SharePoint Online with Azure RMS

Hi Adrian,

SharePoint IRM and Azure RMS are related, but they are not same.

With Azure RMS, you create Azure RMS templates and apply them to the documents. The rights you apply lives within the document, no matter where you store them or how you share them. In general, Azure RMS works in the organisation's domain level + security group. Example, john@contoso.com can apply a template to a document that allows everyone within contoso.com READ ACCESS (but NO PRINT) the document. John can send that document to his colleague@contoso.com by email, Azure will check for access right when the recipient opens the document using an Azure RMS supported application (e.g. Microsoft Office). If someone@contoso.com forwards that document to someone@xyz.com, that someone@xyz.com won't be able to read that document. How do you apply Azure RMS templates? Normally, end users can use the AIP client or Office backstage.

With SharePoint IRM, you configure a library to use Azure IRM. You define the rights at the library level. You cannot use Azure RMS templates in a SharePoint library. Rights are applied ONLY when the document leaves the library. Within the library, documents are not protected using Azure IRM. Therefore, within SharePoint, you would create contributor or viewer group to control permission. This is by design to ensure that documents within SharePoint IRM configured library can be indexed, so that search returns those documents.

Now, if you upload an Azure RMS protected document to a SharePoint library (Azure RMS templates applied using AIP client or Office backstage), Search will not be able to index it, Search will not return that document.

Hi Adrian,

Azure RMS and SharePoint Azure IRM are related but not same.

With Azure RMS, you create RMS templates and apply them to the documents, rights are applied on the document level. How do you apply the templates? As an end user, you do this using AIP (Azure Information Protection) Add-in in Office or you can use backstage of Office application.

Azure RMS templates from Office backstage

Azure RMS protection lives within the document, no matter where they are stored and how they are shared (email, DropBox, OneDrive etc.).

When you use SharePoint IRM, it is different. You configure a library to use IRM, you define the protection requirements at the library level. You cannot use Azure RMS templates in a SharePoint library. Protection is applied on the document ONLY when the document leaves the library (e.g. when you download a document). This design is to ensure that SharePoint can index the documents, and Search can find the documents. So within SharePoint, the document living within an IRM protected library doesn't have any protection, within SharePoint you control access using SharePoint permission. For example, you can create contributor or viewer group to control who can edit and who can view.

Now, if you upload an Azure RMS protected document to a SharePoint library (when you apply the templates using AIP client using Office), rights applied on the document will not be affected. SharePoint search will not be able to index that file, it won't show up in the Search.

In general Azure RMS/IRM works on the organisation's domain level. Example, john@contoso.com can apply a template to a document that allows read access to anybody within contoso.com domain, now if someone from the contoso.com forwards that document to someone@xyz.com, that someone@xyz.com will not be able to read the document.

OK, so I've figured this out. IRM doesn't explicit work with Azure RMS templates. It basically keeps the SharePoint Online permissions to the file. This means that if the file was downloaded and tried to open on another computer (as another user) you would still need to be a member of a group that has access to the file.

...users could edit the files before as the default permission was 'Contributor'

Also I wanted to ask if this be a good instance to store highly confidential files or would you suggest storing the files locally and setup on a 2012R2 server, with the AzRMS connector and FCI? I am looking at sharing the files with some external users also, which is why i opted for AzRMS rather than AD RMS.