In rolling out RMS to the enterprise, PDFs often come up. They are an important file format, often seen as a ‘universal’ read-only format, and PDF readers are plentiful and free. Additionally it is also a format used to attempt to control information – marking it read only, watermarking, etc.

So end users often ask:

  • How do I protect PDFs with RMS?
  • How do I open protected PDFs?
  • More specifically, why does Microsoft Office 365 offer a way to RMS-protect PDFs without also offering a compatible client application?

Unfortunately, there are no straightforward answers to these questions, and RMS support for PDFs is inconsistent with the rest of the Microsoft product suite. In order to plan the enterprise introduction and adoption of RMS, it helps to review the historical background and roadmap to understand the quirks and future direction, insofar as that is possible.

Historical background 

The two formats for producing RMS-protected PDFs are Protected PDF (also called PDF v1) – created by Foxit – and PPDF – created later by Microsoft for the RMS Sharing Application. With the Foxit server-side plugin, RMS protection can be added to on-premise SharePoint 2010 and 2013 instances. In fact, Microsoft white-labels the Foxit server-side plugin to protect files in SharePoint 2013 out-of-the-box. Microsoft Office 365 SharePoint Online (SPO) is based on SharePoint 2013 and thus shares the same RMS protection module. This explains why PDFs are protected using different methods between SPO and the RMS Sharing Application.

Office 365 user experience 

In Office 365MT, PDFs are protected along with Office documents (Word, Excel, PowerPoint) in RMS-enabled SPO libraries and OneDrive for Business, which is based on the SharePoint platform.  However, PDFs cannot be protected in Exchange Online, OWA, Outlook, Office Online, or Office native applications (Word, Excel, PowerPoint). Also, RMS-protected PDFs downloaded from SPO and opened locally in a typical, unenlightened native client (Microsoft Word or Adobe/Foxit/Nitro/etc. without supplemental plugins) will display a landing page or splash screen stating that protected content cannot be read without a compatible application. This landing page is not customizable in Office 365. Given that there is no browser preview of RMS-protected PDFs or other server-side rendering, this can be quite confusing for users. For enterprise users, following a download link to expiring free trial software is not a viable solution, and they know it.

The right answer for now is to have an RMS-enlightened native client application that supports RMS-protected PDFs for your end users, and possibly even external partners. Microsoft partner solutions are available from Foxit, NitroPDF, GigaTrust, etc., though these do not necessarily fix the end-to-end UX. rms:anywhere® uses PPDF when protecting documents, so you can leverage the free RMS Sharing Application as a PPDF reader.

Future direction

According to Microsoft product team roadmap hints, the RMS Sharing Application will extend support beyond PPDFs to cover Protected PDFs as well, such as those produced by SPO or on-premise SharePoint 2013. This ‘all-Microsoft’ solution (Office 365 + RMS Sharing Application) could provide a cleaner UX and free up budget.

2017 Update: Microsoft released the free Azure Information Protection (AIP) Viewer that supports PDFs downloaded from RMS-enabled Office 365 SPO.

Roll-out considerations

Some considerations when rolling out an RMS-enlightened client-side application to your enterprise:

  • Cover your whole population or perform a focused deployment to users of RMS?
  • Replace your existing PDF reader or deploy an alternative, non-default application to limit short-term user disruption?
  • Disable or replace in-browser PDF readers/plugins (e.g., Chrome ships a version of Foxit reader embedded as a plugin)?
  • Deploy RMS Sharing Application to cover ad hoc RMS protection of PDFs in the PPDF format? Note that today the RMS Sharing Application support for .PPDF does not conflict with the existing .PDF extension.
  • Mitigation plan for handling user confusion with the Office 365 SPO ‘landing page’? User confusion can be heightened by the above decisions.