that trusts any other forest in the organization where there are installations of Exchange or SharePoint servers that you need to integrate with the Azure Rights Management service.

A minimum of two connector computers is required for fault tolerance and high availability. For additional information, see Section § Configuring the Rights Management connector for high availability.

Important note    A single connector installation (potentially consisting of multiple servers for high availability) needs to be installed per organization (or more specifically, per Azure Rights Management service tenant). Unlike AD RMS, there's no need to make one installation per forest.

To install the Rights Management connector, proceed with the following steps:

• On the target computer, download the Rights Management connector (RMSConnectorSetup_x64.exe) from the http://go.microsoft.com/fwlink/?LinkId=314106.

• Right click the file RMSConnectorSetup_x64.exe and select Run as Administrator on the target computer. The Rights Management connector setup wizard opens up.

You are now offered with the option to install either the Rights Management connector and the Rights Management connector administration tool or the Rights Management connector administration tool only.

Choose the first option to install the connector on the local computer.

Note    You can use the second option to install the administration tool on an administrator's computer. The minimum requirements for installing the administration tool alone are:

1. 32 or 64 bit physical or virtual computer running Windows Server 2008 R2, Windows Server 2012, Windows 7 or Windows 8

2. At least 1GB of RAM

3. A minimum of 64GB of disk space

4. At least one network interface

5. Access to the Internet

6. It must be member of a forest or domain that is trusted by forests in the organization where there are installations of Exchange or SharePoint servers that you need to integrate with Azure Rights Management.

• Click Next.

• On the End User License agreement page, click Next after reading the agreement and agreeing to its terms by clicking on the corresponding option.

As soon as you begin to use the Rights Management connector, you need to enter credentials with sufficient privileges to perform the installation.

An account with either of the following privileges will suffice:

• Office 365 Tenant Administrator. An account with administrator privileges on your Office 365 tenant. This applies to the Office 365 Rights Management service SKU add-on.

• Azure Rights Management service Tenant Global Administrator. For the Azure Rights Management service, an account with administrator privileges on the Azure Rights Management service tenant. This applies to Microsoft Rights Management stand-alone service SKU.

• Rights Management connector Administrator. An account in Azure AD that has been granted rights to install and administer the Rights Management connector for the organization. This applies to Microsoft Rights Management stand-alone service SKU.

If the last option is chosen, in order to assign the Rights Management connector administrator role to an account, you need to execute the following steps:

• Install the latest Microsoft Rights Management Administration Tools.

• From a Windows PowerShell command prompt, run the following command:

PS C:\Windows\System32> Import-Module aadrm
PS C:\Windows\System32> Connect-AadrmService

• Provide Office365 Tenant Administrator or Azure Rights Management service Tenant Global Administrator credential

• And then one of the following commands:

PS C:\Windows\System32> Add-AadrmRoleBasedAdministrator -EmailAddress -Role "GlobalAdministrator"

-or-

PS C:\Windows\System32> Add-AadrmRoleBasedAdministrator -ObjectId