Azure Information Protection, AIP.
You know when there's an acronym involved,
it sounds complicated,
but not if you spend time with me talking about
‘What it is?’, ‘Why you want to use it?’,
and most importantly, ‘How we set it up?’
All that and more, coming up now.
Hello, my name is Adam Gordon, an edutainer here at ITProTV,
back with another exciting ‘What Is Azure?’ discussion
in our ongoing conversation about Azure Services
that you are going to find of interest
and want to know more about.
In this episode,
we're going to focus on Azure Information Protection.
It's commonly referred to as AIP.
We're going to answer our famous three questions:
‘What is Azure AIP?’, ‘Why would you want to use it?’
and of course, equally importantly,
also really compellingly cool to get to see me
do the actual configuration and implementation,
‘How do you set this thing up and make it work?’
When we think about Azure Information Protection,
we want to start by talking about what it is.
It's actually a combination of services and offerings
that have been around for some time.
Microsoft has been offering
what's known as Rights Management Services,
going all the way back
to the some of the earliest versions of Microsoft Windows,
certainly starting around Windows 2000.
So we've seen technology that forms the basis
for what we now think of as Azure AIP,
for the better part of the last 20 years.
But traditionally,
that technology has really only been available on premises
in our data centers, using Windows
and Microsoft centric technology that really was not scalable,
and certainly was not related to or connected to the cloud.
Along comes Azure, along comes Office 365,
which we now refer to as Microsoft 365.
And as we see the growth of cloud services,
and the supporting elements like Azure Active Directory,
that enable use of those cloud services at scale,
we begin to see the merging,
and the collection of these different kinds of rights management,
classification labeling, and security services
that come from those on premises environments,
really moving them into the Microsoft 365 Cloud and that space,
using directory synchronization,
to be able to bring those users
and that information into the Azure world,
enabling the use across multiple different web platforms,
using Windows, using android, using the Apple platform,
to be able to bring the mobile devices in
and allow access to all sorts of services and data.
And we see all of this coming together around
Azure Information Protection.
And so when we think of what AIP is,
we think of a service that brings the best of breed,
rights management, classification labeling,
and the ability to secure our data in any of these areas
in any of these platforms, and bring it all together for us
in one centrally managed, easily accessible location.
Again, we have the ability to work
with Microsoft/ Office 365, however, you view that.
We have the ability to bring in mobile platforms
across different vendors,
Apple, Android, as well as Windows devices.
We have the ability to leverage our
on-premises directory services, Active Directory,
linking that to the cloud,
bring in our data from our file services,
but also where data traditionally lives in SharePoint
as well as in Exchange.
And we see all of those capabilities linked together.
So this is a fully featured rights management solution.
When we think of why we want to be able to use
Azure Information Protection Services,
the why, is actually very straightforward.
It's the compelling proposition
that we can take our file services
and we can say we want to protect all the data that's there.
We want to take our online, both on-premises
and cloud-based versions of SharePoint,
our massive enterprise content management capabilities,
Exchange, our email capabilities,
we want to add protection for all of those.
We want to be able to take our Office/ Microsoft 365 data,
some of that data sitting in SharePoint and Exchange,
but also some of it sitting in file services, all on OneDrive,
maybe even SQL databases that are backing that.
We want to be able to connect that.
And we want to be able to take our mobile platforms
and protect information from them,
and use our directory synchronization services
to be able to authenticate and authorize use,
but apply our protections to our data when it's in transit,
it's being sent back and forth
between any and all of these platforms,
it's at rest, it is sitting in storage in our file services,
in our OneDrive capabilities in the data centers
in Azure and Microsoft 365,
and of course in use in our applications, wherever they are.
As we consume them,
we are applying security across that data lifecycle.
And so we're allowing our data to exist and be useful,
allow for collaboration, allow for sharing,
but do so in a secure way,
using the technology that's built right in
to every one of these areas to allow us to attach the data
wherever it lives under any circumstance.
So it's a very, very compelling value proposition
when we think about the why,
because it gives us the best of breed,
as I suggested to you in terms of protection,
but it gives us ease of use as well.
Setting up the solution, configuring it,
initially is a little bit daunting, there's a few steps involved,
but believe it or not, it's really not that challenging.
And we have the capability
to allow the application of our sensitivity and classification labels
to either be done automatically,
Microsoft Azure and Microsoft 365 can apply that for us
and automatically protect our data,
or can actually decide that users will have the rights
in any of these mobile platforms, using any of these services,
probably most likely, especially email,
where they're going to be sending/receiving news in the Outlook client.
They can decide to pull down an option
and simply apply a label that shows up
in a pop-up menu right there for them on the spot
as they create an email or send and receive information.
So we get maximum flexibility, along with maximum security.
I'm going to show you how all this comes together
as we move into our demo
and we discuss not only the ways you can implement,
but I'm going to show you some really neat tricks
about things that you may not be aware of
that make it simpler for your users to classify
and protect data using AIP.
All right, everybody.
So it's time for the ‘How?’.
How do we put AIP together?
We're in the Azure portal and we're going to take a look at
where we find the Azure Information Protection element.
We're going to start by searching under all services.
And I've already got this configured.
I'll explain why that's important in just a minute,
but let's zoom in
and just take a look at where we're going to begin.
We're using All services area.
You'll notice off to the right,
I've already started to search for Azure Information.
Sure enough, it pops up right there at the top of the list.
Now we're going to go ahead and we're going to click on that.
We're going to go in and see in just a second.
It takes a moment to load that.
The Azure Information Protection area comes up and is set up,
or at least once it loads fully, is set up and ready to go.
I've got some labels that are already configured here for use.
You'll see right below under Classifications and Labels.
I've got a bunch that I've created.
I've got some Analytics that I can look at.
I've got a Quick Start area.
All of this is part of the architecture along
with Policies down below.
But this is already set up and configured.
And the reason for that is it takes a little bit of time
to install and initially set up AIP.
And so when you want to deploy it, first time,
you want to set it up and use it,
you're going to go up here to Create a Resource right at the top.
We're going to search in the marketplace,
which is where all the Azure resources are that we can deploy.
And we'll search for Azure information.
And you'll see as we start to type again, it pops in right there.
And when we click on it, you'll see we do have an element
that we can go ahead and click to create.
And when we do that, it's going to give me an error,
because it's going to tell me, “Hey, it's already set up.”
And that's fine. No big deal.
If I were to click Create, it would tell me that.
But basically, what you're going to do
is you're going to see this little information element here,
there's really nothing you do
other than click Create at the bottom.
Once you do that, Azure itself,
you'll see the create button right down there,
kicks off the process, sets it up takes us to that dashboard
we were just looking at
and makes the system available for us after a few minutes.
And once that is done,
then what we're able to do just as we navigate back,
is spend some time in here
looking at really the two most important elements.
The labels that I already briefly pointed out,
we're going to see those inside of Outlook in a moment.
We'll take a look at how we apply them in email.
And our Policies right there.
And we have the ability with policies
to be able to go ahead and to be able to just get over there,
get over there, and there we go, and click on Policies.
We have the ability to be able to set up a policy
that governs our use of the labels to protect our data,
as we were suggesting about as we were sketching out
and drawing the information to answer our questions,
what is AIP and why do we want to use it,
when we were examining this over at the lightboard.
And so we create policies that are applying
our information management thought processes
around rights management to our data,
and we provide labels that can either be applied
as part of that policy, or manually users can intervene
and decide to apply on their own.
And when I go ahead and I add a new policy right down here,
you'll see that I have the ability to give the policy a name.
I select which users or groups will be set up to use this policy
or have it applied to them.
And it says, “Hey, select the users or groups
that will be using this that are email-enabled,"
meaning they have the ability to send and receive email.
And as I come down, I then have the ability to specify
just some of the settings that are associated
with how I want this to be covered.
Do I make having all documents using labels
as well as emails part of this applied automatically
or by the user?
Turn that on.
That's that element we talked about.
Do I require users to provide what's known as a justification?
A user has to specify in writing
that they're going to want to be able to set a label
on a document or classify a document a certain way.
If it violates the policy, we may give them the ability
to override the policy,
but they have to write out a justification.
We then have a record of that,
so we understand why they did that.
Maybe a manager overrides that setting in the policy
with a justification to say,
“It's okay for me to send this document this way
and I'm approving it.”
Now we have a record of that and we can track that.
So we want to be able to see these settings and understand them.
A lot of stuff that we have to be aware of here,
we go into how to do all this in great detail
through the ITProTV courses,
where I spend time showing you how to use AIP,
both with Azure, as well as the Microsoft 365 elements
that I discussed at the lightboard.
You can always join me over at ITProTV
to see those courses and see a full discussion of this
if you want to really get into the details
and understand how to implement fully.
So we set our policies up.
We then go ahead and we create our labels
and remember our labels right here,
we'll just let that list come back up for us,
are simply going to be the elements
that we assign to a piece of data.
Something like Adam Label is FOREVER,
or ITP Label 1 or whatever they may be.
Those are just names.
But we would use more meaningful names
like confidential, private communication,
traditional classification elements we would see
in an information protection program.
And we can create our own labels
right at the bottom there as well.
Now when we do that, we go into Office 365. Login.
Go to Outlook, let's say.
I'm using this through the web, using Outlook Web Access,
but you can do this with your desktop Outlook mail client as well.
When you go and click on New Message
to essentially send a brand new message,
I get a blank message form
the way I have right over here to the right,
and I begin to address it and set it up.
But then what I can do is come right up here to Sensitivity
and you'll see I can pull down.
You'll see I've got my labels,
the same ones that I was just looking at over
in the Azure portal,
allowing me to label this email
and identify it through a classification element
with regards to its sensitivity.
Maybe Adam label, whatever that is.
And then you'll see I've got a specify justification.
Our organization, according to our policy
has this element that says, “Hey, I'm changing this label.”
I need to justify my action, I have to make a choice here,
like I was suggesting to you,
and previous label was incorrect or whatever that is no big deal.
Choose the appropriate one.
There's my sensitivity label.
And now when I send this,
everybody who gets this message is going to see that
and is hopefully going to act and understand accordingly
based on that sensitivity label.
This is the value, the power of AIP in Email received
by anybody on any device.
Remember, we have that mobile platform covered
for Android, for iOS, and for Windows devices.
I'm sending email, I'm also potentially sending data
and consuming it via SharePoint or file services.
I protect the data there as well.
When we look at the Microsoft 365 site quickly
just the other side of this service.
In the Data Classification dashboard,
which is part of our Microsoft 365 Compliance area.
We also see the capabilities to use
sensitivity information labeling, and to work with these.
We can see that we've got an overview
to show us the kinds of things that we may want to look for,
social security numbers, account numbers, all sorts of stuff.
I can go in and look at Sensitive Information Types
and define them.
I could explore and find those types.
And I can look at recent activity,
bringing together both sides of our communication
and information sharing platforms,
Azure and Microsoft 365 giving us total protection
using Azure Information Protection Services.
I'll be back with continuing conversations about
more features, more capabilities,
and most importantly, more really cool things you can do
on the Azure platform as we continue bringing you new episodes
in our ‘What Is Azure?’ serial.
But until I'm back with another new episode,
I'm going to wish you Happy Azuring and I'll see you soon.