Azure Information Protection and the Information Protection Modernization Journey

Jeffery1967 checking in on this thread - have you, or anyone else here, found a reasonably priced alternative to AIP for email encryption? 

I am with an MSP managing 365 licensing for several thousand users. I have been scouring the internet for 6+ months now trying to find any option that is even remotely affordable. F1 licenses came up - cheap, but not eligible. E5 Information Protection and Governance - cheap, but not eligible (requires EMS E3 in addition to the IPG license itself). The "cheapest" alternative is Enterprise Mobility + Security E3, but at $10.xx that's still a significant increase over AIP's $2.00 price. 

As previously mentioned, Microsoft's documentation is still wrong on this. For example, both the Exchange Online Service Description and the Purview Message Encryption FAQ still state that you can add AIP to a Business Basic license. This is an incredibly frustrating issue and we have no solution.

MSFT-thommck 

I've been working with Microsoft sales support and it appears that there is no replacement product for the AIP P1 add-on.  The only method to get the same encryption function is to spend 300% to 500% more for the E3, E5, or similar license.  There was a mention of a "...new Microsoft Information Protection client (without the add-in) is currently in preview and scheduled for general availability --https://www.microsoft.com/en-us/security/business/information-protection/microsoft-purview-information-protection)." This appears to provide the e-mail encryption function I am looking for, but pricing doesn't seem to be available yet, so it may be no more cost effective than an E3 license.  The last exchange with Microsoft Sales support was that this previously available AIP P1/e-mail encryption is only available now if I purchase a license that adds 300% to my overall cost.  I am very disappointed that Microsoft chose to abandon a reasonable cost AIP P1 add-on in favor of only providing the encryption ability in it's most expensive licensing models.  This feels very much like Microsoft has decided to squeeze the customer for more money instead of continuing to providing reasonably priced products. Smaller business like mine do not need or require the full featured functions provided by the E3 and E5 licenses. Part of the reason I use Microsoft and have moved my customers to Microsoft is that their products and pricing have been very fair in the past. The behavior I see with this current product change is not well thought out, is detrimental to the customer.

Sorry, I'm not ranting at you. Your information was great and helped me track down an answer. Unfortunately, there just isn't a reasonable solution to my "Microsoft 365 E1 $10/month" + "AIP P1 $2/month" to provide encryption other than "Microsoft 365 E3 (no Teams) $33.75/month" or just under a 300% increase in cost. The E3 product also forces products like the Microsoft Office suite on me that I do not want.  With products like Open Office that are free and just as functional as Microsoft's desktop products, paying $400+ doesn't make any sense.  Anyway, thanks for all the help, but there is no way to provide a solution when one isn't available.

MSFT-thommck ,

Thanks for the links and info, but unfortunately, it does not provide a path forward.  Your message indicates that, "You can also add Azure Information Protection Plan 1 to the following plans to receive Microsoft Purview Message Encryption: Exchange Online Plan 1, Exchange Online Plan 2, Office 365 F3, Microsoft 365 Business Basic, Microsoft 365 Business Standard, or Office 365 Enterprise E1." However, this product can't be purchased and appears to be discontinued: "As part of this journey, partners and customers can no longer purchase new standalone subscriptions for AIP P1 as of January 2024. ." --ref (https://learn.microsoft.com/en-us/partner-center/announcements/2024-february) .  The same document referenced seems to indicate that only E3, E5, F3, and Business Premium can utilize Microsoft Purview Information Protection.  This leaves the average consumer with Business Basic or E1 unable to utilize encrypted e-mail without spending between 300% or 500%+ more on their licensing instead of the $2/month option that AIP P1 offered.  I also reviewed the links you provided, but even there, it's a journey down the rabbit hole.  The message encryption FAQ tells me that I have to migrate AD RMS to Azure Information Protection. I don't believe I have any Azure RMS services active, but when I try to follow the link from the FAQ on how to migrate, the directions don't work and are confusing. After multiple months trying to provide encrypted e-mail for my E1 and Business Basic accounts, I'm at a loss and other than the recommendation to spend 300% to 500% more on an E3 or E5 plan, I'm constantly getting contradictory information. Honestly, since Microsoft has made these changes, I don't think that the departments are up to speed yet and I probably just need to take a 6 month or 1 year timeout and try again when Microsoft has figure things out internally.  Thanks for trying to help. I'll try the FAQ again when my brain is fresher.

Jeff

edit 4/5/2024: changed "unfortunately it does provide a path forward" to "unfortunately it does *not* provide a path forward".  Funny how missing one word changes the meaning. 😄

Bob_Dickson, Jeffery1967 

This blog post is talking about the AIP add-on client, not licence. The Purview name is just an umbrella brand for all of the Microsoft Compliance features. Although it has many products and services underneath them you don't need to buy or use them all. A lot of what you need is included in the M365 subscriptions. The general rule is, if it will use an Office feature then the relevant Purview service will be included in one of the subscriptions (e.g. E3, E5 etc). If you are using OME currently then my understanding is it will just automatically become PME

To use Microsoft Purview Message Encryption, you need one of the following plans:

• Microsoft Purview Message Encryption is offered as part of Office 365 Enterprise E3 and E5, Microsoft 365 Enterprise E3 and E5, Microsoft 365 Business Premium, Office 365 A1, A3, and A5, and Office 365 Government G3 and G5. You don't need additional licenses to receive the new protection capabilities powered by Azure Information Protection.

• You can also add Azure Information Protection Plan 1 to the following plans to receive Microsoft Purview Message Encryption: Exchange Online Plan 1, Exchange Online Plan 2, Office 365 F3, Microsoft 365 Business Basic, Microsoft 365 Business Standard, or Office 365 Enterprise E1.

• Each user benefiting from Microsoft Purview Message Encryption needs a license to use message encryption.

• For the full list, see the Exchange Online service descriptions for Microsoft Purview Message Encryption.

As mentioned in the EXO Service description link, you must add Azure Information Protection Plan 1 to the following plans: Exchange Online Plan 1 or 2, Office 365 F3, Microsoft 365 Business Basic or Standard, or Office 365 Enterprise E1 To receive Microsoft Purview Message Encryption. @Bob, it seems the article you linked to is talking about is Azure related. Although the rights management is connected between Azure and M365 you won's see the old AIP name in the Azure Portal 

 

To use the feature you don't need to install anything as it is built into the Outlook desktop apps and the web version.

 

The FAQ is a great source of info, including what the differences are between OME, IRM and the Purview Solution Message encryption FAQ | Microsoft Learn

 

FYI, if included in your licence, you can also use the sensitivity labelling encryption features in Purview Information Protection. That has the added benefit of working on files as well as emails. More info on this is here: Apply encryption using sensitivity labels | Microsoft Learn

 

I hope that helps. That's about the limit of my knowledge. For purchasing add-ons open a billing related support ticket with Microsoft or contact your licensing reseller

MSFT-thommck ,

Thanks for the information. I did a quick look at the document, but I have a couple of questions that I'm hoping you can answer for me:

1. The Purview system seems to be a LOT more than the AIP P1. We don't want/need data governance. We are a very small company. (i.e 2 consultants) Designing a reasonable data governance rule set would be a large task and likely give a false sense of compliance while not be being more effective than us hitting an encrypt key when we feel it is necessary.  Does Purview have a similar "Encrypt" button that shows up on the toolbar when activated like the OME in AIP P1 did? (i.e. Can you easily make a manual decision to encrypt a message?)
2. We have Microsoft 365 Business Basic and one legacy Office 365 E1 license (mine) that I plan to move to business basic one day when I have the time. Keeping in mind our current licenses and our need for just simple "on demand" e-mail encryption, which would be the most cost effective license to move to or add-on to add?  The $2/user cost of AIP P1 was one of the major draws to using the Microsoft service instead of some third party, so I'm hoping that there is a similarly priced option as with most small businesses, cost is a critical factor in everything we do.

I've been dealing with MS Sales and MS Support on multiple tickets and no one has given me a straight answer for almost 2 months now.  My most recent email indicated that " If you’re using any of the following plans, you can also add Azure Information Protection Plan 1 to receive Microsoft Purview Message Encryption..." I don't think they got the memo that the AIP P1 add-on is no longer available or at very least it doesn't show up in my Purchase Services screen.  I hope you don't mind that I'm going to forward the subscription and billing rep a link to this page.  It is weird that the AIP P1 (trial) is still available and is what started me down this path.

Your expertise and help is greatly appreciated and has helped me move toward a solution from this multi-month goose chase. 

Jeff

MSFT-thommck 

I think what we are missing is what are our licensing options for Purview Message Encryption after April.

For example, I have a customer with a ton of M365 Business Basic Users.  How will they be able to send encrypted messages after April?.

The article below states:

"Microsoft Azure — Removed all references to Azure Information Protection Premium Plan 1.

From April 2024 it will no longer be a chargeable license product, but the functionality will continue."

Does this "functionality" apply to Purview Message Encryption?

https://medium.com/version-1/monthly-microsoft-license-update-january-2024-d006b64b7452

Jeffery1967 This blog article has been replaced with the one here so please take a look at that as well.

Office Message Encryption has been deprecated since July 1, 2023. 

You should move to Purview Message Encryption. There are details on how to do this here: 
https://learn.microsoft.com/en-us/purview/legacy-information-for-message-encryption 

There is the full docs on the new Purview Message Encryption here: https://learn.microsoft.com/en-us/purview/ome 

Craig - thank you for the license information, I appreciate it. I'll probably start recommending business premium to get the email encryption and other features.

AashishRamdas ,

So from what I've seen, the "Azure Information Protection add-in for Office" will be retired April 2024.  As several above have pointed out, there is a VOID of knowledge on how to move forward with the encrypted OME e-mail function  that was provided by AIP P1.  Is this just discontinued, has this moved to another product, or something else?  An answer will greatly be appreciated as my AIP P1 trial ran out last month and no one at Microsoft has a clue on how I can purchase it or convert my trial. I've got tickets open with Azure Support, Azure Sales, M365 Support, and M365 Support and everyone is pointing at the other guy and giving me directions that start with go to the Azure Portal which doesn't exists anymore.  As much as I dig through the Entra portal, there don't seem to be the same links.  This leaves me stuck with an expired trial that did exactly what I wanted, no way forward provided by Microsoft, and if they do provide a way forward to purchase a AIP P1 license, the fear that it will stop working in April.

Thanks In Advance for your help,

Jeff

Kent, I was told by distribution that Enterprise Mobility + Security E3, Microsoft Business Premium, and then Office 365 E3 are your options from cheapest to most expensive that include email encryption. Of course, there are E5 licenses that will include message encryption, but they are a bit out of reach for the majority of my customers. Enterprise Mobility + Security E3 is still a HUGE increase over AIP at $10.60/user/month!