Oct 26 2018
- last edited on
May 24 2021
I am new to AIP (Azure Information protection). My question is how do I enforce the protection of documents.
What I want: any document/email should be assumed to be for internal company only and not available to anyone outside of the org unless the user changes the label.
It actually works ok if the user has the AIP client installed; emails and documents they create are automatically labeled "internal" as expected. If the user uninstalls the client then documents work just like they would for anyone creating them, meaning there is no protection and no label is applied so the document can be sent to whomever and they can read it.
Oct 27 2018 10:06 PM - edited Oct 27 2018 11:27 PM
To allow automatic label you must configure the relevant settings but not all services work with the label, for example in Exchange you must to create Exchange Transport Rule to allow label, but there are some conditions when applying labels with AIP and Exchange.
But before starting with AIP label and Exchange take a quick look with the following URL's: https://docs.microsoft.com/en-us/azure/information-protection/faqs-infoprotect
For other protection such as RMS, you can apply Secure Email (OMEv2) and protect all content that go externally.
Oct 29 2018 07:09 AM - edited Oct 29 2018 07:10 AM
Eli, thank you for taking the time to respond to my email and to gather those links; I really appreciate it. Let's set aside emails for the time being. I am chiefly concerned with documents being labeled and protected by default. If no emails at all were protected, but every document was, I would be content with that.
What are these relevant settings you mentioned in your first sentence?
I have set a policy and assigned my test user to it. There is a default label, but it only gets automatically applied if the AIP client is installed, which means a malicious user could just uninstall it to get around the labeling requirement.
Oct 31 2018 04:03 PM
After talking to MS support, it seems this is not currently possible. At this time, the AIP client must be installed and remain installed for the default labeling behavior to work properly.
Nov 01 2018 04:11 AM - edited Nov 01 2018 05:47 AMSolution
Soon enough the Azure Information Protection client will be build into the Office Pro Plus clients, effectively solving one of your issues. Until then I think your best bet is to utilize Azure Information Protection in conjunction with Data Loss Prevention for sensitive data types.
In AIP you could enforce that all documents must have a label and ensure that all documents starts with a default label. It won't solve all you headaches, but It's a start I guess.
Also you can enforce transport rules through the Exchange Admin center, that will add protection to content that is being sent externally, even if that content is sent from devices or applications that does not support adding labels or protection to content.
You can also enforce Information Rights Management in selected or all SharePoint/OneDrive document library locations, to ensure protection for files located there.
Nov 01 2018 07:43 AM
have you seen the AIP Scanner? If you use OnPremise Data this tool can help you for automatic labeling and protection for documents.
You should think about combining AIP/Azure RMS with DLP where you can also protect shared documents or block sharing.