Skip to main content

Basic FAQ about SHIELD DRM

Q1. What is SHIELD DRM?​

Cloud Native DRM (Digital Rights Management) service that provides document security in Microsoft 365 and Google Workspace environments.

  • Microsoft 365— Automatically converts existing DRM documents to MIP (Microsoft Information Protection) documents to enable cloud collaboration (viewing/editing/co-authoring).
  • Google Workspace— Detects changes in Google Drive and enables cloud collaboration by removing the encryption of DRM documents according to conditional policies.

Q2. What are the main features?​

  • Conditional Policy-Based Automatic Enforcement (Applied based on conditions such as User · Group, Network Location, Document Type, etc.)
  • Providing compatibility with existing DRM documents (including BYOK/HYOK)
  • Policy Linkage and Operational Visibility (Policy Establishment · Application Linkage)
  • Integration Targets — Microsoft 365 (Teams / OneDrive / SharePoint), Google Workspace (Google Drive's My Drive · Shared Drives)

DRM ↔ MIP conversion is a feature exclusive to the Microsoft 365 environment.

Q3. What is the actual usage flow?​

Microsoft 365

When you upload a file to Teams/OneDrive/SharePoint, the MIP label will be automatically applied after a certain period of time.
When applied, the modifier will show 'SharePoint app', and at the bottom of the document, 'Protected by SHIELD DRM' will be displayed.
You can upload and use the DRM document immediately without any release.

Google Workspace

When you upload a file to Google Drive (My Drive · Shared Drive), the event channel installed on that drive detects the change and evaluates the conditional policy.
If it is a policy target, lock the document, then decrypt it, and unlock it to reflect it in the same file.
DRM documents can be uploaded and used immediately without release, and at the time the document is downloaded to the local PC, Document Security reapplies DRM protection.

Google Workspace environment does not provide automatic encryption at the time of upload and label conversion. Policies do not operate on drives where the event channel is not installed, and newly created shared drives are not automatically detected.

Q4. What should be prepared before the introduction?​

Common

(1) Security365 Portal Sign Up/Settings
(2) Registering Allowed URLs in the Firewall

Microsoft 365

(1) Administrator Permissions/License (Global Administrator·E3 Recommended)
(2) MIP Label Creation/Publication
(3) Confirm Tenant Name

Google Workspace

(1) Super Admin 권한
(2) Enable Google Drive API in Google Cloud Project
(3) Create Service Account and Approve Domain-Wide Delegation
(4) Add the service account as a member with participant or higher privileges to the shared drive to be used as the policy target.

Q5. What is Microsoft Throttling and what impact does it have?(Microsoft 365)​

Throttling is a mechanism by which Microsoft applies rate limiting to API requests, queries, networks, etc., for service stability and fair usage.
Since it may be limited during bulk processing/bursting, operational considerations such as retry and backoff strategies are necessary.

Q6. SharePoint Add-In is being discontinued, how should we respond?(Microsoft 365)​

Microsoft will terminate ACS (Azure Access Control Service) and SharePoint Add-In on 2026-04-02.
Accordingly, it should be switched to the Event Receiver method, and the migration procedure of the SHIELD DRM admin page (check → consent → execute) will be transitioned.

Q7. What is the Google Drive API quota and what impact does it have?(Google Workspace)​

Google Drive API applies request quotas on a project and user basis. If the quota is exceeded, a 429 or 403rateLimitExceededThe response is returned, and SHIELD DRM detects this and automatically retries with an index backoff.
Also, the change notification channel registered with the drive has a maximum validity period of 7 days, so it will be automatically re-registered before expiration.
If a large number of changes occur at once, the change history retrieval may be delayed, which can result in a late reflection of the policy.

Authentication/Integration​

Q8. Where can I check the 'App authentication information (App ID + App Secret)', and how do I apply it in the DS management console?(Microsoft 365)​

Admin Page → Settings → App Credentials에서 표시되는 App ID와 App Secret이 결합된 Security Token을 복사해, DS Management Console의 Custom Policys365_app_dataUse it by pasting it into the item.

  • Applicable Version (DS Console Module)
  • SCPD_DS365.dll6.0.3.24 or higher
  • SCPD_DS36564.dll6.0.3.24 or higher

Google Workspace integration authenticates using a service account and domain-wide delegation instead of app credentials.