Office 365 Message Encryption – Transition to AIP

A typical part of the migrations I work on with my clients is enabling Encryption. The encryption for their emails could be a replacement for a current solution like Iron Mail or PGP. The clients typically want to encrypt confidential emails to their customers, partner organizations or clients.
I am rather familiar with the process that’s been supported for the past 3 or 4 years. Presented on it internally to my team as well as to the user group I run MMCUG and regularly refer to this GREAT blog post when I forget some of the details. It’s an excellent read.
Microsoft Announcements?
Microsoft has documented it’s intent to change the process and capabilities of email encryption in Exchange online with posts like these:
https://technet.microsoft.com/en-us/library/dn151475%28v=exchg.150%29.aspx?f=255&MSPPError=-2147217396
https://support.office.com/en-us/article/office-365-message-encryption-faq-0432dce9-d9b6-4e73-8a13-4a932eb0081e

Change?
Before Microsoft made the changes, the classic Exchange Online transport rule creation would look something like this:

Now, with the integration with Rights Management, we get something like this:

What does this exactly mean in terms of usage and capabilities? It means that we can either use the original OME method of just encrypting the message, or we can also apply Rights Management to the same encrypted message. Simply put, this is an extension or added functionality that an organization can use when securing messages to recipients external to their organization.
What other changes are there?
In addition combining Rights Management with message encryption, we also have a change for the end-user as well as integration with Google or Yahoo users.
(1) End User – OWA Changes
If the majority of your users are in OWA and their mailbox is in Office 365, there is a new button available that will allow the end-user to encrypt their messages. The encryption process does not rely on a transport rules unless that user is using Outlook only. In that case a transport rule would still need to be used:

(2) Messages sent to Google and Yahoo accounts can use their identities to access their emails and no longer need to use a Microsoft account.
Additional Reading
https://techcommunity.microsoft.com/t5/Security-Privacy-and-Compliance/Bringing-deeper-integration-and-new-capabilities-to-Office-365/ba-p/109409