.png)
Manage super users for rights managed content
Published: July 16, 2012
Updated: July 16, 2012
Applies To: Office 365
This topic shows how to manage the super user feature using the Windows Azure AD Rights Management module for Windows PowerShell. With this feature enabled, you can add, list or remove super users for the Rights Management service.
About the super user feature
The Rights Management super users group is a special group that has full control over all rights-protected content managed by the Rights Management service. Its members are granted full owner rights in all use licenses that are issued by the subscriber organization for which the super users group is configured. This means that members of this group can decrypt any rights-protected content file and remove rights-protection from it for content previously protected within that organization.
By default, the super users feature is not enabled and no groups or users are assigned membership to it.
Enabling and disabling the super user feature
The following demonstrates how to enable the super user feature for your organization with the Rights Management service:
Enable-AadrmSuperUserFeature
 Caution |
|---|
| Enabling the super users feature should be done only on an as-needed basis. During normal operations, the super users feature should be disabled, unless it is used to provide a trusted application with the ability to decrypt rights-protected content, such as to enable the application to scan the content for malware. It should be enabled only when necessary. |
To disable the super user feature for your organization, the following cmdlet is used:
Disable-AadrmSuperUserFeature
Adding a super user
The following demonstrates how to add a super user for the Rights Management service by specifying the email address to identify a user object to be granted super user rights:
Add-AadrmSuperUser -EmailAddress "user1@contoso.com"
Additional information
The SuperUser group is a special group that has full control over all rights-protected content managed by the Rights Management service for your organization. Its members are granted full owner rights in all use licenses that are issued by the account using the Rights Management service on which the super users group is configured. This means that members of this group can decrypt any rights-protected content file and remove rights-protection from it.
List all super users
The following demonstrates how to list all the super users for the Rights Management service:
Get-AadrmSuperUser
Removing a super user
The following demonstrates how to remove a role-based administrator for the Rights Management service by specifying the email address to identify a user object to be removed from the list of super users:
Remove-AadrmSuperUser -EmailAddress "user1@contoso.com"
