Forum Discussion
Does Rights Management Service currently support MFA claims from EAM?
We've been testing EAM (external authentication methods) for a few months now as we try to move our Duo configuration away from CA custom controls.
I noticed today that when my Outlook (classic) client would not correctly authenticate to Rights Management Service to decrypt OME-protected emails from another org. It tries to open the message, fails to connect to RMS, and opens a copy of the email with the "click here to read the message" spiel. It then throws a "something is wrong with your account" warning in the Outlook client's top right corner.
If I try to manually authenticate & let it redirect to Duo's EAM endpoint, it simply fails with an HTTP 400 error. When you close that error, it then presents another error of "No Network Connection. Please check your network settings and try again. [2603]". I can close/reopen Outlook and that warning message in the top right stays suppresses unless I attempt signing into RMS all over again.
However.. If I do the same thing and instead use an alternate MFA method (MS Authenticator, for example), it signs in perfectly fine and will decrypt those OME-protected emails on the fly in the Outlook client, as expected.
I verified that we excluded "aadrm.com" from SSL inspection and that we're not breaking certificate pinning. So all I can assume at the moment is that Rights Management Service isn't honoring MFA claims from EAM.
Any experience/thoughts on this? Thanks in advance!
1 Reply
Based on the behavior you've described, it doesn't look like a networking or SSL inspection issue, especially since excluding aadrm.com and bypassing certificate inspection didn't make a difference.
The fact that authentication succeeds and OME-protected emails decrypt correctly when using Microsoft Authenticator, but consistently fails when the flow is redirected to Duo through EAM, suggests that Rights Management Service may not currently honor MFA claims issued by External Authentication Methods.
This seems more like a service limitation than a client or configuration problem. I haven't come across any documentation explicitly stating that Azure Rights Management/OME supports EAM-issued MFA claims, so it's possible this scenario isn't supported yet.
It would be good if Microsoft could confirm whether RMS/OME is expected to work with External Authentication Methods today, or if support for this authentication flow is still planned.
