Prepare for GDPR – Protect Your Most Sensitive Data with Azure Information Protection

Leave a comment

The main objective of General Data Protection Regulation (GDPR) is to protect all European Union (EU) citizens from privacy and data breaches. This regulation impacts every organization located in the EU and it also applies to organizations located outside of the EU if they offer goods or services to EU data subjects. To ensure that there is proper security of such data, you should consider implementing solutions and processes that enable you to identify, classify, and protect data regardless of where it resides.

My most recent work has provided me with an opportunity to work with Microsoft Azure Information Protection (AIP) in Office 365. This technology provides persistent data protection, by classifying, labeling, and protecting documents and emails. In my previous posts, Classifying Data with Azure Information (AIP) – Introduction and Classifying and Protecting Data in Office 365, I provided an overview of AIP including descriptions of labels, how they are created, and how to classify your documents and emails. Additionally, Azure Rights Management (Azure RMS), the protection technology used by AIP, allows for encryption and authorization, ensuring users must successfully authenticate to access the documents and emails.

What are labels?

In AIP, a classification label is used to identify data based on its level of sensitivity and the impact to your business.  Most common sensitivity levels are categorized as restricted, confidential, official use, and public.

Unified Labeling and Protection

If you’ve worked with Office 365 and Azure Information Protection in the past, you may have noticed that there are two different technologies where labels can be created in Security and Compliance Center and Azure portal; this caused quite a bit of confusion of when to use which technology. Microsoft has been working towards providing a more consistent classification, labeling, and protection model that will be used across Office 365 and AIP.

The consistent protection model Private Preview will start soon, no announcement has been made as to when this will be generally available. The consistent labeling model will help ensure that sensitivity labels are recognized across Azure Information Protection, Office 365 Advanced Data Governance, Office 365 DLP and Microsoft Cloud App Security.

The following images show one central location where a label can be created, protection can be configured, and a retention policy can be applied.

Automatic Labeling (Classification)

The ability to automatically classify data is a critical part of helping organizations achieve GDPR goals. Azure Information Protection has 80+ built-in sensitive information types that can be used to detect and classify your data. Microsoft is working on releasing a GDPR template which will include additional information types such as addresses, telephone numbers, and medical information to help detect and classify personal data relevant to GDPR. This new sensitive information template will make it simpler to detect, classify, and protect GDPR related personal data.


The European Union’s General Data Protection Regulation (GDPR) will be enforced on May 25, 2018. Organizations can be fined up to 4% of annual global turnover or €20 million for breaching GDPR. If your organization collects, hosts, or analyzes personal data of EU residents, you should not delay in implementing solutions to ensure compliance with GDPR.


Back Up All Azure Rights Management Templates via PowerShell

Leave a comment

I need to update properties of several custom templates in my tenant. After reading the warning in Set-AadrmTemplateProperty (see excerpt below), I want to ensure that I have at least a last-known-good set of these templates.

Excerpt from article:

Important: When you update properties of a custom template, the existing settings for those properties will be overwritten (not supplemented) without warning, so be sure to specify all the settings that you need for the properties that you are updating.

As a best practice, back up the existing template before you run this cmdlet, by using the Export-AadrmTemplate cmdlet. Then, if you need to revert to the original configuration, you can use the Import-AadrmTemplate cmdlet to restore the template.

The Export-AadrmTemplate article provides an example of how to export (back up) one template. Well, I don’t want to do this (one at a time) for all the templates I have in my tenant. So, I wrote the following script to export all templates that I need.

$ShortDate = Get-Date -Format yyyyMMdd

$OutPath = “C:\Azure RMS\Backup\”

$OutFolder = New-Item -ItemType Directory -Force -Path $OutPath$ShortDate

Foreach ($Template in ($Templates = Get-AadrmTemplate))


    $TemplateName = $Template.Names[0]

    $TemplateStatus = $Template.Status

    If ($TemplateName -match “1033” -and $TemplateStatus -match “Published”)


        $RMSTemplateFileName = ($TemplateName.Value.Substring(0) -replace ” “,“” -replace “\\”,“” -replace “-“,“”)

        $OutFile = $($OutFolder)\$($RMSTemplateFileName).xml”

        Export-AadrmTemplate -TemplateId $Template.TemplateId -Path $OutFile -Force



Get-Variable | Remove-Variable -EA 0

Get-PSSession | Remove-PSSession


The script creates a new directory and writes the export files to it in case I need to run this frequently.

Obviously, the If statement and any of the variables can be changed to meet your needs.

This script works well for me.

Thanks for reading!

Password-protected and Azure Information Protection

Leave a comment

As you read Azure Information Protection client administrator guide on file types supported section, it is clearly stated that ‘Any file that is password-protected cannot be natively protected by the Azure Information Protection client. It lists a workaround by changing the default protection level via registry keys. If you’re not onboard with changing the default protection level and changing everyone’s registry keys, perhaps you would consider the following as a workaround.

Before I get to the workaround, it is necessary that I provide a bit of background on how I got here.

I classify an Excel file with RMS (Co-Author) rights, encrypt it with a password, and attach it to an email.

The recipient opens the attachment and sees this error:

“Excel cannot open the file <FileName>.xlsx because the file format or file extension is not valid. Verify that the file has not been corrupted and that the file extension matches the format of the file.”


Here’s the workaround I came up with.

  1. I classify the document with RMS enabled (same as before)
  2. I rename the file to <FileName>.pxlsx
  3. I attach the file to an email
  4. The recipient saves the file locally
  5. The recipient opens Excel, then opens the <FileName>.pxlsx
  6. The recipient provides the password to the file


7. The recipient selects ‘Yes’ in the dialog box


8. The file opens successfully

This is my workaround on this issue. I’m hoping that Microsoft will include password-protected files as one of the supported file formats in the near future.

Thanks for reading!

Persistent Permissions with Azure Rights Management

Leave a comment

We all know that embedded classification and protection follow the data regardless of where it is stored when using Azure Information Protection (AIP) and Azure Rights Management (Azure RMS), but what happens when the classification label is deleted from AIP portal.

Today, I had to create a scoped policy to test automatic classification for a group of pilot users. One of the requirements was to delete the scoped label after the pilot users completed their testing.

I created a scoped label (sub-label), under ‘Confidential’, called ‘Privacy – Read’ which is configured with Azure RMS with View, Reply, and Reply All rights. The label was configured to automatically apply when a Belgium National Number is detected. As you can see in the following two images that automatic classification was applied when the document was created and when it was attached to an email

I deleted the label from my tenant, and reopened the document I created earlier to check its classification label. The document was automatically reclassified as its parent label ‘Confidential’ which has no RMS nor any automatic classification configured. The same document was resent as an attachment to an email.

As you can see, permissions associated with the document persist even though the document was automatically defaulted to the parent label (Confidential) which is not configured for RMS protection.


Thanks for reading!

Azure Information Protection Administrator Role

Leave a comment

Great news for organizations that have concerns about granting Global Admin or Security Admin rights to users who need to manage Azure Information Protection policy.

The Azure Active Directory team have added a new role named Information Protection Administrator.  Members of this role can manage Azure Information Protection labels and policies using Azure portal, and use RMS PowerShell

Note that the role is currently in public preview.


Great news!!

G Suite Sync with Microsoft Outlook and RMS

Leave a comment

Today I had the opportunity to try out sending RMS protected messages to external recipients who use native Exchange-Outlook and G Suite Sync with Outlook.

I send a message to the external recipients from Outlook.

The external recipient with Outlook (I’ll call her Carmen) already has AIP client installed and RMS enabled in her tenant. The message opens with no issues.

The external recipient with G Suite Sync and Outlook (I’ll call him Ben) receives the message with the following text in the reading pane.

This message with restricted permission cannot be viewed in the reading pane until you verify your credentials. Open the item to read its contents and verify your credentials.

After double clicking on the message, the message below is displayed. Note that the sender is MOD Administrator from the sender tenant.


After the Ben verifies his credentials, the email message is displayed.

So far so good.

Carmen replies all from Outlook; all is normal.

Ben replies all from his Outlook client; the original sender (MOD Administrator) and Carmen see this:


However, when Ben replies all from Gmail via the Web browser, he sees the following message:

“You’ll automatically get an email copy of this message.” along with the label and the owner of the messages.

The original sender (MOD Administrator) and Carmen can view the message with no issues.

Ben, however, sees that the message comes from, not from his email address.


After the Ben verifies his credentials, the email message is displayed.

In summary – if you are using G Suite Sync with Outlook and responding to an encrypted message, be aware that your recipients may not be able to view your responses.

Thanks for reading!