Forum Discussion
Logs not available for PDF applied with sensitivity label
We created sensitivity labels for files and can apply them to files (docx, xlsx, pdf). However, we found that there were no activity logs for PDF in activity explorer nor in audit search. Activity logs were available for MS office documents (docx, xlsx). Is there any way we can enable logging for PDF documents with labelled content?
Thanks
Hi JamesY650
While sensitivity labels can be applied to PDFs similarly to Office files, labeling activity for PDFs is currently not captured in Activity Explorer or the Unified Audit Logs. This is a known limitation and cannot be addressed through configuration. It's important to note that Activity Explorer does track labeling events—such as label applied, changed, or removed—for supported file types, but PDFs are not among them at this time.
That said, there are a few workarounds depending on how you're labeling and storing your PDFs:
-If you're using the AIP unified labeling client:
You can use the Azure Information Protection (AIP) Unified Labeling client and AIP Scanner to apply and monitor sensitivity labels on PDFs. When configured correctly, these tools can generate audit events that include who applied the label, when it was applied, and the file name and location. These events are typically visible in the Microsoft 365 Unified Audit Log and Activity Explorer—though support may vary depending on the labeling method and environment. This approach is especially useful in on-premises or hybrid scenarios where the AIP Scanner is deployed to scan and label files across network shares or SharePoint libraries.
-If your PDFs are stored in Microsoft 365 (e.g., SharePoint, OneDrive):
You can use Microsoft Defender for Cloud Apps to create file policies that detect classification labels on PDFs and trigger alerts or actions.
-For local or custom environments:
Some organizations use PowerShell scripts or third-party tools to scan file metadata for label IDs and timestamps.
So while native logging for PDFs in Activity Explorer and audit logs isn’t available yet, there are still ways to get visibility depending on your setup.
I hope that helps!
Brian
😎 ✌️🎸
2 Replies
Thanks. It does help!
BrianStephenMicrosoft
Hi JamesY650
While sensitivity labels can be applied to PDFs similarly to Office files, labeling activity for PDFs is currently not captured in Activity Explorer or the Unified Audit Logs. This is a known limitation and cannot be addressed through configuration. It's important to note that Activity Explorer does track labeling events—such as label applied, changed, or removed—for supported file types, but PDFs are not among them at this time.
That said, there are a few workarounds depending on how you're labeling and storing your PDFs:
-If you're using the AIP unified labeling client:
You can use the Azure Information Protection (AIP) Unified Labeling client and AIP Scanner to apply and monitor sensitivity labels on PDFs. When configured correctly, these tools can generate audit events that include who applied the label, when it was applied, and the file name and location. These events are typically visible in the Microsoft 365 Unified Audit Log and Activity Explorer—though support may vary depending on the labeling method and environment. This approach is especially useful in on-premises or hybrid scenarios where the AIP Scanner is deployed to scan and label files across network shares or SharePoint libraries.
-If your PDFs are stored in Microsoft 365 (e.g., SharePoint, OneDrive):
You can use Microsoft Defender for Cloud Apps to create file policies that detect classification labels on PDFs and trigger alerts or actions.
-For local or custom environments:
Some organizations use PowerShell scripts or third-party tools to scan file metadata for label IDs and timestamps.
So while native logging for PDFs in Activity Explorer and audit logs isn’t available yet, there are still ways to get visibility depending on your setup.
I hope that helps!
Brian
😎 ✌️🎸
