Office 365 Message encryption

If you weren’t aware, Office 365 supports sending encrypted messages to anyone. Basically, they get an email telling them to login to a web portal to view the message. Here’s how to make all that work.

You’ll firstly need to enable Rights Management for your tenant. To do that login to the Office 365 portal as an administrator.

On the left hand side select Service Settings.

This will expand a menu as shown above. From this menu select Rights Management.

On the right now select the Manage hyperlink.

Select the Activate button to enable Right Management.

Confirm that you wish to enable by selecting the Activate button.

After a few moments the screen should update.

You are now going to need to run some PowerShell commands. if you haven’t done this check out this previous blog post to get your environment setup:

Configuring PowerShell Access in Office 365

Once you have connected using PowerShell you’ll need to run the following commands depending on your location:

USA: Set-IRMConfiguration -RMSOnlineKeySharingLocation https://sp-rms.na.aadrm.com/TenantManagement/ServicePartner.svc

Europe: Set-IRMConfiguration -RMSOnlineKeySharingLocation https://sp-rms.eu.aadrm.com/TenantManagement/ServicePartner.svc

Asia-Pacific: Set-IRMConfiguration -RMSOnlineKeySharingLocation https://sp-rms.ap.aadrm.com/TenantManagement/ServicePartner.svc

In my case I used the Asia Pacific URL as shown above.

You then need to run the command:

Import-RMSTrustedPublishingDomain -RMSOnline -name “RMS Online”

which produces the above result.

Then this command:

Set-IRMConfiguration -InternalLicensingEnabled $True

Finally run the command:

Test-IRMConfiguration -RMSOnline

and ensure the result come back OVERALL RESULT: PASS

With that done you can now return to the Office 365 management portal as an administrator to set up a message encryption transport rule.

In the top right of the Office 365 portal select Admin and then Exchange from the menu that appears.

From the menu on the left select mail flow.

Select the Plus icon on the right and the option Create a new rule from the menu that appears.

Now there are lots of different options when creating an Office 365 Transport Rule but I am not going to cover these. This post is aimed at showing you the basics of enabling Exchange Online Message Encryption. If you want more information about Office 365 Transport Rules in general see:

http://technet.microsoft.com/en-us/library/jj919238(v=exchg.150).aspx

In this case I am going to set a rule to encrypt messages sent to one person in the organisation (Anne Wallace).

To see the encryption options ensure you select the More options hyperlink at the bottom of this window as shown above.

For the Do the following condition select Modify the message security and then Apply Office 365 Message Encryption as shown above.

Once saved the new rule should appear in the list as shown above.

Now if Anne Wallace is sent an email by another Office 365 she will see:

Indicating that this is an encrypted message.

To view the message Anne must save the attached HTML file to her local machine and open it.

When she so and opens it she will see the above message.

If she then selects the Sign in and view encrypted message hyperlink she will be see the encrypted message.

Exchange Online Encrypted messages work with people inside and outside Office 365. If you want more information check out the following:

http://technet.microsoft.com/en-us/library/dn569286.aspx

Once you have done the initial Rights Management setup you then have a lot of flexibility using Exchange Online Transport Rules to determine how messages are handled. You could set up a rule that if the word ENCRYPT is in the message subject it will always be encrypted.

Very flexible and most importantly, very secure.

Emailing OneDrive for Business files

Office 365 now supports the ability to attach files directly from your OneDrive for Business via Outlook Web Access.

To do this simply navigate to your Office 365 web portal and select Outlook from the top navigation bar.

Compose a new email and select the Insert button at the top of the window. That will reveal the above menu. Select Attachments or OneDrive for files.

You’ll then be taken to a screen like the above where you can select from a number of different sources. Under the OneDrive option for example select My Files. You should then see all the files you have in OneDrive for Business displayed. Select the file you wish to attach and then the Next option in the top left (above the OneDrive icon).

You are then prompted as to whether you wish to send this file as an attachment (i.e. the whole file is added to the email) or you just want to send a link to the file. In essence this ‘shares’ that file from your OneDrive for Business rather than sending the whole file. That allows you to potentially revoke that sharing at any stage in the future.

If you elect to attach the file you will see the attachment displayed as above with the actual file size displayed.

If instead you elected to Share with OneDrive you will see the attachment but also the text Recipients can edit.

When the recipient receives the file, if it was sent as an attachment they can view it as they normally could.

However, if you elected to Share with OneDrive they will be taken to a link to view the file. If the shared file is an Office document they will see that document in Office Online as shown above.

This feature is something that has been missing from Office 365 for a while now and makes more sense as more people move all their information to the cloud. What would be nice now is some similar integration with Outlook on the desktop. Having the ability to attach or share from Outlook on a standard PC desktop would really accelerate cloud adoption in my option.

This feature is currently rolling out to all tenants. If you don’t have it yet you will soon.

Exchange Online mailbox search

Office 365 provides the ability in all plans to search across all mailboxes. What I’ll cover here is how to do this with the Small Business Plan as that is the most challenging given that Exchange Online console is not exposed by default. If you have an M or E plan simply follow on from when the Exchange Online console comes into view.

The above screen shot shows a user with a single email in their inbox we will search for. In this case we will be searching for the text “Rescuetime”.

Here we have logged into a Small Business tenant which provides a simplified interface. To access the Exchange Online console from a Small Business tenant use the URL:

https://outlook.office365.com/ecp/

When the Exchange Online console appears select permissions from the left hand side.

By default no user is given the ability to search through all mailboxes, not even global administrators. So the first step in the process is therefore to allow this.

Once permissions is selected, select Discovery management to the right as shown above.

Now select the pen icon at the top to edit this security group.

At the bottom of the dialog that appears, in the Members section, press the + button to add a new member.

Select and add the Office 365 users you wish to give these discovery rights to.

Press Save to update the permissions.

You may need to log out of the web portal and log back in. You may also need to wait a few minutes until the rights have been updated.

Once you have select compliance management from the menu on the left.

Unless you see more than 4 icons at the top of the table you do not have the discovery rights.

Only when you do will you see all the icons as shown directly above will you have the rights to search across multiple content.

Press the + key to create a new search.

Give the new discovery search a name and description and select next to continue.

In most cases you are going to want to search all mailboxes, however it is possible to specify which ones you wish to search.

Press the next button when you have made your selection.

Now you can specific the filter criteria for your search. In this case we need to search for the keyword ‘Rescuetime’.

Press the finish button when complete.

The search will execute immediately. The time taken will depend on the information your are searching for and how much information it has to search.

Press the close button to continue.

You should now see the item just created listed.

If you scroll down the dialog on the right you will see a hyperlink Preview search results. Select this.

You will now see an Outlook Web Access style interface with all the matches located.

With the item selected you can also use the download button to save the results to a PST file for offline review.

You can of course return to this query at any point in the future, edit the query and save it to re-run the search. This makes it very handy if you need to search for things on a regular basis.

In summary, all plans have the ability to search across your users data (in this case email). Some plans also allow you to place searched information on hold so that it is retained even if deleted by the user. You will firstly need to grant the person doing the searching the rights as a member of the Discovery Management group. You then create a query based on your requirements which you can view online or export to a PST file for offline view.

You’ll find more detailed information about these discovery options at:

Office 365 eDiscovery FAQ

Enable litigation hold for all Exchange Online mailboxes using PowerShell

If your Office 365 plan includes the option for litigation hold then it is generally best to turn it on for all mailboxes from day 1. The quickest and easiest method of doing that is via PowerShell.

Here’s the one line command you need to achieve that:

get-mailbox | set –litigationholdenabled $true

Of course, it won’t automatically enable any future mailboxes your create but all you need to do is run the same command again.

Adding multiple mailbox to a SharePoint eDiscovery centre

One of the great ‘enterprise’ features you receive with the higher end Office 365 plans is eDiscovery. This basically allows you to trawl through all the information you have in Office 365 looking for matches to your query.

One of the options available is to create an eDiscovery centre in SharePoint Online which I covered in a previous blog post here:

SharePoint Online eDiscovery

It is important not to overlook the fact that the SharePoint Online eDiscovery centre can be used across SharePoint Online and Exchange Online.

So if you create a new eDiscovery Set, you then need to define the Sources that the set will work across (i.e. search through). You do this by selecting the Add & Manage Sources hyperlink.

You’ll then see this take you to a dialog where you can select the individual mailboxes you wish to search along with any SharePoint locations.

But what happens if you want to search across multiple mailboxes? Do you have to enter them in individually?

In this case, because there are already email distribution groups established we can use these to select a group of users.

Here there is an existing email distribution group called Sales Team.

If you therefore enter the distribution email group into a mailbox location and select the Check Name icon to the right, you should see a green tick appear to the left indicating that it is valid.

When you save this source you should then see that all the mailboxes of the email distribution group have been added as Sources for eDiscovery.

Thus, if you want to include every email inbox simply create or use an email distribution group in Office 365 that includes all mailboxes.

Working with Exchange Online Shared mailboxes in OWA

On of the big advantages that Office 365 provides is the ability to create as many ‘shared mailboxes’ as you like. Typically these ‘shared mailboxes’ are used for common function like info@, sales@, support@ etc.

You can’t open a ‘shared mailbox’ directly, however a user with an Exchange Online license can open it via Outlook either on the desktop or via Outlook Web Access (OWA).

Firstly, navigate to a users Outlook Web Access by logging into the Office 365 portal.

In the top right corner select the users name (in this case Alex Darrow) and from the menu that appears select Open another mailbox…

Enter the email address of the mailbox to be opened (in this case (info@ciaops365d10.onmicrosoft.com). You of course need the rights to open the mailbox before hand.

This will then open that mailbox in a new browser tab as shown above.

This is all well and good if you only need to work with the ‘shared mailbox’ occasionally. What happens if you want to interact it with a lot directly from your browser?

In that case, return to Outlook Web Access and right mouse click on the name of the mailbox, which is directly above Inbox (here Alex Darrow). From the menu that appears select add shared folder…

As before, enter the email address of the shared mailbox and press OK when complete.

In a matter of moments that shared mailbox will appear below all the other folders of the primary user mailbox. Now, provided you have the rights to can also drag and drop email into or out this mailbox to your primary mailbox.

To remove this shared mailbox from you OWA, simply right mouse click on it and select removed shared folder.

So, working with ‘shared mailboxes’ is just as quick and easy as using Outlook on the desktop in Office 365.