How to start your AIP project with only a selected group of users.

-

I am sometimes asked if AIP needs to be visible to all users, and usable by all users when customers are starting a PoC or just want to play around with the security settings in AIP. 


After all, you may not want all your users to start protecting content, and especially before they have been informed and trained. Well, Microsoft has thought of this, and an easy way to select only the users you want to include in the PoC/test is by using this simple PowerShell command:

Set-AadrmOnboardingControlPolicy

Info: Since this article requires you to have the AADRM PowerShell module, I have included a short guide on how to install this at the bottom.

The Onboarding policy is a great tool for a gradual deployment of Azure Information Protection. It gives us the ability to specify who should be allowed to protect content. We can chose either the members of a group, or select users by if they are licensed or not. 

If you want to give AIP only to the users who are licensed, you can run the following command:

Set-AadrmOnboardingControlPolicy -UseRmsUserLicense $True

If you would rather use a group to control which ones of your users who get AIP, you can find the groups Object ID in the Azure portal, under Azure Active Directory – Group - Properties (see illustration below) or run the Get-MsolGroup command.

Groups in Azure Active Directory

You can then run the following command:

Set-AadrmOnboardingControlPolicy -UseRmsUserLicense $False -SecurityGroupObjectId "feb2c2a7-0798-4b72-936b-c7454a53efb1"

to specify that only the members of this group should be able to protect content.
AIP should now only be usable for the users/groups you have specified. 



And when you no longer want to use the onboarding policy, regardless of if you decided to use group or license:
Set-AadrmOnboardingControlPolicy -UseRmsUserLicense $False

Installing the AADRM PowerShell module


Getting the AADRM PowerShell is done by starting PowerShell as an admin, and running the following command:

Install-Module -Name AADRM

You may receive a warning that you are installing from an untrusted repository. Press Y to continue.
If you already have AADRM PowerShell installed, but you need a newer version (the actions in this article requires AADRM PowerShell 2.1.0.0 or above) you can run:

Update-Module -Name AADRM

Hopefully this gets you one step closer to starting your AIP PoC.

Comments

Post a Comment

Popular posts from this blog

Do not Forward and the protection of attachments

-
Image
Maybe I am the only one who has misunderstood this, but if not, this may be useful for you. I've been wrong about this for a while, and since it is not a feature we have used, I didn't really look into it until today. I always thought that using Do not Forward in a label would make sure attachments where given the same DNF rights.  Unfortunately I was shown the error of my ways by one of my customers today, when I answered (with some confidence) that, yes: Attachments get the same protection. He then replied that he was able to do all kinds of things with the attachment, and I started to look into it more closely. Microsoft has many great articles about protecting information, and this article is no exception. I guess you just have to read it carefully. They say:  “When the Do Not Forward option is applied to an email, the email is encrypted and recipients must be authenticated. Then, the recipients cannot forward it, print it, or copy from it . For example, in the Outlook cli
Read more

Using Do not Forward or Encrypt Only as the results of a Sensitivity Label

-
Image
Do not Forward and Encrypt Only can be found in Outlook by default for all who uses Office 365 E3 or equivalent/higher. And as many know, they can also be used in a Sensitivity label. But what are the consequenses of using these, instead of creating our own encryption settings within the label? This is what we will be looking at today.  As many know, we can use these two in Outlook, as long as we have the proper license. They are well hidden away under Options, and can look a little like this:    EO and DNF in Outlook.  I've covered these in earlier blogposts , but lets just quickly go through them again here: " Encrypt/Encrypt-Only " option makes sure the email is encrypted and recipients must be authenticated, but then they have all usage rights except Save As, Export and Full Control (Basically means no restriction except that they cannot remove the protection). When the Do Not Forward option is applied to an email, the email is encrypted and recipients must be au
Read more