Office 365 Message Encryption. OME.

[Robert Bollinger]

Hey Guys

Trying my best to figure out some of the finer details about office 365 old OME vs New OME. This line has me confused: https://docs.microsoft.com/en-us/office365/securitycompliance/ome-faq

Who can use OME?

You can use the new capabilities for OME under the following conditions:

If you have never set up OME or IRM for Exchange Online in Office 365.

The above doesn't make any sense to me, what do they mean by you can use the new ome if you never setup the old OME? 

Do they mean automatically, ever, on tuesday ? what are they talking about i have both versions of OME up and running. I Don't see why they made the above statement. 

Thanks, 

Robert

[#2]

Hi Robert,

I think they are referring to the question a bit further down that page, when comparing the new OME features to the legacy OME/IRM features.

In other words, if you set up OME in a tenant today which has never had it set up before, all the new OME features will work as it uses AIP.

If you set it up with AIP some time back as opposed to AD RMS then the new features introduced will work as that is now the current and default setup.

If you set it up with Azure RMS some time back then you’ll need to migrate that to AIP first in order to use the new OME features.

If you continue to use AD RMS then the new OME features won’t work.

That is my take on it. I had to read it a few times! Hope that makes sense and answers your question.

Best, Chris

[#3]

Thanks Chris. So if i have this understood, and please correct me if i dont. I am trying to take my office 365 (70-347) exam and up until now i have been doing alright with the studying. but OME *.* really has me confused. 

1) For any Version of OME to work, you had to enable IRM (exchange side) and Either AD RMS (Old On Prem way) or Azure RMS ? Is that Right? What is the difference between Azure RMS and AIP's RMS? (didn't even see that) (I know that AD RMS is on Prem)

2) As you said, i think you are correct, if you enable OME now you only have the option of using the NEW OME, if you previously had it enabled then you could use either the OLD OME or the NEW OME (such as my tenant) 

3) Am i correct in assuming that the ANY of the OMEs require some version of AD RMS, Azure RMS, or AIP? that would be where they get their templates from right ?

Thanks and sorry to hit you with so many questions, but the more i read the more i seem to get confused. 

Robert

[#4]

Thanks Robert,

I took 347 last year as part of the MCSA Office 365 too. I hope that I can clarify this to you to support a successful exam. It is a confusing element. This is probably the best article that I can find (I did an extensive search this morning)

https://docs.microsoft.com/en-gb/azure/information-protection/aka

I would use it together with

https://docs.microsoft.com/en-us/office365/securitycompliance/ome-faq

To answer your questions

1.) This is technically a no. IRM (rights protection) is different from OME (encryption). As the article states IRM was the Office implementation of the technology that supported AD RMS (on premise) and Azure RMS (cloud) - in other words it protected what you could do with documents (I.e. download them, forward them) and, as people are more familiar, templates. Back in the day, when you had AD RMS/Azure RMS and before AIP came out, IRM was included so you typically set them up to work with encryption. Today, IRM (rights protection), like OME (encryption), is a part of the RMS technology which AIP is built on so again you typically set them up together. However, there was a period where OME could be applied when IRM wasn't in AIP, and technically, you can implement encryption for email without having to implement rights protection for documents. To answer your sub question, there should be no difference between Azure RMS and AIP RMS: they are synonymous. I don't really know why Microsoft persists on keeping both names and I imagine they will be phased out in the future.

2.) That is correct, if you add AIP now you have the new capabilities automatically. Legacy OME from older implementations of AIP's should have been upgraded and if you had an old AD RMS on premise SKU then you would migrate it to AIP in order to be able to use the new functionalities or keep it and have the older functionalities.

3.) The templates are referring to are the rights protection of documents which is IRM within RMS, not the OME aspect of RMS. To have IRM on the Microsoft platform and have the ability to control what happens to documents you need AIP, and previously Azure RMS or AD RMS (if on premise) because these are the only services which offer the rights protection of documents and where they got their templates from (I.e. confidential, highly confidential).

Hope that helps to clarify and answer your questions.

Best, Chris