SharePoint Online with Azure RMS

Hi Adrian,

SharePoint IRM and Azure RMS are related, but they are not same.

With Azure RMS, https://docs.microsoft.com/en-us/information-protection/deploy-use/configure-policy-templates and apply them to the documents. The rights you apply lives within the document, no matter where you store them or how you share them. In general, Azure RMS works in the organisation's domain level + security group. Example, john@contoso.com can apply a template to a document that allows everyone within contoso.com READ ACCESS (but NO PRINT) the document. John can send that document to his colleague@contoso.com by email, Azure will check for access right when the recipient opens the document using an Azure RMS supported application (e.g. Microsoft Office). If someone@contoso.com forwards that document to someone@xyz.com, that someone@xyz.com won't be able to read that document. How do you apply Azure RMS templates? Normally, end users can use the https://www.microsoft.com/en-us/download/details.aspx?id=53018 or Office backstage.

With SharePoint IRM, https://support.office.com/en-us/article/Apply-Information-Rights-Management-to-a-list-or-library-3bdb5c4e-94fc-4741-b02f-4e7cc3c54aa1 to use Azure IRM. You define the rights at the library level. You cannot use Azure RMS templates in a SharePoint library. Rights are applied ONLY when the document leaves the library. Within the library, documents are not protected using Azure IRM. Therefore, within SharePoint, you would create contributor or viewer group to control permission. This is by design to ensure that documents within SharePoint IRM configured library can be indexed, so that search returns those documents.

Now, if you upload an Azure RMS protected document to a SharePoint library (Azure RMS templates applied using AIP client or Office backstage), Search will not be able to index it, Search will not return that document.