Move to modern experience in SharePoint and what you need to know about it

Modern experience in SharePoint

Microsoft offers a good overview about all topics in this context on this website: https://docs.microsoft.com/en-us/sharepoint/guide-to-sharepoint-modern-experience This article is structured with the following headlines: Information architecture and hub sites, Navigation, Branding, Publishing, Search, Sharing and permissions.

I already posted about some of these topics:

• Information architecture and hub sites => Summary about Modern Team Sites, Communication Sites & Hub Sites
• Branding => Summary about Modern Team Sites, Communication Sites & Hub Sites
• Sharing and permissions => Coaching your users through the External Sharing Experience

Other topics:

• Navigation: The “inherited” navigation feature in classic SharePoint site is not available in the modern experience. Hub sites provide another way to achieve cross-site navigation previously available in managed navigation and site hierarchies in classic SharePoint. 
• Publishing: In the modern experience, Communication sites replace traditional publishing sites. Communication sites are easier to build and maintain, and include new features such as a modern authoring canvas. Also multilanguage capabilities will be available soon. They allow you to. To sum up: you can quickly create beautiful and responsive pages to share news, reports, statuses, and other information in a visually compelling format - all without heavy developer investment. You can get inspired with some great examples in the SharePoint Lookbook.
• Search: SharePoint has both a classic and a modern search experience, where Microsoft search in SharePoint is the modern experience. Microsoft is actually in the middle of a transition from Classic Search to Microsoft Search. Because of this there are other differences, especially around customization. More details: When to use which search experience. The most visible difference are:
• Microsoft search box is placed in the header bar
• Microsoft search is personal. The results you see are different from what other people see, even when you search for the same words
• Search as you type: And you'll see results before you start typing in the search box, based on your previous activity and trending content in Office 365

Modernize your root site

A root site, f.e. https://contoso.sharepoint.com, which is set up before April 2019 was created as a classic team site. Now, a communication site is set up as the root site for new organizations. If your Office 365 Tenant was created before April 2019, you can modernize your root site with one of these scenarios:

• Replace the root site with a new site: If you already have a site that you want to use as your root site, or if you want to use a modern team site, replace (swap) the root site with it. This scenario is very useful if you plan to create a new site and let the old one live until you are ready. We can use the new SharePoint admin center to replace the root site. Select your root site (f.e. https://contoso.sharepoint.com) in the Active Sites menu in SharePoint Online Admin Center. Doing this you get the “Replace site” button in the menu:

Selecting this you get the following dialog:

And we can also use PowerShell to do the swap. Powershell offers the capability to manually set the url for the archive url and some further parameter:

Invoke-SPOSiteSwap

         -SourceUrl <string>

         -TargetUrl <string>

         -ArchiveUrl <string>

         [-DisableRedirection]  

      [<CommonParameters>]

 Details & Examples: https://docs.microsoft.com/en-us/powershell/module/sharepoint-online/invoke-spositeswap

• Use the root site as it is but with a modern experience: If you want the content on your classic root site as it is but want to have the layout of a communication site, apply the communication site experience to the root site. This feature isn't available yet but is coming soon.
• Continue using the classic team site but with modern pages library and a modern home page: If you want to continue using the classic team site, enable the modern site pages library experience and set a modern page as the home page of the root site. This gives users a modern team site experience with the left navigation.

Things to think about

Before you begin, make sure that…:

• If you have "Featured links" on the SharePoint start page. You'll need to add them again after you replace the root site.
• Review your source site about policies, permissions, and external sharing settings

Limitations:

You can use the following as a new root site:

• Communication site (SITEPAGEPUBLISHING#0)
• Modern team site that isn't connected to an Office 365 group (STS#3) | The root site can't be connected to an Office 365 group.
• Classic team site (STS#0).

When plan to do a site swap the root site and the new site can't be hub sites or associated with a hub. You need to unregister it as a hub site, replace the root site, and then register it as a hub site again.

Coaching your users through the External Sharing Experience

If your organization is sharing documents or collaborating directly with vendors, clients, or customers, then you can use the external sharing features and guest access in Office 365 to support this. Or, if this is not the case, you may want to limit the use of external collaboration in your organization.

Note that external sharing is turned on by default for your entire Office 365 environment. Every user can invite external people to Groups, Teams and SharePoint sites and can share content using OneDrive for Business. You may want to turn it off globally until you know exactly how you want to use the feature.

Poorly there is no mater switch to turn external sharing and inviting external user ON or OFF globally. We need to configure it per service and there are also cross sites effects between the services.

Settings overview

External sharing overview

Content Level

When sharing a SharePoint site with an authenticated external user, an invitation is sent to them via email which contains a link to the site. During the login process they are asked to log in using the username and password of their Microsoft account or their work or school account. If the login is successful, the account is added to the Azure AD associated to the Office 365 subscription. The account is added with #EXT# in the user name.

An external user did not need to have a license. To discontinue sharing with an authenticated external user, remove the permissions from the site or delete the user in the Azure AD.

If you share a file or folder with an external user, this user gets an email with a link to the file or folder. The user gets a time-sensitive code via email that he can use to verify his identity. Once he proved his identity by using the code the user is added as a external user in the Azure AD and he can access the file using his account. Sharing a file or folder with a user that did not have a Microsoft account or work or school account this user needs to use the code every time to access the shared content.

To discontinue sharing with an authenticated external user you can delete the sharing link that was sent to him.

To share with anonymous users, you can set several options:

• Edit, view or upload to a folder
• Set link to expire at a specified time
• Block download

The (external) user will receive a E-Mail with the link to the file or folder.

Anonymous users are not added to the Azure AD. To discontinue sharing you need to delete the anonymous link.

Collaboration Level

Guest access on the collaboration level is included with all Office 365 Business Premium, Office 365 Enterprise, and Office 365 Education subscriptions. No additional licensing for the guest users is requirement. You can have up to 5 guests per licensed user on your tenant. For more information about licensing, see Azure Active Directory B2B collaboration licensing guidance.

Office 365 Groups

To collaborate with external users in your Office 365 Group this feature must be activated as showed in the table above. By default, guest access is turned on in Office 365. That means, that everyone in your organization can add external users to an Office 365 Group. When an external user is invited to join a group, he receives an invitation email. The external user will have access to the following Office 365 Group features:

• Conversations: Externals did not get access to the conversation history, but they will become part of the Office 365 Group distribution list.
• Notebook: Externals get access to OneNote
• Calendar: No access, but they receive calendar invitations
• SharePoint Team Site: Externals get access to the SharePoint Team Site
• Planner: To access a plan, guests either need to use a specific plan URL or go to https://tasks.office.com/%organizationdomainname%

Microsoft Teams

Because of Microsoft Teams is using services like SharePoint Online etc. the external access configuration belongs on the settings in you tenant.

Each level controls the guest access as shown:

• Azure Active Directory: External access in Microsoft Teams relies on Azure AD.
• Microsoft Teams: Controls external access in Microsoft Teams.
• Office 365 Groups: Controls external access in Office 365 Groups and Microsoft Teams.
• SharePoint Online and OneDrive for Business: Controls external access in SharePoint Online and OneDrive for Business.

Advanced

Office 365 inter-tenant collaboration

We have several options to collaborate between two Office 365 tenants. Based on Azure Active Directory B2B we can set up collaboration for nearly all Office 365 services. Details are described in this Microsoft article: Office 365 inter-tenant collaboration

Tenant restrictions

Tenant restrictions enables you to control access to other Office 365 tenants. Tenant restrictions gives organizations the ability to specify the list of tenants that their users are permitted to access. Details, pre-requirements and limitations are described in this Microsoft article: Use Tenant Restrictions to manage access to SaaS cloud applications

Office 365 user vs. Windows Live ID

Anyone with a Microsoft work or school account or a consumer email account, such as Outlook, Gmail, or others, can participate as a guest in Office 365.

If a user has an Office 365 hosted E-Mail address, he will automatically have a work or school account created by his IT department. This account original exists in an Azure AD.

If a user does not have a work or school account, he can use a LiveID. To get one the user needs to go to the Microsoft account sign-in page: https://account.microsoft.com/. In the upper right corner select “Login” and then select “No account”. He needs to fill out the form and create a password. Details see below in “Coaching your (guest) users through the External Sharing Experience” The LiveID is original hosted by Microsoft.

Coaching your (guest) users through the External Sharing Experience

Content Level

IF you are inviting an external user to a SharePoint site or added him to a SharePoint group, he will receive an invitation E-Mail:

The link in the email will point the user to a website asking him what type of account he has:

If the user enters his email but did not have a Microsoft account, he will see the following dialog:

Click “Create One!” to register a new Microsoft account:

Set a password:

Provide your details:

Microsoft will send a code to verify the email address:

If a file or folder in SharePoint or OneDrive for Business is shared to an external user and the user did not already exists in the Azure AD, he will also need to verify his E-Mail address:

Sharing a file or folder with a user that did not have a Microsoft work or school account this user needs to use the code every time to access the shared content.

Collaboration Level

When an external user is invited to a group, he receives an E-Mail:

External member's can join conversations through their inbox and receive calendar invitations.

When an external user is invited to a group, he also receives an E-Mail with the details:

SharePoint Conference 2019 – Las Vegas

SharePoint Conference 2019 – Las Vegas

I am proud and honored to be selected as a speaker at SPC2019 in Las Vegas!

If you are working with SharePoint Online & Office 365 or Microsoft SharePoint Server, you need to attend this event!

SharePoint Server 2019 has been announced – you are interested in the latested news about SharePoint 2019? That see you in May in fabulous Las Vegas. We from atwork will be part of the conference and we are looking forward to it.

As shown on the conference website, SharePoint Conference is organized by the SharePoint Conference team and co-produced by Microsoft. They put together an amazing line up of international speakers and Microsoft employees to show you the latest technologie updates and news around Microsoft 365 and SharePoint.

The session I present is about a real-world scenario: From fragmented services to a modern intranet.

It is about the project I did together with atwork GmbH. The crew from atwork will also be part of the conference and presenting session:

• How Yammer security and management works behind the scenes in a GDPR world - Martina Grom
• Office 365 Groups and Microsoft Teams PowerShell MasterClass - Martina Grom, Toni Pohl
• Why Yammer is still the universe to me - Martina Grom
• Send data to Outlook, Teams and Bots with Adaptive Cards - Toni Pohl

In the session Real world: From fragmented services to a modern intranet we will talk about a large enterprise customer in steel industry and its journey to SharePoint. Klöckner & Co started from a mixed environment using classic file shares, DropBox, Slack and even an OpenText-based Intranet solution. Learn how this customer moved from independent disconnected services to an integrated, company-wide service landscape based on SharePoint, Yammer & Office 365.

In detail the session agenda and topics are:

• Project overview: where we came from
• Starting with Yammer
• Design patterns in the project like using standard where it is possible
• Live Demos
• Implementation: technical goals, technical parameters, organization of the project using Microsoft Team & Planer
• Migration
• Structure of the new Intranet called DigiDesk
• Prototyping
• Taxonomy and search customization
• Rollout planning
• User adoption & Training
• Mobile use of DigiDesk
• Microsoft Stream integration
• Custom Apps in the App Launcher
• Integration of additional services
• Why the Marketing department of Klöckner directly switched from Slack to Microsoft Teams
• Custom Development

See you in our session at SharePoint Conference MAY 21 - 23, 2019 ,MGM Grand, Las Vegas.

Save $50 and register via: https://www.sharepointna.com/#!/register?utm_term=BORELL

My tips and recommendations for the conferment

Sessions at SharePoint Conference 2019

Watch as much session as you can. But definitely watch the keynotes. Other hot topics, workshops, speaker and sessions are:

• Microsoft Search in your Organization and Everything you wanted to know about Microsoft Search by Agnes Molnar
• Workshops: Becoming a Master Power User in Office 365 by Benjamin Niaulin
• Mixed reality in Office 365 with SharePoint spaces by Bill Baer
• Become a Microsoft Teams Rockstar by Gokan Ozcifci
• Office 365 Application Security by Liam Cleary
• What Options do you have to govern the lifecycle of Office 365 Groups and Teams? by Mikael Svenson

My hot topics are:

• New Microsoft Search
• New features in OneDrive for Business, SharePoint and SharePoint Hub Sites
• Updates and News about Communication Sites
• Compliance & Security

To get the most out of attending SharePoint Conference 2019:

• Set your expectations and plan what session do you attend and which you download afterword
• Stay connected on Social Media with the conference and the speaker using @SPConf and #SPC18
• Participate in SharePoint Conference 2019 social events, parties and Meetups
• Have Fun!

Azure Information Protection Part V – advanced features & scenarios

Label an Office document by using an existing custom property

This option allows us to reflect on existing metadata values for example coming from SharePoint or other solutions like for example Secure Islands (which was acquire by Microsoft in 2015).

As a result of this, when a document without an Azure Information Protection label is opened and saved by a user, the document is then labeled to match the corresponding property value.

This configuration requires two settings in the advanced client settings section. The first is named SyncPropertyName, which is the custom property name that has been set from the other classification solution, or a property that is set by SharePoint. The second is SyncPropertyState and must be set to OneWay:

• Key 1: SyncPropertyName
• Key 1 Value: <property name>
• Key 2: SyncPropertyState
• Key 2 Value: OneWay

Keys and corresponding values are good for one custom property.

Example:

We have a SharePoint column named Classification. Possible values are: Public, Internal and Confidential. SyncPropertyName value is then: Classification.

To make this feature work we need labels with the same name (Public, Internal and Confidential) in AIP. Now, when an Office documents from this SharePoint library is opened and saved and this document is labeled as Public, Internal or Confidential in SharePoint Azure Information Protection applies the corresponding AIP label. If no label with a corresponding name exists in AIP, the document remains unlabeled.

More details about how to label an Office document by using an existing custom property: https://docs.microsoft.com/en-us/azure/information-protection/rms-client/client-admin-guide-customizations#label-an-office-document-by-using-an-existing-custom-property

Convert Templates to Labels

When you create a label in AIP under the hood also a new custom template is created. This new template can then be accessed by services and applications also using Rights Management templates. The new template is not shown in Azure AIP portal but can be managed by using PowerShell.

If you delete the label the template will still exists and is then shown in Azure AIP portal. In Azure AIP portal you can convert a template to a label:

If you change the protection settings in this newly created label, you're changing them in the template and any user or service that uses this template will get the new protection settings with the next template refresh.

More details about labels and templates in AIP can be found in this article: https://docs.microsoft.com/en-us/azure/information-protection/configure-policy-templates#to-configure-the-templates-in-the-azure-information-protection-policy

Cloud App Security to auto apply Labels for scenario / location

Microsoft Cloud App Security lets you apply AIP labels as part of a CAS policies. You can also investigate files by filtering for the applied classification label within Cloud App Security.

Scenarios:

• Apply classification labels as a governance action to files that match specific policies
• View all classified files in a central location
• Perform investigation according to classification level
• Create policies to make sure classified files are being handled properly

More details:

• Integrate AIP in CAS: https://docs.microsoft.com/en-us/cloud-app-security/azip-integration
• Automatically apply AIP labels using CAS: https://docs.microsoft.com/en-us/cloud-app-security/use-case-information-protection

Encrypting Emails using Exchange Mail Flow Rule

Exchange Mail Flow Rule can be used to automatically apply AIP labels:

This is based on the RMS template associated to the AIP label.

A step-by-step documentation on how to configure a mail flow rule using a RMS template can be found here: https://blogs.technet.microsoft.com/kemckinn/2018/07/09/encrypting-emails-from-anywhere/

Decommissioning and deactivating protection

If AIP is no longer needed you can deactivate it. Make sure that you have a copy of your Azure Information Protection tenant key before you deactivate the Azure Rights Management service. If you deactivate AIP make sure, that you won’t be locked out of content that was previously protected.

You have the following options to deactivate AIP:

• PowerShell cmdlet Disable-Aadrm to deactivate Rights Management
• Deactivate Rights Management from Office 365:
• Go to the Rights Management page for Office 365 administrators
• On the Rights Management page click deactivate
• Deactivate Rights Management from the Azure portal
• On Azure Information Protection blade => Protection activation blade, select Deactivate

Further details about deactivating AIP: https://docs.microsoft.com/en-us/azure/information-protection/deploy-use/decommission-deactivate

Related posts:

• AzureInformation Protection Part I – Overview
• AzureInformation Protection Part II – PowerShell
• AzureInformation Protection Part III – AIP Scanner
• AzureInformation Protection Part IV – Work with AIP

Summary about Modern Team Sites, Communication Sites & Hub Sites

Modern Team Sites, Communication Sites & Hub Sites

Modern Team Sites, Communication Sites & Hub Sites are available in SharePoint Online and SharePoint 2019. A modern Site is created from the SharePoint Home App:

Common Stuff

In modern Sites we have a bunch of new Webparts:

Complete list and details: https://support.office.com/en-us/article/using-web-parts-on-sharepoint-online-pages-336e8e92-3e2d-4298-ae01-d404bbe751e0

One of the initial questions is about using a modern Team Site or a Communication Site. At the end it all about the focus of the site and the question about the usecase for this site. Susan Hanley provides a brilliant overview and matrix to find out what is best for your scenario:

Provided by Susan Hanley: Source and further details: https://storage.snappages.site/op8ir2nu2f/assets/files/Team-Site-vs.-Communication-Site-What-sh-69.pdf

In addition, Mark Kashman also provides a good overview picture about modern Team Site and Communication Site:

Modern Team Site

About Modern Team Site:

• Focus: Connect, Collaborate, Create
• Connected to O365 Groups: Creates group email address
• Privacy settings: Private by default and can be changed to public

• Name and email address a validated at this time
• Naming Policies and lifecycle policies are applied at this time
• Further details about lifecycle policies: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-lifecycle
• Further details about naming policies: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-naming-policy
• Privacy settings are applied here.
• Site classification is no out-of-the-box feature but can be configured based on Azure AD Premium. Further details about Site Classification for SharePoint Sites: http://www.sharepointtalk.net/2017/09/using-site-classification-for.html

In modern Sites we have a so called “New” Dropdown to easy create new objects:

It is also very easy to modify the Quick Launch Navigation based on the modern canvas:

A new feature for modern Team Sites is the Site Info Hover Panel. You can access this panel by mouseover the Site name:

The panel gives you an overview about the site and direct links to the associated resources like the Planer, the Group Calendar etc.

Further details about modern Team Sites can be found here: https://support.office.com/en-us/article/what-is-a-sharepoint-team-site-75545757-36c3-46a7-beed-0aaa74f0401e

Communication Site

About Communication Sites:

• Fokus: Showcase, Share Services, Story (broadcast information)
• 3 different type of a Communication Site are available out-of-the-box:
• Topic: Designed to present large amount of information such as news, events and other content
• Showcase: Designed to showcase a product, team, or event using images
• Blank: Start from scratch

Further details about Communication Sites can be found here: https://support.office.com/en-us/article/what-is-a-sharepoint-communication-site-94a33429-e580-45c3-a090-5512a8070732

Modern Sites Pros and Cons

Pro:

• Easy to use
• Modern canvas
• Modern branding & responsive design
• Modern Web Parts
• Easy to use/configure web parts
• Connected to a Group
• Extend using the SharePoint Framework

Contra:

• Only created as a site collection and no modern sub-sites available
• No variations until now
• No extensibility for modern search until now
• Not all Lists, Libraries and website types have a modern design already (Blogs, Tasks, Calendars, Discussions)

Complete list and further details: http://www.sharepointtalk.net/2018/08/things-to-think-about-when-moving-from.html

Things to think about when moving from classic to modern SharePoint Site

Moving from classic SharePoint Online Sites or from SharePoint on-prem Sites to modern Sites sound easy but can get tricky. There are several pros and cons coming from classic Sites and now plan to use modern Sites. The following to table shows the pros and cons and the topics you have to think about when planning a migration:

Complete list and further details: http://www.sharepointtalk.net/2018/08/things-to-think-about-when-moving-from.html

Hub Sites

Common info about Hib Sites:

• Linked sites
• Consistent branding across all sites
• Top navigation
• Search within the hub site will also search all linked sites.
• Aggregate news from linked sites. This can take 5–15 minutes.
• Flexible attach & detach a site from a hub
• Sites can only be associated with one hub site.
• Hubs can’t be nested
• Limited to 50 hub sites
• Association with a hub does not change the permissions on a site
• A site can only be associate with one hub

Webparts for Hub Sites:

• News roll-up: News published on a hub site and on any associated sites is automatically aggregated and shown on the home page of the hub site.
• Associated sites: Display the most active sites associated with the hub site.
• Highlighted content: Use the Highlighted content web part to dynamically display content from sites associated with the hub.

Further details about Hub Sites:  https://docs.microsoft.com/en-us/sharepoint/planning-hub-sites

Admin Stuff

Manage site creation in SharePoint Online Admin:

Subsite Creation in SharePoint Online Admin:

Office 365 Groups Connection Setting in SharePoint Online Admin:

To allow only specific users to create groups, use the PowerShell cmdlet GroupCreationAllowedGroupId or change setting in Azure AD

Connect to a new office 365 group:

Ability to connect existing SharePoint team sites to Office 365 Groups is coming later this year

Branding SharePoint Modern Sites

Out of the box themes, configuration option and custom site themes:

• The following predefined themes are available by default: Blue, Orange, Red, Purple, Green, Gray, Dark Yellow, Dark Blue
• Each theme can be customized by selecting “Customize theme”
• Custom themes can be created and uploaded. To create a custom theme a online theme generator tool is available: https://developer.microsoft.com/en-us/fabric#/styles/themegenerator
• Classic themes can still be used by choosing the link under the modern themes listed.
• Because the modern SharePoint UI differs from the classic UI, however, some limitations apply when you use classic themes with modern pages.

Themes are defined in a JSON schema that stores color settings and related metadata for each theme. These capabilities are available to administrators via PowerShell cmdlets, and to developers via the SharePoint client-side object model (CSOM) or the SharePoint REST API.

Further details about branding: https://docs.microsoft.com/en-us/sharepoint/dev/solution-guidance/portal-branding

PNP Starter Kit & Fantastic 40 Web Parts

What is the SharePoint Starter Kit:

• SharePoint Starter Kit demonstrates how you can extend modern sites.
• Currently included in the package:
• Tenant level provisioning logic using PnP Provisioning Engine
• 3 site collections. One assigned to be a hub site and two associate to the hub site automatically from the provisioning script
• Contoso Site Designs for group associated team site and communication site
• 17 client-side web parts demonstrating different capabilities
• 7 SharePoint Framework extensions
• Sample LOB service to be hosted in Azure
• Sample content on the portal to demonstrate news and article capabilities

Source and further details: https://github.com/SharePoint/sp-starter-kit

What is the Fantastic 40 Web Parts:

It is a sample kit of 40 web parts for example visual web parts as carousel, images galleries, custom editors, polls, charts, map, animations, etc. These web parts are free and open source. The webparts are available: English, French, Spanish, German. IMPORTANT NOTE: These web parts are not officially supported by Microsoft.

Source and further details: https://github.com/OlivierCC/spfx-40-fantastics

Things to think about when moving from classic to modern SharePoint Site

Moving from classic SharePoint Online Sites or from SharePoint on-prem Sites to modern Sites sound easy but can get tricky. There are several pros and cons coming from classic Sites and now plan to use modern Sites. Also, some features that we know from classic sites are no longer available in modern Sites. In addition, some features we have in SharePoint on-prem are deprecated in SharePoint online. This is also a topic to think about when planning a migration.

The following to tables showing the pros and cons and the topics you have to think about when planning a migration:

Pros and Cons about modern Sites focusing a migration scenario

Mapping of deprecated / new features und functions

Azure Information Protection Part IV - Work with AIP

Azure Information Protection is a cloud-based solution that can be used to classify, label and protect data and e-mails. The nice thing about it is that depending on the implementation, this works without the user's intervention. Rules are automatically applied based on metadata, storage location, template on which a document was created or on the content of the document.

Of course, users can also assign classification manually. A combination of both, whereby proposals are displayed to the user based on administrative specifications, can also be implemented.

AIP integrates into the Office Client applications Word, Excel and PowerPoint from version 2010 in the Enterprise or Office ProPlus version. With this integration, files can be classified and protected directly from Office applications. Word, Excel and PowerPoint also display the classification of a file directly:

Source: https://docs.microsoft.com/en-us/azure/information-protection/understand-explore/what-is-information-protection#integration-with-end-user-workflows-for-documents-and-emails

The AIP Client is used to protect and classify non-Office files. This free software is used to classify and protect e.g. PDF documents and other files. The AIP Viewer is also used to open protected non-Office files. This tool is available free of charge for the iOS, Android, macOS and Windows platforms. Details on supported platforms and Office versions can be found here: https://docs.microsoft.com/en-us/azure/information-protection/get-started/requirements-applications  

Overview of the features of AIP

The AIP feature essentially works with 2 objects:

Labels:

• A label is used for classification; e.g. CONFIDENTIAL
• A label can contain encryption, but can also be used for classification purposes only
• The following rights can be assigned during encryption: View, Open, Read (VIEW) | View Rights (VIEWRIGHTSDATA) | Edit Content, Edit (DOCEDIT) | Save (EDIT) | Print (PRINT) | Copy (EXTRACT) | Reply (REPLY) | Reply All (REPLY ALL) | Forward (FORWARD) | Change Rights (EDITRIGHTSDATA) | Save As, Export (EXPORT) | Allow Macros (OBJMODEL) | Full Control (OWNER)

Policies:

• Policies determine which users/groups have which labels available
• Policies also regulate administrative options such as whether a standard label is assigned

Due to the integration into the Outlook client, labels can also be assigned directly when writing an email. The classification then affects documents that are sent as attachments to the mail and the e-mail itself.

In addition to labels and policies there is another useful function. The "Protect with user-defined permissions" function is used to encrypt files individually and make them available with explicit rights for certain users (including external users). This feature can be used in both the AIP Client and Office integration. The following individual options can be configured per file:

• Displaying user: Display only
• Check: Display, Edit
• Co-author: view, edit, copy, print
• Co-owner: All rights
• Only for me
• User / Group: Users or groups by e-mail address, who should have access with the selected right
• Expiration of the access: Date how long the access for the selected users / groups with the configured right should exist

Details on the individual functions of AIP can be found here: https://azure.microsoft.com/en-us/services/information-protection/

Typical scenarios

Scenario 1: A user creates a document. The user knows which category the document must be assigned to and is responsible for assigning the corresponding label.

Scenario 2: In addition to scenario 1, automatic classification can be used. To do this, we need to define or create own information types. Microsoft provides standard information types such as credit card number, driver's license number, etc. A complete list of standard information types can be found here: https://support.office.com/en-us/article/what-the-sensitive-information-types-look-for-fd505979-76be-4d9f-b459-abef3fc9e86b?ui=en-US&rs=en-US&ad=US

Scenario 3: Classification Based on location. The AIP scanner, which is part of the AIP client, is used to do this. The scanner can encrypt NTFS shares and SharePoint libraries. Example: all files that are stored in a specific folder or in a specific SharePoint library always get the label "Confidential - Contract". The AIP scanner runs as a service on a Windows server. Using PowerShell and a parameterized call, the scanner then checks and encrypts contents in the defined storage locations with the specified label.

Licensing

Microsoft Azure Information Protection is available as a standalone solution or as part of the Enterprise Mobility + Security Suite, Microsoft 365 Enterprise and Office 365 E5.

AIP is available in three different versions: AIP for Office 365, AIP P1 and AIP P2 Details on the different versions can be found here: https://azure.microsoft.com/en-us/pricing/details/information-protection/

Only the user who protects content needs a license. External users or users who only consume do not need to be licensed.

AIP, RMS and IRM

Definition and dependencies:

• RMS: The Azure Right Management Service is the basic instance for encryption and rules. Word, Excel, PowerPoint, Outlook and the Office Server SharePoint and Exchange provide native support for Azure Rights Management and provides document and email protection.
• AIP: Azure Information Protection is based on RMS and requires the RMS service in the background. With AIP, files can be individually encrypted and classified. File tracking and detailed reporting show who opened an AIP-protected file, when and from where.
• IRM: Information Rights Management is required to connect RMS to Exchange or SharePoint. If we need to connect the on-prem versions of Exchange or SharePoint or an NTFS file server, an RMS Connector is required. IRM integrates seamlessly into Exchange and SharePoint.

IRM with Exchange and SharePoint:

• To protect an e-mail with the "Do not forward" restriction, the Information Rights Management options for Exchange is required. With IRM in Exchange features like DLP can also be used.
• IRM integration can be used to encrypt files stored in SharePoint. This integration does not offer the flexibility and functionality of AIP. Documents in SharePoint are not encrypted until they are downloaded for example. IRM does not provide an option to classify files and permissions must be assigned by an administrator at the site or library level.

Depending on the detailed scenario, either AIP or IRM can be used. Both functions require the RMS service in the background.

Details about RMS, IRM and the limitations with SharePoint are described in this article: https://docs.microsoft.com/en-us/azure/information-protection/understand-explore/office-apps-services-support

Related posts:

• AzureInformation Protection Part I – Overview
• Azure InformationProtection Part II – PowerShell
• AzureInformation Protection Part III – AIP Scanner
• AzureInformation Protection Part V – Advanced features