Azure Information Protection- part 4: the AIP Viewer-client

In part 3, I discussed the end user side of Azure Information Protection: How can users classify and label document by using the Microsoft Office apps. To get the ribbon inside the office apps, as mentioned before, you need to install the AIP client on your Windows device. Besides the ribbon, the client also is a full client app to label content and share it with externals. It also is a viewer for other (than Office) supported formats, like a protected .pdf file (which will be a .ppdf file). You can check here which file formats are supported with the AIP client-viewer, for protection and classification.

So, what is the flow of sharing a classified and protected document with an external (or internals who weren’t part of the users in the RMS template)? Remember, a classified and protected (with RMS) document can only be shared with internal users, within your organisation, out of the box- set in the RMS template. Sometimes you want to share a document with someone outside your org. The AIP Viewer/client has shell integration, so the only thing you need to do is to right-click on your document and clic
k on “Classify and protect”.


The AIP Viewer/client will open you you will see the same labels as in the ribbons of your Office apps. Here you can change the classification of a document (when setting a lower classification, optionally with a justification) and you can check “Protect with custom permissions” . Then it will be possible to select permissions: like Viewer- View Only, Reviewer- View/Edit, Co-Author and Co-Owner. You set these permissions for groups of user, which you can add manually. Optionally, you can set an expiration date. After applying the settings, you can send the document to new internal users and external users, you have added.

From that moment on, you will be able to track the document. At the top of the Viewer, you see “Track and Revoke”. When you click on that button, your browser will open and you will see an overview of your document: when was it shared with others, the list of users it was shared with, who viewed, denied access, expiration date etc. There also is a timeline of activities and a map with geo locations of your viewers. At the button, in black, you see the Revoke Access button. This way, you can monitor the usage of your document and take action when needed.



There are no ribbons in, for example Adobe Reader. However, you can still label and protect .pdf files if you want. Again, the AIP Viewer/client supports several file formats. Just right-click on a .pdf file and click on “Classify and protect”.  You can now label your .pdf file or label + protect it. Meta data and optionally protection is being added to the file. With pdf files, you can see the AIP logo being added in the icon, as shown in the picture.

With the Azure Information Protection Viewer/client, users can now easily share content with others, but in a very controlled way. They intentionally need to take steps to do so. Even if a person you have shared a document with shouldn’t be allowed to view that document anymore, the user can quickly revoke access to the document.


Azure Information Protection- part 3: the end user with the Office apps

I have written a couple of posts around Azure Information Protection- what the solution is and the admin side of the solution. In this post, I would like to discuss the end user side of Azure Information Protection. What do end users see and how can they use classification, labeling and share documents? Luckily, it is very simple from an end user perspective, and that is a great thing!

I have mentioned it before; AIP starts with the creation of a document. When a user is creating a document, either a default classification/label has been applied by AIP (based on a company’s policy) or a user classifies/labels the document (also based on the company’s policy around document classification). From that moment on, optionally encryption applies with access control, a user policy and tracking+revocation possibilities.


After installing the AIP plug in on a user’s Windows system ( which you can download for free from here), when a user opens Word, Powerpoint, Outlook of Excel, the user will see a new ribbon in the Office app’s interface with the labels. If the automatic default label policy is applied, one of the labels will be grey, thus applied. On the left in the ribbon, you also can see which label is applied.

Which label to chose from all depends on the classification/labeling policy of documents within an organization. Needless to say you need to train/educate your users about the labels and what they stand for. Within the user interface, when a user hoovers over the labels, a textbox pops up with a description of that specific label. Companies can put in their description of liking. Also an open door but don’t use too many labels and add a clear description so users will understand easily which label to pick with different kind of content.

I discussed automatic classification and recommended classification in the post on the admin side of AIP. So, what’s the flow there and how does it look from an end user? Let’s say all documents with the word “draft” need to be classified internal or confidential. A user created a Word document, is typing away and somewhere is the word “draft”. Now the user wants to save the file on its machine (and it doesn’t matter where the user wants to save it). After picking the location and hitting save, the user will be prompted to change the classification of the document, with a reason (wording is up to the company’s policy). The user can change the classification of the document or dismiss the recommendation. Remember, AIP isn’t to prevent intentional behavior or fraud. In this case, the user will be made aware of the situation and can decide, after thinking about it, to change the classification or not. Also, you have the option to enforce the policy automatically, so users don’t have a recommendation. After changing the classification, the user will see the marking, set my the companies policy in the back end of AIP.

In the above case, meta data has been added to the document. When you right-click the document and open the properties, you will see and extra tab called “custom” where you can see the meta data. Besides meta data, the document, in this case, also has RMS attached to it. A users most likely doesn’t know about this and in my opinion, shouldn’t know this. The user classifies the document and based on the classification, the document gets encrypted, has specific access control and user policies attached.

Because of the specific classification/label and the attached RMS template, the user cannot just send the document to people outside the organization (RMS templates apply to users/groups inside the organization/(Azure) Active Directory/Azure tenant. If, by accident, a user would send the document to someone outside the organization (or maybe a user inside the organisation who wasn’t in the RMS template user/groups list), that recipient of the document couldn’t authenticate to open the document. With Echange Online and the Data Loss Prevention tools, you even can set rules on the AIP classifications/labels. Exchange Online and AIP work together.

AIP is easy to use for end users. Success depends on a clear, easy to understand company policy around classifying and labeling content and education of the users. Awareness how to handle content is one of the major benefits when using AIP. It is fair to say it can prevent user mistakes till a certain level but it won’t help you when someone intentionally is trying to get around the system.

My next post will be about the AIP client and sharing documents externally.