I am new to AIP (Azure Information protection). My question is how do I enforce the protection of documents.
What I want: any document/email should be assumed to be for internal company only and not available to anyone outside of the org unless the user changes the label.
It actually works ok if the user has the AIP client installed; emails and documents they create are automatically labeled "internal" as expected. If the user uninstalls the client then documents work just like they would for anyone creating them, meaning there is no protection and no label is applied so the document can be sent to whomever and they can read it.
How can I ensure that every document/email has an automatic label even if the user doesn't have the AIP client installed?
If that's not possible (really?!) then how might I ensure the AIP client gets installed on and remains installed on each user's computer?
To allow automatic label you must configure the relevant settings but not all services work with the label, for example in Exchange you must to create Exchange Transport Rule to allow label, but there are some conditions when applying labels with AIP and Exchange.
Eli, thank you for taking the time to respond to my email and to gather those links; I really appreciate it. Let's set aside emails for the time being. I am chiefly concerned with documents being labeled and protected by default. If no emails at all were protected, but every document was, I would be content with that.
What are these relevant settings you mentioned in your first sentence?
I have set a policy and assigned my test user to it. There is a default label, but it only gets automatically applied if the AIP client is installed, which means a malicious user could just uninstall it to get around the labeling requirement.
Soon enough the Azure Information Protection client will be build into the Office Pro Plus clients, effectively solving one of your issues. Until then I think your best bet is to utilize Azure Information Protection in conjunction with Data Loss Prevention for sensitive data types.
In AIP you could enforce that all documents must have a label and ensure that all documents starts with a default label. It won't solve all you headaches, but It's a start I guess.
Also you can enforce transport rules through the Exchange Admin center, that will add protection to content that is being sent externally, even if that content is sent from devices or applications that does not support adding labels or protection to content.