Control 1.16: Information Rights Management (IRM) for Documents

Overview

Control ID: 1.16 Control Name: Information Rights Management (IRM) for Documents Pillar: Security Regulatory Reference: GLBA 501(b), SEC Reg S-P, FINRA 4511, SOX 404 Setup Time: 1-2 hours

Purpose

Information Rights Management (IRM) provides persistent protection for documents accessed by Copilot Studio agents, ensuring that sensitive financial documents maintain protection even when downloaded or shared outside the organization. IRM controls what users and agents can do with protected content—preventing unauthorized copying, printing, forwarding, or screen capture of sensitive financial information. In FSI environments, IRM is critical for protecting MNPI, customer PII, and confidential trading strategies.

This control addresses key FSI requirements:

Persistent Document Protection: Rights travel with the document
Access Control: Control who can view, edit, copy, or print
Expiration and Revocation: Time-limit access and revoke remotely
Audit Trail: Track who accessed protected content

Prerequisites

Primary Owner Admin Role: Purview Info Protection Admin Supporting Roles: SharePoint Admin

Required Licenses

License	Purpose
Microsoft 365 E3/E5	Azure Information Protection
Microsoft 365 E5 or E5 Compliance	Advanced sensitivity labels
Azure Information Protection P1/P2	IRM protection and tracking

Required Permissions

Permission	Scope	Purpose
Compliance Administrator	Microsoft Purview	Create and manage sensitivity labels
SharePoint Administrator	SharePoint Online	Configure IRM on libraries
Global Administrator	Initial setup	Enable Azure RMS
Information Protection Admin	Microsoft Purview	Manage label policies

Dependencies

Control 1.5: DLP and Sensitivity Labels - Sensitivity label creation
Control 1.15: Encryption - Underlying encryption
Control 1.3: SharePoint Governance - Library permissions

Pre-Setup Checklist

[ ] Azure Rights Management Service (Azure RMS) activated
[ ] Sensitivity labels created with encryption
[ ] SharePoint modern experience enabled
[ ] Client applications support IRM (Office 365 ProPlus)
[ ] Document classification scheme defined

Governance Levels

Baseline (Level 1)

Apply IRM to sensitive documents; restrict copy, print, screenshot, forward permissions.

Recommended (Level 2-3)

IRM applied to all team collaboration and enterprise managed documents; time-limited access; audit logging of document access.

Regulated/High-Risk (Level 4)

Mandatory IRM with expiration; no download without audit; continuous access revocation capability.

Setup & Configuration

Step 1: Activate Azure Rights Management Service

Portal Path: Microsoft 365 Admin Center → Settings → Org settings → Security & privacy → Azure Information Protection

Navigate to Microsoft 365 Admin Center (admin.microsoft.com)
Select Settings → Org settings
Click Security & privacy tab
Select Azure Information Protection
Activate Azure RMS:
If not activated, click Manage Microsoft Azure Information Protection
This redirects to Azure portal
Navigate to Azure Information Protection → Protection activation
Click Activate if status shows "Not activated"
Verify activation status shows "Protection is activated"

Step 2: Create IRM-Enabled Sensitivity Labels

Portal Path: Microsoft Purview → Information protection → Labels → Create label

Navigate to Microsoft Purview (compliance.microsoft.com)
Select Information protection → Labels
Click + Create a label
Configure Label Properties:
Name: "Confidential - FSI Client Data"
Display name: "Confidential - Client Data"
Description for users: "Apply to documents containing client financial information"
Description for admins: "IRM-protected label for client PII and financial data"
Click Next → Scope:
Enable Items (files, emails)
Enable Groups & sites (optional for library protection)
Click Next → Encryption:
Select Apply encryption
Assign permissions now:
- Click Assign permissions
- Add internal users/groups with appropriate rights
- Add agent service accounts with Viewer rights only
Configure Rights: | Permission | Personal Productivity | Team Collaboration | Enterprise Managed | |------------|--------|--------|--------| | View | ✓ | ✓ | ✓ | | Copy | ✓ | ✗ | ✗ | | Print | ✓ | ✗ | ✗ | | Edit | ✓ | ✓ | ✗ | | Forward | ✗ | ✗ | ✗ |
Set Content Expiration:
For enterprise managed: Set Content access expires to 90 days
Configure Allow offline access for limited days (7-14)
Click Next → Content marking:
Enable watermark for enterprise managed documents
Add header: "CONFIDENTIAL - [CompanyName]"
Add footer: "Internal Use Only"
Complete label creation and publish

Step 3: Configure SharePoint Library IRM

Portal Path: SharePoint site → Library settings → Information Rights Management

Navigate to the SharePoint site containing agent knowledge sources
Go to the document library
Click Settings (gear icon) → Library settings
Under Permissions and Management, click Information Rights Management
Enable IRM on the library:
Check Restrict permission to documents in this library on download
Policy title: "FSI Protected Content"
Policy description: "Protected by IRM - copying and printing restricted"
Configure IRM Settings:
Allow viewers to print: Uncheck for enterprise managed
Allow viewers to run script and screen reader: Check (accessibility)
Allow users to upload documents that do not support IRM: Uncheck
Stop restricting access to the library at: Set expiration date if needed
Additional Options (click "Show Options"):
Group protection: Set reasonable group size
Document access rights: Configure per governance level
Prevent opening documents in browser: Enable for high-security libraries
Click OK to apply IRM settings

Step 4: Configure IRM for OneDrive

Portal Path: SharePoint Admin Center → Settings → OneDrive → Sync

Navigate to SharePoint Admin Center (admin.sharepoint.com)
Select Settings → OneDrive
Enable IRM for OneDrive:
Under Sync, click IRM
Enable Let users sync IRM-protected files with the OneDrive sync app
Configure Sync Client IRM:
Users can sync IRM-protected libraries
Files maintain protection when synced locally

Step 5: Configure Agent Access to IRM Content

Portal Path: Copilot Studio → [Agent] → Knowledge → Manage sources

Open Copilot Studio (copilotstudio.microsoft.com)
Select the agent that accesses protected content
Navigate to Knowledge → Manage sources
Verify Agent Permissions:
Agent service account must be included in label permissions
Grant minimum required rights (typically View only)
For IRM-Protected Libraries:
Agent respects IRM permissions
Agent cannot extract content beyond granted rights
Document content is decrypted for authorized access only
Test Agent Access:
Upload IRM-protected test document
Query agent about document content
Verify agent can read but not expose protected content inappropriately

Step 6: Enable Document Tracking and Revocation

Portal Path: Azure Information Protection → Track and revoke

Navigate to Azure portal → Azure Information Protection
Select Track and revoke
Enable Document Tracking:
Users can track who accessed their protected documents
Available in Office applications and online
Configure Revocation:
Authorized users can revoke access to protected documents
Revocation is immediate for online access
Offline access limited by "Allow offline access" days setting
For Compliance Teams:
Compliance administrators can track all protected documents
Super user account can access all protected content (audit access)

Step 7: Configure Label Policies

Portal Path: Microsoft Purview → Information protection → Label policies

Navigate to Microsoft Purview → Information protection
Select Label policies → Publish labels
Create Publishing Policy:
Name: "FSI Agent Document Protection"
Labels: Select IRM-enabled labels created in Step 2
Users/Groups: All users who work with agent-accessed content
Policy Settings:
Apply default label to documents: Select appropriate default
Require users to apply a label: Enable for enterprise managed
Require justification for label change: Enable
Publish the policy
Allow 24-48 hours for policy propagation

Step 8: Configure Auto-Labeling for IRM

Portal Path: Microsoft Purview → Information protection → Auto-labeling

Navigate to Microsoft Purview → Information protection
Select Auto-labeling → Create auto-labeling policy
Configure Policy:
Name: "Auto-protect FSI Documents"
Conditions: Match sensitive information types
- SSN, Credit card numbers, Bank account numbers
- Custom SITs for MNPI indicators
Select IRM Label:
Choose label with IRM protection
Configure for automatic application
Locations:
SharePoint sites used by agents
OneDrive locations
Exchange for email content
Run policy in simulation mode first, then enable

PowerShell Configuration

Enable Azure RMS and Configure IRM

# Install required modules
Install-Module -Name AIPService
Install-Module -Name PnP.PowerShell

# Connect to Azure Information Protection
Connect-AipService

# Verify Azure RMS is activated
$rmsStatus = Get-AipServiceConfiguration
Write-Host "Azure RMS Status: $($rmsStatus.FunctionalState)" -ForegroundColor Cyan

# If not activated, activate it
if ($rmsStatus.FunctionalState -ne "Enabled") {
    Enable-AipService
    Write-Host "Azure RMS has been activated" -ForegroundColor Green
}

# Configure super user feature (for compliance access)
Enable-AipServiceSuperUserFeature

# Add compliance admin as super user
Add-AipServiceSuperUser -EmailAddress "compliance-admin@domain.com"

# Get current IRM configuration
Get-AipServiceConfiguration | Select-Object *

Configure SharePoint Library IRM via PowerShell

# Connect to SharePoint Online
Connect-PnPOnline -Url "https://yourtenant.sharepoint.com/sites/AgentKnowledgeBase" -Interactive

# Get the library
$libraryName = "Agent Documents"
$library = Get-PnPList -Identity $libraryName

# Enable IRM on the library
Set-PnPList -Identity $libraryName -IrmEnabled $true

# Configure IRM settings
$irmSettings = @{
    PolicyTitle = "FSI Protected Content"
    PolicyDescription = "Documents protected by IRM - copying and printing restricted"
    AllowPrint = $false
    AllowScript = $true
    AllowWriteCopy = $false
    DisableDocumentBrowserView = $true
    DocumentAccessExpireDays = 90
    EnableDocumentAccessExpire = $true
    GroupProtectionExpiryDays = 30
}

# Apply IRM settings via CSOM (more granular control)
$ctx = Get-PnPContext
$list = $ctx.Web.Lists.GetByTitle($libraryName)
$ctx.Load($list.InformationRightsManagementSettings)
$ctx.ExecuteQuery()

$list.InformationRightsManagementSettings.AllowPrint = $false
$list.InformationRightsManagementSettings.AllowScript = $true
$list.InformationRightsManagementSettings.AllowWriteCopy = $false
$list.InformationRightsManagementSettings.DisableDocumentBrowserView = $true
$list.InformationRightsManagementSettings.DocumentAccessExpireDays = 90
$list.InformationRightsManagementSettings.EnableDocumentAccessExpire = $true
$list.InformationRightsManagementSettings.PolicyTitle = "FSI Protected Content"
$list.InformationRightsManagementSettings.PolicyDescription = "Restricted by IRM"

$list.Update()
$ctx.ExecuteQuery()

Write-Host "IRM configured on library: $libraryName" -ForegroundColor Green

Audit IRM-Protected Document Access

# Connect to Exchange Online for audit log search
Connect-ExchangeOnline

# Search for IRM document access events
$startDate = (Get-Date).AddDays(-30)
$endDate = Get-Date

$irmEvents = Search-UnifiedAuditLog -StartDate $startDate -EndDate $endDate `
    -Operations "ProtectionApplied","ProtectionRemoved","FileAccessed" `
    -RecordType AzureActiveDirectoryAccountLogon `
    -ResultSize 5000

# Parse IRM access events
$accessReport = $irmEvents | ForEach-Object {
    $auditData = $_.AuditData | ConvertFrom-Json
    [PSCustomObject]@{
        Timestamp = $_.CreationDate
        User = $_.UserIds
        Operation = $_.Operations
        File = $auditData.ObjectId
        Result = $auditData.ResultStatus
    }
}

# Export report
$accessReport | Export-Csv -Path "IRM_AccessReport_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# Summary
Write-Host "=== IRM Access Summary ===" -ForegroundColor Cyan
Write-Host "Total IRM events: $($irmEvents.Count)"
Write-Host "Protection applied: $(($irmEvents | Where-Object Operations -eq 'ProtectionApplied').Count)"
Write-Host "Documents accessed: $(($irmEvents | Where-Object Operations -eq 'FileAccessed').Count)"

Create Sensitivity Label with IRM (Microsoft Graph)

# Note: Requires Microsoft.Graph module
Install-Module Microsoft.Graph.Identity.SignIns
Connect-MgGraph -Scopes "InformationProtectionPolicy.ReadWrite.All"

# Define label with encryption (simplified example)
$labelParams = @{
    displayName = "Highly Confidential - FSI"
    description = "For MNPI and highly sensitive financial data"
    color = "#FF0000"
    sensitivity = 10
    contentFormats = @("file", "email")
    isEndpointProtectionEnabled = $true
    settings = @(
        @{
            "@odata.type" = "#microsoft.graph.encryptionSettings"
            encryptionMethod = "AESGCM256"
            contentExpiredOnDateInDaysOrNever = "90"
        }
    )
}

# Note: Full implementation requires Microsoft Graph API calls
# This is a simplified example - use Microsoft Purview portal for production

Financial Sector Considerations

Regulatory Alignment

Regulation	Requirement	IRM Implementation
GLBA 501(b)	Protect customer NPI	IRM prevents unauthorized copying/sharing
SEC Reg S-P	Privacy of consumer financial info	Watermarks and access restrictions
FINRA 4511	Books and records retention	IRM audit trail for access history
SOX 404	Internal controls	Prevent unauthorized document distribution
SEC Reg S-ID	Red flags for identity theft	Protect customer identity documents

Zone-Specific Configuration

Configuration	Zone 1 (Personal Productivity)	Zone 2 (Team Collaboration)	Zone 3 (Enterprise Managed)
IRM on Libraries	Optional	Required	Mandatory
Print Protection	Allowed	Blocked	Blocked
Copy Protection	Allowed	Blocked	Blocked
Watermarking	Disabled	Header/Footer	Full watermark
Access Expiration	None	180 days	90 days
Offline Access	30 days	14 days	7 days
Screen Capture Block	Disabled	Enabled	Enabled
Revocation Capability	Manual	Admin + User	Automated alerts

FSI Use Case Example

Scenario: Research Analyst Report Protection

Requirements:

Equity research reports contain MNPI
SEC regulations require access controls
Reports shared with select institutional clients

IRM Implementation:

Sensitivity Label: "Highly Confidential - Research"
Permissions:
Research team: View, Edit
Sales desk: View only
Institutional clients: View only (via external sharing)
No copy, print, or forward
Expiration: Access expires 90 days after publication
Watermarking: Dynamic watermark with viewer's email
Agent Access: Copilot agents have View-only access for Q&A

Regulatory Benefit:

Demonstrates MNPI access controls to SEC/FINRA
Audit trail for who accessed research
Revocation capability for compliance issues

Verification & Testing

Verification Steps

Azure RMS Verification:
[ ] Azure RMS activated in tenant
[ ] IRM-enabled labels published
[ ] Label policies applied to users
Library IRM Verification:
[ ] IRM enabled on sensitive libraries
[ ] Download restrictions working
[ ] Print/copy blocked as configured
Agent Access Testing:
[ ] Agent can read IRM-protected content
[ ] Agent respects protection restrictions
[ ] Agent cannot expose protected content inappropriately
Audit Trail Verification:
[ ] Document access logged
[ ] Protection events captured
[ ] Revocation tested and working

Compliance Checklist

[ ] IRM enabled on all team collaboration and enterprise managed document libraries
[ ] Sensitivity labels include IRM protection
[ ] Auto-labeling policies active for SIT matches
[ ] Document tracking enabled
[ ] Revocation procedures documented
[ ] Agent service accounts have minimum IRM rights

Troubleshooting & Validation

Issue 1: Agent Cannot Access IRM-Protected Content

Symptoms: Agent returns errors or empty responses for protected documents

Resolution:

Verify agent service account is in label permissions
Check that service account has Azure RMS rights
Confirm library IRM settings allow service accounts
Test with unprotected version to isolate issue
Review agent authentication method

Issue 2: IRM Not Applying to Downloaded Files

Symptoms: Files lose protection when downloaded

Resolution:

Verify IRM is enabled on the library
Check that file type supports IRM (Office docs, PDF)
Ensure client has Azure Information Protection client
Verify user isn't in exception group
Check for conflicting Group Policy settings

Issue 3: Users Cannot Open IRM-Protected Documents

Symptoms: "You don't have permission" errors

Resolution:

Verify user is in label permissions
Check document expiration date
Verify offline access hasn't expired
Ensure Azure RMS is reachable
Clear Azure RMS credential cache

Issue 4: IRM Watermarks Not Displaying

Symptoms: Content marking not appearing on documents

Resolution:

Verify content marking enabled in label
Check that document format supports watermarks
Ensure client application is updated
Verify label was properly applied
Check for macro or add-in interference

Additional Resources

Control ID	Control Name	Relationship
1.5	DLP and Sensitivity Labels	Label-based protection
1.15	Encryption	Underlying encryption
1.3	SharePoint Governance	Library permissions
1.14	Data Minimization	Access restrictions
4.1	SharePoint IAG	Content discovery control

Support & Questions

For implementation support or questions about this control, contact:

AI Governance Lead (governance direction)
Compliance Officer (regulatory requirements)
Technical Implementation Team (platform setup)

Updated: Dec 2025
Version: v1.0 Beta (Dec 2025)
UI Verification Status: ❌ Needs verification

Control 1.16: Information Rights Management (IRM) for Documents

Overview

Purpose

Prerequisites

Required Licenses

Required Permissions

Dependencies

Pre-Setup Checklist

Governance Levels

Baseline (Level 1)

Recommended (Level 2-3)

Regulated/High-Risk (Level 4)

Setup & Configuration

Step 1: Activate Azure Rights Management Service

Step 2: Create IRM-Enabled Sensitivity Labels

Step 3: Configure SharePoint Library IRM

Step 4: Configure IRM for OneDrive

Step 5: Configure Agent Access to IRM Content

Step 6: Enable Document Tracking and Revocation

Step 7: Configure Label Policies

Step 8: Configure Auto-Labeling for IRM

PowerShell Configuration

Enable Azure RMS and Configure IRM

Configure SharePoint Library IRM via PowerShell

Audit IRM-Protected Document Access

Create Sensitivity Label with IRM (Microsoft Graph)

Financial Sector Considerations

Regulatory Alignment

Zone-Specific Configuration

FSI Use Case Example

Verification & Testing

Verification Steps

Compliance Checklist

Troubleshooting & Validation

Issue 1: Agent Cannot Access IRM-Protected Content

Issue 2: IRM Not Applying to Downloaded Files

Issue 3: Users Cannot Open IRM-Protected Documents

Issue 4: IRM Watermarks Not Displaying

Additional Resources

Related Controls

Support & Questions