Applications that support Azure Rights Management data protection

Applies to: Azure Information Protection, Office 365

Relevant for: AIP unified labeling client and AIP classic client.

Note

To provide a unified and streamlined customer experience, the Azure Information Protection classic client and Label Management in the Azure Portal are deprecated as of March 31, 2021. No further support is provided for the classic client and maintenance versions will no longer be released.

The classic client will be officially retired, and will stop functioning, on March 31, 2022.

All current Azure Information Protection classic client customers must migrate to the Microsoft Information Protection unified labeling platform and upgrade to the unified labeling client. Learn more in our migration blog.

The applications and solutions listed on this page have built-in support for the Azure Rights Management (Azure RMS) service, which provides data protection for Azure Information Protection.

These applications and solutions are known as "RMS-enlighted", and have Rights Management and usage restrictions tightly integrated using Rights Management APIs.

Note

Unless stated otherwise, the supported capabilities apply to both Azure RMS and AD RMS.

AD RMS support on iOS, Android, macOS, and Windows Phone 8.1 also requires the Active Directory Rights Management Services Mobile Device Extension.

Windows RMS-enlightened applications

Type Supported applications
Word, Excel, PowerPoint - Microsoft 365 apps
- Office Professional Plus 2010
- Office Professional Plus 2013
- Office Professional Plus 2016
- Office Professional Plus 2019
- Office for the web (viewing protected documents)
- Web browser
Email - Outlook Professional Plus 2010
- Outlook Professional Plus 2013
- Outlook Professional Plus 2016
- Outlook Professional Plus 2019
- Outlook from Microsoft 365 Apps for Enterprise
- Web browser
- Windows Mail
Other file types - Visio from Microsoft 365 apps, Office 2019, and Office 2016: .vsdm, .vsdx, .vssm, .vstm, .vssx, .vstx
- Azure Information Protection client for Windows: Text, images, pfile

CAD files, such as .dwg files, are supported by partner solutions, such as SealPath RMS plugin for AutoCAD and SECUDE's HALOCAD plugin. For more information, see How to protect your CAD data files with MIP and HALOCAD.

macOS RMS-enlightened applications

Type Supported applications
Word, Excel, PowerPoint - Microsoft 365 apps, version 16.40 or later
- Office 2019 for Mac, version 16.40 or later
- Office 2016 for Mac, version 16.16.27 or later
- Office for the web
- Web browser
Email - Outlook 2019 for Mac, version 16.40 or later
- Outlook 2016 for Mac, version 16.16.27 or later
- Web browser
Other file types RMS sharing app (viewing protected text, images, generically protected files)

Android RMS-enlightened applications

Type Supported applications
Word, Excel, PowerPoint - GigaTrust App for Android
- Office for the web
- Office Mobile (unless using sensitivity labels, limited to viewing and editing protected documents)
- Web browser
Email - 9Folders
- Azure Information Protection app (viewing protected emails)
- BlackBerry Work
- GigaTrust App for Android
- Citrix WorxMail
- NitroDesk
- Outlook for Android
- Samsung Email (S3 and later)
- TITUS Classification for Mobile

- Web browser
Other file types Azure Information Protection app (viewing protected text and images)

iOS RMS-enlightened applications

Type Supported applications
Word, Excel, PowerPoint - GigaTrust
- Office Mobile
- Office for the web
- TITUS Docs
- Web browser
Email - Azure Information Protection app (viewing protected email)
- BlackBerry Work
- Citrix WorxMail
- NitroDesk
- Outlook for iPad and iPhone
- TITUS Mail
- Web browser
Other file types - Azure Information Protection app (viewing protecting text and images)
- TITUS Docs: Pfile

Windows 10 or Windows 11 mobile RMS-enlightened applications

Type Supported applications
Word, Excel, PowerPoint - Office Mobile apps (viewing protected documents using Azure RMS)
- Web browser
Email - Citrix WorxMail
- Outlook Mail (viewing protected emails)
- Web browser
Other file types Not supported

Blackberry 10 RMS-enlightened applications

Type Supported applications
Word, Excel, PowerPoint - Web browser
Email - Blackberry email
- Web browser
Other file types Not supported

Additional details about RMS-enlightened applications

For more information about the tables RMS-enlightened applications listed above, see:

Viewing protected content in email clients

When an email client protects a message, any Office files that are attached to the message, and are currently unprotected, are protected together with the email message. In such cases, both the email message and attachments can be viewed in the email client, by authorized recipients only.

However, if only the attachment is protected, but not the email message itself, the attachment cannot be previewed by the email client, even by authorized recipients.

Tip

For email clients that don't support protecting emails, consider using Exchange Online mail flow rules to apply this protection.

Supported text and image file types

File types other than Office files and email messages include text and image file types, with extensions such as .txt, .xml, .jpg, and .jpeg.

These files change their file name extension after they're natively protected by Rights Management, and then become read-only.

Files that cannot be natively protected have a .pfile file name extension after they are generically protected by Rights Management.

For more information, see the File types supported.

Microsoft 365 app support

Includes:

  • Office apps, for the versions listed in the table of supported versions for Microsoft 365 Apps by update channel, from Microsoft 365 Apps for Business or Microsoft 365 Business Premium, when the user is assigned a license for Azure Rights Management (also known as Azure Information Protection for Office 365)
  • Microsoft 365 Apps for Enterprise

Viewing protected documents in Office for the web

Supported only with Microsoft SharePoint and OneDrive, and the documents are unprotected before they are uploaded to a protected library.

Web browser support

  • Web browsers are supported for Word, Excel, and PowerPoint files, when the Office attachments are protected by using Microsoft 365 Message Encryption with the new capabilities.

  • For emails, web browsers are supported only in the following scenarios:

    • If both the sender and the recipient are part of the same organization
    • If the sender or recipient is using Exchange Online
    • If the sender is using Exchange on-premises in a hybrid configuration

Email clients using Exchange ActiveSync IRM

The following email clients use Exchange ActiveSync IRM, which must be enabled by the Exchange administrator:

  • Windows Mail
  • 9Folders
  • GigaTrust App for Android
  • NitroDesk
  • Outlook for Android
  • Samsung Email (S3 and later)
  • Outlook for iPad and iPhone
  • Blackberry Email

Users can view, reply, and reply all for protected email messages but cannot protect new email messages.

If the email application cannot render the message because the Exchange ActiveSync IRM is not enabled, the recipient can view the email in a web browser when the sender uses Exchange Online, or Exchange on-premises in a hybrid configuration.

Azure RMS support for Office

Azure RMS is tightly integrated into the Word, Excel, PowerPoint, and Outlook apps, where this functionality is often referred to as Information Rights Management (IRM).

See also: Office Applications Service Description

Windows computers for Information Rights Management (IRM)

The following Office client suites support protecting files and emails on Windows computers by using the Azure Rights Management service:

  • Office apps, for the versions listed in the table of supported versions for Microsoft 365 Apps by update channel, from Microsoft 365 Apps for Business or Microsoft 365 Business Premium, when the user is assigned a license for Azure Rights Management (also known as Azure Information Protection for Office 365)

  • Microsoft 365 Apps for Enterprise

    These editions of Office are included with most but not all subscriptions that include data protection from Azure Information Protection. Check your subscription information to see if Microsoft 365 Apps for Enterprise ProPlus is included. You'll also find this information in the Azure Information Protection datasheet.

  • Office Professional Plus 2019

  • Office Professional Plus 2016

  • Office Professional Plus 2013

  • Office Professional Plus 2010 with Service Pack 2

All editions of Office (with the exception of Office 2007) support consuming protected content.

Azure Rights Management service with Office Professional Plus 2010 and Service Pack 2 or Office Professional 2010 with Service Pack 2

When you use the Azure Rights Management service with Office Professional Plus 2010 and Service Pack 2 or Office Professional 2010 with Service Pack 2, you must also have the AIP client for Windows.

Additionally, this configuration:

  • Is not supported on Windows 10 or Windows 11.
  • Does not support forms-based authentication for federated user accounts. These accounts must use Windows-Integrated Authentication.
  • Does not support the ability to override template protection using custom permissions selected with the AIP client. In this scenario, the original protection must first be removed before custom permissions can be applied.

Mac computers for Information Rights Management (IRM)

The following Office client suites support protecting files and emails on macOS by using Azure RMS:

  • Microsoft 365 Apps for Enterprise
  • Office Standard 2019 for Mac
  • Office Standard 2016 for Mac

All editions of Office for Mac 2019 and Office for Mac 2016 support consuming protected content.

Tip

If you are using the classic client on a Mac computer, you might find the following FAQ useful: How do I configure a Mac computer to protect and track documents?

Azure Information Protection apps for iOS and Android

The Azure Information Protection app for iOS and Android provides a viewer for rights-protected email messages (.rpmsg files) when these mobile devices don't have an email app that can open protected emails. This app can also open rights-protected PDF files, and pictures and text files that are rights-protected.

If your iOS and Android devices are enrolled by Microsoft Intune, users can install the app from the Company Portal and you can manage the app by using Intune's app protection policies.

For more information about how to use app, see the FAQ for Microsoft Azure Information Protection app for iOS and Android.

The Azure Information Protection client for Windows

To use Azure Information Protection, you must deploy the AIP client across your system.

Download the unified labeling client installation from the Microsoft Azure Information Protection page.

For more information, see:

AIP's classic client

If you have not yet upgraded, you may still have the legacy Azure Information Protection classic client deployed.

For more information about deploying and using the classic client, see:

Note

To provide a unified and streamlined customer experience, the Azure Information Protection classic client and Label Management in the Azure Portal are deprecated as of March 31, 2021. No further support is provided for the classic client and maintenance versions will no longer be released.

The classic client will be officially retired, and will stop functioning, on March 31, 2022.

All current Azure Information Protection classic client customers must migrate to the Microsoft Information Protection unified labeling platform and upgrade to the unified labeling client. Learn more in our migration blog.

Rights Management sharing app

For Mac computers, the Rights Management sharing app offers a viewer for protected PDF files (.ppdf), protected text images, and generically protected files. It can also protect image files, but not other files. To protect Office files on these computers, use Office for Mac or Microsoft 365 Apps for Enterprise.

For more information, see the FAQ for Microsoft Rights Management Sharing Application for Mobile Platforms

Download the Rights Management sharing app for Mac computers from the Microsoft Azure Information Protection page.

Other applications that support Azure Information Protection

In addition to the applications listed above, any application that supports the APIs for the Azure Rights Management service can be integrated with Azure Information Protection.

Examples may include line-of-business applications written in-house, or applications from software vendors, written using the RSM SDKs.

Applications that are not supported by Azure RMS

Applications not currently supported by Azure RMS include:

  • Microsoft OneDrive for SharePoint Server 2013
  • XPS Viewer
  • Applications running on Windows versions earlier than Windows 7, Service Pack 1

Next steps

See also:

For the latest information about solutions that support the Azure Rights Management service and Azure Information Protection, see the blog post, Microsoft Ignite 2019 – Microsoft Information Protection solutions Partner ecosystem showcase.