First published on CloudBlogs on Apr 06, 2016

We talk a lot in the EMM space about MDM and MAM .  MDM and MAM are really just ways of trying to provide information protection .  MDM does it by trying to build a perimeter around the device and in so doing protect the data.  MAM tries to build a perimeter around the app . These are important layers of protection, but every organization has data that has to be shared (aka be mobile) and, therefore, it simply cannot be kept within the perimeter of the device/app.  Despite all their benefits, MDM and MAM technologies can only protect up to the device boundary – EMS exists to extend this boundary to be anywhere via Azure Rights Management (RMS).  To offer this kind of protection, we had to think of a new way of protecting this information.  Our solution was, at the risk of sounding dramatic, revolutionary:  If the information cannot be contained within a perimeter, it must become self-protecting. This is a really important concept to understand – especially when you recognize that the sharing of information will only accelerate, not decrease. You can read more about the self-protecting concept here , here , here and here .

A Single Viable Option

This is an area where Microsoft’s Enterprise Mobility Suite (EMS) provides capabilities that other EMM solutions simply cannot begin to offer.  To do this, this type of solution has to be engineered into the apps that are creating and viewing the information – and all of this really begins with Microsoft Office.  One question I ask in every customer meeting is, “ What percentage of data that’s shared across your organization or with partners is contained in the Microsoft Office docs? ”  The response is almost always “ north of 90%. ”  What we’ve done is develop a solution that addresses >90% of the docs that are shared – and this gets you almost entirely to a place where you have this dramatically elevated level of information protection.  This is accomplished through RMS . This aspect of your overall IT plan is critical because when your workforce tries to save their files to the cloud or their device, they may often need to share those files with customers or partners.  That means your organization’s data is not just moving beyond your perimeter – it’s moving entirely beyond your control.  Protecting every file in your organization can be quite a lot to bite off all at once though, however.  I suggest that you start with the most highly sensitive information – like docs from your HR, Legal, or R&D teams. I want to be perfectly clear: No other EMM solution can provide this level of security where the data/files themselves becomes self-protecting. More on self-protecting files here and here and here .

It’s fine if that seems a little scary.  But it’s ok.

This is where RMS via EMS go light years beyond what’s possible anywhere else in the industry. Simply put, Azure RMS is the component of EMS that helps you protect your company’s information by encrypting files such that only the identities you’ve pre-approved can access the file – and only then can they take pre-approved actions with the file. Every EMS customer can use Azure RMS to share their documents and files with anyone – whether they work for your organization or not.

Here’s a bit more detail on how this process works:

• When a protected document is opened, the user is asked to authenticate against Azure AD.
• When they have authenticated, the user’s rights to the document are checked and sent to the user’s client, the client then applies those rights.
• The users access is logged and the author of the document can check on the usage with document tracking.
• If an unintended user attempts to access a protected file and fails to authenticate (or they authenticate but don’t have rights), the author can be informed by email and can view the failed attempts through document tracking.
• If an authenticated and authorized user shares the file subsequently this is also tracked.
• Files may be protected using the RMS Sharing app or by using the RMS SDK available on all important platforms.
• It’s also important to note that this functionality still works when a user isn’t online (and therefore can’t connect to AAD). The rights are cached locally (in extreme cases you can reduce this cache to 0).  In other words, the rights are cached for a period of time defined by the administrator and, if the rights have not been verified after that time, access is denied.  In this way, your users that are out of contact – for example on a plane with no Wi-Fi – can still access their documents with the correct rights.

The Outlook, Word, Excel, PowerPoint apps on iOS and Android (as well as Windows) are all able to natively use Azure RMS .  Additionally, Adobe Reader and Foxit on iOS and Android also both support RMS. Each of these apps also are Intune MAM partners so you have control over the uncontrollable at multiple levels! No other EMM solution can offer the Data Loss Prevention capabilities across the Office mobile apps and Adobe – this is entirely unique to EMS. More on our Data Loss Prevention (DLP) functionality here and here .

Additional Resources:

• Watch more: Azure AD Join in Windows 10
• Take an in-depth training: Taming Android and iOS with Enterprise Mobility Suite
• Watch a demo: How to Enable Mobile Application Management (MAM) for Unenrolled iOS and Android Devices
  • Launch the corresponding virtual lab
• Watch a demo: How to Configure Mobile Application Management
  • Launch the corresponding virtual lab
• Get hands-on: Enterprise Mobility Suite trial
• Download analyst insights: IDC Technology Spotlight: Securing Productivity in the Borderless Enterprise