Hello,I'm playing around with an Enterprise Mobility + E3 license and security and I was following the next tutorial/document from Microsoft: https://docs.microsoft.com/en-gb/information-protection/get-started/infoprotect-quick-start-tutorial However, after completing every step the following error will pop up when trying to select a custom policy. I have tried creating different policies with different setups in vain: I wonder what else is needed? Thank you.

In addition to checking the firewall isn't blocking IP addresses and URLs, check it's not terminating your TLS connection, which breaks certificate pinning. I've added a tip how to check for this client-side, if you don't manage the firewall yourself. See https://docs.microsoft.com/en-us/information-protection/get-started/requirements#firewalls-and-network-infrastructure

Azure information protection custom policies not working

27 Replies

subhendudas
Copper Contributor
Aug 25, 2020
Ion Zubia and other in this thread
I have been following the entire thread and some of these solutions may not work. I found a solution that always works and I have tested all of the scenarios as follows:
Improper installation of AIP Unified Labeling Client
Improper upgrade of AIP Unified Labeling Client
UL Client was unable to download protection template from RMS Service due to network issue
UL Client unable to update stale protection template tokens cache stored locally in user profile
Check the following before proceeding
User has AIP P1/P2 license
User is logged into office App with correct account. If multiple account is used to login, please log out from all other account except the account that is supposed to use the AIP Protection.
Ensure that there are no additional Work Account added to windows 10 other than the account using AIP Protection.
Solution 1: - Delete Crypto Keys from the effected user profile
Close all the office apps. Word, Outlook, Excel and PowerPoint.
On file explorer navigated to the folder "%APPDATA%\Microsoft\Crypto\" in there please rename the folder Keys to any name.
Open Word and click on Sensitivity Icon -> Help and Feedback -> Reset Settings.
Close Word and re-open, give couple of minutes for the UL client to retrieve labels and your Client will re-build the protection template cache too.
Larry_Chan
Copper Contributor
Sep 20, 2019
I've got same problem with you today.

I created a label and a label policy in M365 Security Center (I'm using Unified Labeling client as required)
But it doesn't work well.

After hours of troubleshooting and found that I've met all of those requirements mentioned in technet docs.

But, a strange default "Archived" state of the label (template) caused my custom label to stop working.

You can try using the following commands to troubleshoot:-

Set-ExecutionPolicy Bypass
Install-Module AIPService
Import-Module AIPService
Connect-AIPService
Get-AipServiceTemplate | FL
Get-AipServiceTemplateProperty -TemplateId <xxxxxxxx> -Status <--- this reports the custom label is at "Archived" state by default, what the hell.

To fix it:-
Set-AipServiceTemplateProperty -TemplateId <xxxxxx> -Status Published

After these, I can now apply the label in either Office apps or File Explorer

This link helped me in troubleshooting
https://docs.microsoft.com/en-us/azure/information-protection/configure-policy-templates#considerations-for-templates-in-the-azure-portal

Ion Zubia
- Daught995
  Copper Contributor
  Dec 18, 2021
  Glorious, after struggeling with the problem for 4 days your answer resolved my issues!
- imrinder
  Copper Contributor
  Dec 13, 2021
  You are life saver. Thank you!
- JeremyLeirmo
  Copper Contributor
  Sep 20, 2019
  Larry_ChanThanks for the update, as I have expanded my uses of Labels and Policies I encountered this and this fix one of my label issues.
bbbab_angel
Copper Contributor
Mar 22, 2019
One thing that worked for me after getting this error message was to go to a random Word document saved anywhere on your computer. In File Explorer, right-click the Word document and click Classify and protect to open the AIP Client.

Next, select one of your custom labels, it shouldn't matter which one and click apply. This forces the custom label in a way that you can't do in Word. After that I was able to assign custom labels within Word after that with no issues. Hope that helps.
Pablo R. Ortiz
Iron Contributor
Jan 16, 2018
Please try uninstalling the client and installing again from this Url
https://www.microsoft.com/en-us/download/details.aspx?id=53018
Select and run AzInfoProtection.exe
- Ion Zubia
  Brass Contributor
  Jan 17, 2018
  Hello Ortiz,
  
  I'm afraid that didn't work, I originally used this installer by the way.
  
  Looking at Microsoft's documentation, and as far as I know, it should be working as it is but I can't get it to work. Any ideas? Could something in the computer set-up be affecting the client?
  
  Thank you for the help :)
  - Pablo R. Ortiz
    Iron Contributor
    Jan 17, 2018
    Please try the following to completely remove AIP client:
    
    1. Uninstall AzIP client either in control panel or by running AzInfoProtection.exe /uninstall
    
    2. Access Registry (RegEdit.exe) and delete: HKEY_CURRENT_USER\Software\Microsoft\MSIP
    
    3. Clear IE cookies
    
    4. Delete folder: C:\Users\<user name>\AppData\Local\Microsoft\MSIP
    
    5. Clear Windows credentials and sign-out of Office account
    
    6. Restart and run AzInfoProtection.exe again

Forum Discussion

Azure information protection custom policies not working

27 Replies

Resources