This document outlines how to use Exchange Online to classify and secure email messages. It discusses creating message classifications in Exchange Online PowerShell and transport rules to apply actions based on the classification. For example, encrypting messages classified as external confidential and blocking messages with no classification sent externally. The presentation demonstrates exporting classifications, deploying them to Outlook clients via Group Policy, and using a demo to show the process in action. Other options for classification like Azure Information Protection are also mentioned.

1. 1
Slide
1
Using Exchange Online to
Classify and Secure Mail
Steve Goodman

2. 2
Slide
2
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Using Exchange Online to Classify and Secure
Mail
• Our example scenario
• Creating Message Classifications
• Creating Transport Rules
• Other options outside of Exchange Online

3. 3
Slide
3
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Our example scenario
• Goodman Enterprises manufactures components
used in the aerospace industry
• They have a problem with emails being accidentally
sent to external senders and want people to specify
the type of message it is before it can be sent:
• A user must select a category for mail if it will be
sent externally or it will be rejected
• If the user selects “External Unrestricted” the
message will be allowed to be sent to an external
sender.
• If the user selects “External Confidential” the
message will be encrypted with Office 365
Message Encryption to external senders.

4. 4
Slide
4
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
What are message classifications and why are
they useful?
• Message Classifications allow us to provide an interface for
users to provide additional information about the message they
are sending
• These are exposed to the user in OWA or Outlook
• When a message is sent the classification is retained
• Logic can be applied with Transport Rules to perform specific
actions, like block the message, or protect it

5. 5
Slide
5
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Creating Message Classifications
• Message Classifications are created using Exchange Online
PowerShell.
New-MessageClassification -Name ExtUnrestricted -DisplayName "External Unrestricted" -
SenderDescription "Contains no sensitive content and can be sent to external recipients"
New-MessageClassification -Name ExtConfidential -DisplayName "External Confidential" -
SenderDescription "Contains confidential content and will be encrypted using Office 365
Message Encryption when sent to external recipients"

6. 6
Slide
6
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Message Classifications User Experience

7. 7
Slide
7
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Deploying Classifications to Outlook Clients
• An XML file needs to be deployed to clients
• This can be deployed using Group Policy and is supported by
Outlook 2007, 2010, 2013 and 2016

8. 8
Slide
8
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Exporting Message Classifications
$classifications = Get-MessageClassification
$holder = "<?xml version=`"1.0`" ?>`n<Classifications>`n"
if ($classifications)
{
foreach ($i in $classifications)
{
if ($i.RetainClassificationEnabled)
{
$retain = "`n`t`t<AutoClassifyReplies/>"
}
else
{
$retain = ""
}
$displayName = $i.DisplayName
$description = $i.SenderDescription
$id = $i.ClassificationID
$holder +=
"`t<Classification>`n`t`t<Name>$displayName</Name>`n`t`t<Description>$description</Description>`n`t`t<Guid>$id</Guid>$retain`n`t</Classifica
tion>`n"
}
}
$holder += "</Classifications>`n"
$holder > MessageClassifications.xml

9. 9
Slide
9
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Registry Import
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USERSoftwareMicrosoftOffice12.0CommonPolicy]
"AdminClassificationPath"="%PUBLIC%MessageClassifications.xml"
"EnableClassifications"=dword:00000001
"TrustClassifications"=dword:00000001
[HKEY_CURRENT_USERSoftwareMicrosoftOffice14.0CommonPolicy]
"AdminClassificationPath"="%PUBLIC%MessageClassifications.xml"
"EnableClassifications"=dword:00000001
"TrustClassifications"=dword:00000001
[HKEY_CURRENT_USERSoftwareMicrosoftOffice15.0CommonPolicy]
"AdminClassificationPath"="%PUBLIC%MessageClassifications.xml"
"EnableClassifications"=dword:00000001
"TrustClassifications"=dword:00000001
[HKEY_CURRENT_USERSoftwareMicrosoftOffice16.0CommonPolicy]
"AdminClassificationPath"="%PUBLIC%MessageClassifications.xml"
"EnableClassifications"=dword:00000001
"TrustClassifications"=dword:00000001

10. 10
Slide
10
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Group Policy

11. 11
Slide
11
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Creating Matching Transport Rules
• Create two matching transport rules to apply the business logic.
Name If Then
Encrypt External Confidential Messages Message Classification = External Confidential
And
Recipient is Located = Outside the Org
Encrypt the message with Office 365 message
encryption
Block External Messages with no classificaton The message properties don’t include a classification
and
Recipient is Located = Outside the Org
Reject the message with the reason = “A message
classification must be chosen for messages with an
external recipient.”

12. 12
Slide
12
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Creating Matching Transport Rules

13. 13
Slide
13
Follow us:
#O365ENGAGE17
Demo

14. 14
Slide
14
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Other options available
• Third party products (e.g.
TITUS)
• Azure Information Protection
Plan 2
• Native support for
classifications across Office
365, including Office
documents
• Detected using similar transport
rule methods

15. 15
Slide
15
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Related Sessions
• Mastering Office 365 Data Governance, Today at 16:00, Room
B, Alan Byrne
• What’s New in Office 365 Security, Thursday at 10:45, Room B,
Vasil Michev

16. 16
Slide
16
Using Exchange Online to Classify and Secure Mail | Steve Goodman | 13:55 - 14:15 20th June
Follow us:
#O365ENGAGE17
Questions? | Thank You
Steve Goodman
steve@stevieg.org
We’d like to know what you think!
Please fill out the evaluation form you
received at the registration desk for this
session
Session recordings and materials:
Materials will be available on
Office365Engage.com soon