Azure RMS best practices for auditing

[alphadeltaromeo]

Hi,

I'm having difficulty trying to implement this where the o365 global admins (and who do not have read access to the file), would be the ones using the auditing tool.

I'm assuming I would only install the Track and Revoke AIP tool on the admin PCs, but grant them 'special' rights'? 

...and also just to confirm, if a user has the following rights:

View Content, Export Content (Save As), Save File, Edit Content

If they were to save as...'NewFile.docx', how would that impact the auting? (it seems to keep the same Policy and Tracking info regardless of the filename)

It also appears users with these RMS permisisons are able to remove the RMS protection (inc Tracking) from the original file.

To clarify, I am trying to acheive the following:

[POLICY1]

-ADMIN
Read: Yes
Audit and Tracking: Yes

-End-User:
Read: Yes
Edit/Save: Yes
Remove/Change RMS Protection: No

[POLICY2]

-ADMIN
Read: No
Audit and Tracking: Yes

-End-User:
Read: Yes
Edit/Save: Yes
Remove/Change RMS Protection: No

I'm not sure if this is possible, but any suggestions would be great!

Thanks

[#2]

This is basically what I am trying to achieve.

Could someone clarify the Owners and Authors? ie. from the Azure Classic Portal; Authors has FULL Control. When configuring the RMS protection in the new Azure Portal Co-Owners do not have FULL Control.

Are Owners/Authors (Co-Owners/Co-Authors) the users that creates the document?

In addition, is it possible to have a group of users manage auditing?

For example, HR Dept. has a confidential document and wants to track and audit it. Is it possible fo the HR dept to use the track and audit portal  and what access would they need?

I understand the AIP Client must be installed on the computer they are auditing from..