Co-existence of AD RMS On-Premises and Azure Rights Management

Recently, I was part of an internal IT project to implement AD RMS on-premises on top of Windows Server 2012 R2. We had created a template, assigned users to it and the template has been in use for about 2 months without any issues.
I was then reading about the Azure Rights Management Service which had been released and we were eligible for with our Office 365 subscription. I went through all the documentation and went ahead with implementing it yesterday not seeing any caveats based
on our current setup. Well, today, I received word from users that they were not able to see the original template they were using when trying to protect a document, only the new "Confidential" and "Confidential - View Only" templates that
I know are provided by the Azure Rights Management Service.
I have scoured the web and the Microsoft IT forums, but cannot find any information about restrictions on using on-premises AD RMS along with the Azure Rights Management Service at the same time. I really like the idea of using the Azure version as then
our corporate users can get their policies on all their devices and when outside the network as well as the great new sharing options for other users outside the organization. However, I also need to have some more granular control over at least one template
which I can do with the on-premises AD RMS.
My question is: can you have both rights management services running at the same time? At this point, I may have to disable the Azure Rights Management Service in order to restore the previous functionality that my users are relying on, but I'd like to have
both options available if possible and short of that, maybe migrate over to the Azure hosted version. In addition, is there any documentation that includes considerations for migrating from AD RMS to Azure RMS?

"In addition, is there any documentation that includes considerations for migrating from AD RMS to Azure RMS?"
Just in case you missed the announcement, migration from AD RMS to Azure RMS is now supported:
Blog post announcement:
http://blogs.technet.com/b/rms/archive/2015/01/29/january2015majorupdate.aspx
Migration documentation:
https://technet.microsoft.com/en-us/library/Dn858447.aspx

Similar Messages

RMS: On-Premise vs Azure

Hi,
We are looking at whether to implement RMS either with Azure Cloud and on-premise. Does anyone has a list of technical difference & comparisons of pros-cons when it comes to on-premise versus Azure cloud?
Thank You.

Hi Warrior -
The two are very similar in terms of how they work and the necessary components. There are some feature differences at the moment, which are covered here:
http://technet.microsoft.com/en-us/library/jj739831.aspx
In terms of pros and cons, beyond the article covered there, Azure RMS is available as a subscription service, with limited on-premises components to deploy. AD RMS is available as an on-premises server role. So in addition to the above, the
pros and cons of deploying something in the cloud or on-premises also apply.
I hope that helps!
Thanks,
Micah LaNasa
Synergy Advisors
synergyadvisors.biz

Data sync between on-premise and azure database

HI, I am not able to setup data sync between my on-premise database and azure database. Following is the error I am getting after it ran for almost 36 hours...
Sync failed with the exception "GetStatus failed with exception:Sync worker failed, checked by GetStatus method. Failure details:An unexpected error occurred when applying batch file C:\Resources\directory\4c6dc848db5a4ae88265ee5aa1d44f40.NTierSyncServiceWorkerRole.LS1\DSS_7b1d73b4-d125-466f-94ab-eaa4553ea0ae\ed19f805-3d50-466a-96b3-861c4f22d8a4.batch.
See the inner exception for more details.Inner exception: Failed to execute the command 'UpdateCommand' for table 'dbo.Transactions'; the transaction was rolled back. Ensure that the command syntax is correct.Inner exception: SqlException Error Code: -2146232060
- SqlError Number:10054, Message: A transport-level error has occurred when receiving results from the server. (provider: TCP Provider, error: 0 - An existing connection was forcibly closed by the remote host.) " For more information,
provide tracing ID ‘e6a1fad1-f995-4ffe-85db-0c6dc02423f1’ to customer support.

Hi, sorry it has been a long time since your last post. Are you still using SQL Data Sync and hitting any issue which we could help with?
Linda

Vpn rras connectivity between on-premise and azure.

hello,
i have created a vpn rras site to site between my onpremise site and azure.
vpn status is connected but i can't ping from my on-premise site to azure.
also when i type ns lookup from vm azure it gives me DNS request timed out timeout was 2 seconds.
thakns in advance.

Hi,
Hope your issue is resolved, if u need further assistance, please reply with the information asked by Nagamalar.
If your issue is resolved, please post the steps/troubleshooting solution so that it can help other users in the community.
Regards,
Nithin Rathnakar

Adobe Reader for iOS and Android & Rights Management

This week's release of Reader for iOS and Android devices incorporates support for accessing files secured by Adobe LiveCycle Rights Management.
As you are probably familiar, LiveCycle Rights Management protects sensitive documents by encrypting them with industry-standard AES encryption and enabling central management of their access permissions. Protections persist even when documents are accidentally distributed via email, the cloud, or saved on a lost mobile device.
Many of the core capabilities that you are used to on the desktop versions of Acrobat and Reader are now supported when you are on the go on your tablet or mobile phone. We intend to incorporate additional functionality in future releases of these mobile devices and look forward to your feedback.
We've had several questions thus far about how this works. More information about the product, as well as a link to an FAQ can be found at:http://blogs.adobe.com/security/2011/10/just-released-adobe-reader-10- 1-for-ios-and-android.html
Jonathan

Hello Jonathan,
is there an way to trigger iOS download to immediately open using "Adobe Reader"
instead of using the default Previewer (showing an plain empty white window) and then re-open it using "Open with" ?
Is there an MIME-Type to indicate IRM-protected PDF-files?
Thanks,

Livecycle ES3 - Opening and edit rights managed MS office document in SharePoint

As stated in the release note of LiveCycle Rights Management 9.5 Extension for Microsoft Office:
"After opening the protected document: When you open a protected document from SharePoint Server, all permissions on the document are disabled, regardless of the policy that was applied."
Current LC ES2/ ES2.5 does not cater the direct edit of MS office documents in SharePoint.
Is there any news that LC ES3 will resolve this to allow direct edit on the document?
Thanks.

Excellent!
Worked for me.
I am currently using Windows 8.1 Pro and Office365 ProPlus.
I got the same issue as stated by "Aki from Finland" after and decided to follow the steps outlined by "TylorWang". There were a few things I did differently due to the difference in product versions. Instead of going to the \14.0 folders,
I went to the \15.0 folders (both in the registry and under the \AppData folder).
I used PowerShell, running in Admin mode of course, to stop the MYOSYNC
process with:
kill -name msosync
Once I was done with the three steps, I restarted my computer. Once I logged in into my account, the usual Office Upload Center cache error did not occur and my files are now syncing without any problems.
Thank you very much "TylorWang" for your clear and precise solution and thank you TechNet for your continued support!
Taylor.
Edit: I also run Lync 2013 on my system.

PC Suite and Windows rights management

I have trouble connecting my N80 to get sync'ed properly and have been browsing this discussion. It seems like many of the issues are linked to the same: rights management for Windows users. Maybe Nokia developers are a bit unfamiliar too this? If you test the sw on a single station with no networking and policy, you will not get a result reflecing the world of the user.
At least suply an .exe package for installation enabling us to "run as" under Windows for installing for users WITHOUT local admin rights (common corporate practise).
Furtermore I wonder where the "clean-up" application went? Uninstalling PC Suite leaves a lot residue in registry.

seraphim. You have missed the point.
As a general policy, windows users should not run their machine logged on as a user with administration rights. This is good security practice and this policy will be enforced in Vista.
The Nokia PC Suite can only be installed by an administrative user, it writes to the registry for that user and that user only. If the same person (ie:me) then logs back in in normal (user) mode, the software won't work.
Normally there is a workaround. You log in as a normal user with user rights. Choose the installation executable and select (by right-clicking) 'run as ..' This allows the package to be run with administrative privileges - the username and password for an administrator is required before the action completes - but in the *context* of the normal user account, so the registry changes apply to the normal account.
Because PC Suite is distributed as an .msi file, this workaround is not available.
The proposal to use active directory to distribute software which will only be of relevance to people with a particular gadget is unrealistic. This is precisely the case where standalone installs by trusted administrators should be used.
The real problem is that PC Suite does not install properly and is confused by a change of user identity. This just needs fixing. A workaround using 'run as ..' would be useful however.
No one is proposing that the software should be installed by just anyone. 'run as ..' prevents this by requiring administrative credentials. At present even a fully qualified network administrator with full local rights *cannot* install PC Suite for a normal user.
This is not right. Being rude to prolie_no will not make it so.
You might also like to take some time to make sure that your links work.

AD RMS (On-Premise) and RMS Sharing App not allowing outside organisation protection

Hi All,
I have been looking using the RMS Sharing app with our AD RMS (2012) test environment.
But I seem to be having issues where the RMS Sharing app complains about protecting documents with addresses outside of the organisation.
I have set RMS to trust windows live ID's so i would have assumed that this wouldn't be the issue, or is there any additional settings that need to be implemented to get this to work? (Inter-Organisational protection however works fine)
Any advise would be appreciated.
Thanks,
Dave

Hi. Not all email domains are allowed when including the recipients of the protected file. Currently, free email services like gmail, live or yahoo will be blocked. The whole list can be checked from here https://portal.aadrm.com/content/blocked_domains.json
Regards
// Raúl - I love this game

Cannot share documents between On-Premises and Online Users by email invitation

We have a hybrid setup, no problems with email communications between on-premises and Microsoft Online users. We have also activated online Onedrive/sharepoint to start testing. One interesting thing is that users Online can share their documents by inviting
users who are on Microsoft Online, On-premises and outside this two systems. But the problem is with the users who are on-premises cannot share their documents by email invitation with the other users who are also on-premises, they can share the documents
with the users who are online only. When they try to share documents by email invitation they get error messages it their emailboxes saying that;
A communication failure occurred during the delivery of this message. Please try resending the message later. If the problem continues, contact your helpdesk.
Generating server: SMT947322-001.YLO001.MSOPRD.MSFT.NET
#< #5.5.0 smtp;550 Denied by policy> #SMTP#
It seems some kind of relay should be granted on my CAS servers or something like that but I am not sure of what should be added. I am just stuck as to what next step and where to start looking for the problem
Exchange 2010/2013 with Microsoft Online Office 365 Hybrid

No, just wanted to share documents using the invitation by mail in sharepoint/onedrive. We can share the documents normally without the email notification. Sorry to mention that even the users who are Online cannot share documents in sharepoint/onedrive
between themselves, so not between user on-premises and online users. For example a user selects a document in the library, click share and tick on by email, just gets an error
"#< #5.5.0 smtp;550 Denied by policy> #" , No RMS enabled yet.
Hi,
Sorry for my delay.
According to your further posting, the sending Denied cause is No RMS enabled yet. If that is the case, please activate Azure Rights Management (RMS) to check whether the issue persits.
When you activate Azure Rights Management (RMS), you turn on this feature for all rights-enabled services and applications. You must activate Rights Management before you can begin to use the information rights management (IRM) features within Office, SharePoint,
and Exchange. For details about how to activate RMS, please refer to:
http://technet.microsoft.com/en-us/library/jj658941.aspx
Regards,
Winnie Liang
TechNet Community Support

Premise and Connection object

Is it possible to have different addresses for Premise and Connection Object? If yes, then what configuration is needed??

[IS-U Master Data|http://help.sap.com/saphelp_utilities472/helpdata/en/f8/196c35a018d041e10000009b38f839/frameset.htm]
for each connection we can maintain multiple premises.
Premise address can maintain additional information as like (Additional street data enables you to manage additional information on the street name of the connection object. You can also store different street names. )
Regards,
Siva

Relation between (IBASE)Premise and Partner

Hello, Thanks in advance.
Is there any field or way to relation Premise with Partner ??
Thanks.

Hi,
I believe you are talking in the IS-U /CRM context. Well according to the data model there is no direct relationship between Premise and BP, but in case you are using CRM contracts in your implementation then there is a direct linkage provided out of the box. Even if you are not using CRM contract and are using IS-U contracts only you can use one of the data environment views in order to view the linkage between your BP and the chosen premise.
Hope this helps.
Regards,
Shalabh Jain.

BW on HANA, where BW is on premise and HANA in cloud

Hi,
Does anyone know if it is possible to install BW on HANA, where the BW component is installed on-premise and the HANA component is in the cloud (i.e. AWS hosted). I do know that "BW on HANA in the Cloud" exists, but this is not what my partner would like to do!
Thanks!
Jeffrey D'Silva

Hi Jeffrey,
No, I would not recommend that. If you put the BW components on premise (primary application server, additional app servers) and HANA database in cloud you will need a very high network bandwith to connect (min 2 Gbit/sec or higher), and you need to deal with the network latency as well.
Please steer your customer away from this idea!
They should explore the SPA HEC for the BW on HANA cloud deployment: Cloud Options | SAP HANA
Regards,
Gabor

What is sharepoint 2013 on premise and online

HI
what is sharepoint 2013 on premise and online
what is the concept in onpremises
adil

This is really basic stuff, have you searched for it at all? There is, quite literally, hundreds of articles on this such as:
http://redmondmag.com/articles/2013/04/01/key-piece.aspx
SharePoint On-Premises is where you own the servers and install SharePoint on them and manage it. SharePoint online is where Microsoft own and run the hardware and give you a section of it to use.

Microsoft Rights Management Sharing Application for Windows and the connection with AD RMS

Hi,
I have installed AD RMS and now installed on end users Microsoft Rights Management Sharing Application for Windows.
When I choose protect a document in any end user machine, does it connect with AD RMS server to get a certificate and encrypt the content, or does not use at all AD RMS services? What about when choosing to protect with an AD RMS template distributed
to end users?
Thanks

Hi Ardi -
The first time a user creates or consumes protected content, they must contact the RMS server to "bootstrap". In this process, the user obtains certificates to identity them within the context of RMS.
Once a user has bootstrapped, he or she can create protected protected content without access to the RMS server.
To open protected content, a user must connect to the AD RMS server to obtain a "use license".
Does that help?
Micah LaNasa
Synergy Advisors
synergyadvisors.biz

Need clarification in usage of premise and connection object

Hi everyone,
I am working on a project and for that i have do move in for around 30 customers. i did up to move in . I assumed 5 customers from a single appartment and grouped them. so i used same connection object and premise for them. After move- in is done i checked the Equipment numbers generated for all the 5 in that group. The address in equipment display(ie03) and also the customer display (XD03) is overlapped with the connection objects address. so it is showing same address for all 5 customers. After that i changed the premise but used the same conection object. But again the customer address is overlapped with the given connection object address. can anyone help me how to solve this if i have a scenario like this : 5 customers from same appartment. how to create the connection obj and premise .
Thanks,
Archana

Archana,
Please have a look at the IS-U data model. The connection objects relates to the building and the premises to the appartments. The 5 customers/consumers/business partners live in their own premise. On premise level you may detail the address with such as "1st floor last door to the right".
Devices (meters) are installed technically in a devlice location that can be is linked to premise and connection object. Finally the utility installation holds all billing relevant data while the contract is the link between the technical master data and the business master data. During a move-in the address list of a BP is completed by the address of the connection object (if customized).
As you can see there are various factors affecting the address of a business partner and a installed device.
Kind regards,
Fritz

Co-existence of AD RMS On-Premises and Azure Rights Management

Similar Messages

Maybe you are looking for