Integration of IronPort Edge devices with AIP

Question

Hi all&nbsp;Does anyone have any knowledge or insight on how to intregrate IronPort devices with AIP. The scenario is a as follows:&nbsp;1.) I can send a DNF protected e-mail to a 3rd party no problem. They are able to open it and read it without any issues.&nbsp;2.) Howwever their replies are coming into my mailbox as what appears to be OMEV2 protected content. However I can't open these mails in either Outlook or OWA. The e-mail arrives as a .rpmsg protected file but I can't open it.&nbsp;3.) Looking at the headers I have a suspicion that the Ironport devices are unable to succesfully open the file and are messing with it to the point where it's signature. Something is applying a warning in the message body indicating that the e-mail is from an external source nd I think this breaking the message sealing to the point where I can't open it...&nbsp;Anyone got any ideas??&nbsp;&nbsp;

nir hendler · Answer

PeterJNGL&nbsp;I don't know if this is related specifically to IronPort but it seems like your Exchange server is not enabled for AIP (Information Rights Management). Please review this document to see how to enable it and control the features:
https://docs.microsoft.com/en-us/office365/securitycompliance/manage-office-365-message-encryption
https://docs.microsoft.com/en-us/azure/information-protection/configure-office365#exchangeonline-irm-configuration

peterjngl · Answer

Nir Hendler&nbsp;&nbsp;Hi Nir&nbsp;&nbsp;It appears to have been something else but the question does still arise, if you wanted to allow a 3rd party edge device to inspect outbound and inbound mail that was protected with AIP it would need to have an ability to login into Azure AD as a superuser right and I'm talking in theory here 🙂&nbsp;&nbsp;The same would apply to some 3rd party service that was stamping signatures on outbound e-mail correct?&nbsp;&nbsp;&nbsp;

nir hendler · Answer

To integrate encryption and decryption capabilities by 3rd party apps and devices you can leverage the MIP SDK which provides you the required tools to achieve that.

peterjngl · Answer

Nir Hendler&nbsp;&nbsp;I've been chatting to another colleague of yours about this and will take this discussion offline.. Ok if I email you directly?&nbsp;&nbsp;

esaggese · Answer

PeterJNGL&nbsp;Two additional considerations: if a product integrates into the Exchange Server Transport pipeline (most email content scanning solutions do), they should be able to leverage the Transport Decryption functionality in Exchange, through which if their transport agent sits after the Transport Decryption agent and Exchange has Transport Decryption enabled, the third party solution receives decrypted versions of the email (Exchange itself has SuperUser privileges so it can decrypt the email for processing), without the solution having to have SuperUser itself, or use the SDK.&nbsp;
This is how most antimalware solutions work, for example: they sit after the transport decryption phase, so they see the content in decrypted form. Content is reencrypted before exiting the transport pipeline.
For all this you have to enable Exchange Server to integrate with AIP using the RMS Connector.&nbsp;
The other consideration is that this work for outbound protected email, and for inbound emails that are a reply to a protected outbound email. But if a third party protects email with their own key and sends it to you, you do not have the authority to use SuperUser privileges to decrypt someone else's content. So you cannot scan content protected by others at the transport layer (note that this is not the case in Exchange Online, since EXO has global superuser privileges for the purposes of content scanning so it can scan inbound protected content).&nbsp;
HTH

Forum Discussion

Integration of IronPort Edge devices with AIP

5 Replies

Resources