Internal Rights Management licensing is enabled

Overview

Internal RMS licensing allows users and services in the organization to license protected content for internal distribution and sharing. It’s enabled automatically when Azure RMS is activated. If disabled, users can’t collaborate on encrypted emails and files internally, and legal holds, eDiscovery, and data recovery operations can’t access encrypted content.

Remediation

• Set up Message Encryption

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	High
Pillar	Data, AI
Category	Rights Management Service (RMS)
Product	Purview
Feature	Information protection
Area	Data protection
Licence	RMS_S_PREMIUM, Microsoft 365 E3
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.