Tutorial: Enabling the “new” Office 365 Email Encryption

January 15, 2018

Tutorial: Enabling the “new” Office 365 Email Encryption

Previously we have covered Office 365 Message Encryption, as well as what used to be called Azure Rights Management (now Azure Information Protection). The name changes weren’t confusing enough for us, right? Well, awhile back they announced this big change to the email encryption experience. But it is a little bit misleading. That is, the “new” encryption technology isn’t really new at all.

Take for example this shiny new button we get for “protecting” our messages in OWA. With the “protect” feature, you are really just getting a shortcut to apply the Do Not Forward permission to your messages. But we had that capability before. You can also setup transport rules for it, which again, was available previously.

What really changed?

Using the original Office 365 message encryption feature, users would get an html attachment, and when they opened it, they would be asked to sign in (using a Microsoft account or a one-time passcode), which redirected the user to a website, where they could view the message online through a web browser. Now there is a new experience that makes things a little easier. Microsoft appears to be encouraging us to move away from the “old” experience of Office 365 message encryption, and toward the “message protection” features, from their website:

Here is how the experience looks for end-users, who are recipients of a protected message. If they have Outlook 2016, Outlook for iOS, Outlook for Android, or Outlook on the web, then they will be able to open these messages seamlessly in the Outlook client. If the recipient is signed into Outlook using their Microsoft account (and they have the latest updates), then they should be good to go.

On the other hand, if you don’t have the official Outlook client to open these messages, then users will have to click through to read their message on the web. Check out Gmail:

Notice, however, that the process is now a bit easier (no attachment) and I can even sign in using my Gmail account. One time passcode is still an option, also.

Just like that, I can retrieve my message via the browser:

Encrypt vs. Do Not Forward

Update: when this first came out, the Do Not Forward permission was the only option for encryption. But Microsoft has since released a new template called Encrypt which only encrypts the content, and does not apply the more “restrictive” Do Not Forward permissions. In both cases, if you are not the intended recipient, you will not be able to open and view the contents. You must be able to “sign in” as the intended user. Furthermore, when using Do Not Forward, the intended recipient will not be able to forward or copy the message contents out.

It is worth mentioning that the other permissions templates that are included–Confidential and Highly Confidential–still apply encryption and special permissions, but they only apply to internally sent messages (within the company). I think the vast majority of small businesses will be most interested in the Do Not Forward and most likely the Encrypt permission for that reason (with these it is possible to send external messages).

How to setup the new features

UPDATE: These features should be turned on and activated by default for new tenants with the correct licensing. See here. In a tenant who has not previously configured the Azure RMS or OME features, or if they have been deactivated, then you will need to confirm the following:

An Office 365 subscription that includes Azure Rights Management as well as Exchange Online or Exchange Online Protection (EOP).
An Azure Information Protection subscription and an Office 365 subscription that includes Exchange Online or Exchange Online Protection (EOP).

Then it is all done through PowerShell. Note that the following is accepting all defaults, and we’re not doing any fancy Bring Your Own Key (BYOK) or custom templates or anything like that. See this page for the source of this script:

#Connect to the Azure Rights Management service. 
$cred = Get-Credential
Get-Command -Module aadrm
Connect-AadrmService -Credential $cred

#Activate the service.
Enable-Aadrm

#Get the configuration information needed for message encryption.
$rmsConfig = Get-AadrmConfiguration
$licenseUri = $rmsConfig.LicensingIntranetDistributionPointUrl

#Disconnect from the service.
Disconnect-AadrmService

#Create a remote PowerShell session and connect to Exchange Online.
$session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $cred -Authentication Basic -AllowRedirection
Import-PSSession $session

#Collect IRM configuration for Office 365.
$irmConfig = Get-IRMConfiguration
$list = $irmConfig.LicensingLocation
if (!$list) { $list = @() }
if (!$list.Contains($licenseUri)) { $list += $licenseUri }

#Enable message encryption for Office 365.
Set-IRMConfiguration -LicensingLocation $list
Set-IRMConfiguration -AzureRMSLicensingEnabled $true -InternalLicensingEnabled $true

#Enable the Protect button in Outlook on the web (Optional).
Set-IRMConfiguration -SimplifiedClientAccessEnabled $true

#Enable server decryption for Outlook on the web, Outlook for iOS, and Outlook for Android.
Set-IRMConfiguration -ClientAccessServerEnabled $true

It can take awhile before all of this goes through, and if you just applied your licensing, you may be unable to proceed until the back-end service has caught up with you. But when you’re done, you can test it:

Test-IRMConfiguration -Sender [email protected]

Notice that if you get the IRM configuration, we no longer see the RMS publishing locations, etc.–those values are no longer needed with the new method.

Update: Decrypt Attachments

With regard to the new “Encrypt” template (which only encrypts and does not protect, or restrict, information), it is also possible to enable decryption of attachments, using this same cmdlet with a new toggle:

Set-IRMConfiguration -DecryptAttachmentFromPortal $true

For more details on how this changes attachments when using the “Encrypt” template, see this article.

If you are done with the configuration, you can exit your session:

Remove-PSSession $session

If you followed this procedure for a tenant where you had previously enabled the original Office 365 Message Encryption (probably with a transport rule), then following the above procedure, and simply replacing your transport rules will suffice to get you on the new hotness.

If setting up transport rules, you would not choose Apply Office 365 Message Encryption, as before, but instead, Apply rights protection.

Technical Azure Information Protection, Azure Rights Management, encryption, Office 365 21 Comments

Tutorial: Enabling the “new” Office 365 Email Encryption