Forum Discussion

Paul_Saldanha's avatar
Paul_Saldanha
Brass Contributor
Dec 02, 2021

Sensitivity Button not showing in Office Web Apps

I am trying to understand the process for enabling the sensitivity button in Office Web Apps (Word, Excel, PowerPoint).  The following is confirmed.

 

  1. Have the correct licensing.
  2. Set-SPOTenant -EnableAIPIntegration $true is true

     

     

  3. Label is created automatically apply label when SIT is detected

I do not see the label in Word Online, nor do I see a sensitivity button.  I do now that the SIT was detected because the file is protected with a DLP policy.

What I don't get is why the sensitivity button and corresponding labels aren't in the web app if the integration is set to true.  After reading this ( https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-teams-groups-sites?view=o365-worldwide#enable-this-preview-and-synchronize-labels) and this (https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files?view=o365-worldwide#use-powershell-to-enable-support-for-sensitivity-labels) many times, I think that the set-spotenant is only required for the web apps integration.  However, if this step is required along with other configuration for integrating labels with groups and sites. Correct?

 

I feel I am missing something obvious here but I cannot find it.  All I need at the moment is the Office Web Apps integration.

  • MarcinUK ChristianJBergstrom Mitul_Pansuriya 

    Sorry for the radio silence. Dealing with a family emergency.
    After banging my head on the wall a few things happened:

    1. After about 5 days, the sensitivity button showed up in the Office Web Apps.  I didn't do anything different from when I first posted my question.
    2. I had reached out to CDX Support (through the partner site) for help.  That was very slow and not fruitful but I did get an out-of-the-blue email from someone stating that they had uncovered a bug in the CDX tenants and were applying a fix to my tenant.  This was after the button showed up in one CDX tenant and not in the other CDX tenant.  The button is in both tenants now.  I can't say for certain that the "fix" had anything to do with anything since I had the button prior to receiving the email from Support.
    3. I learned that there are different SLAs for the CDX tenants.  These SLAs are not published but they can be throttled arbitrarily.  Maybe this is what is going on?  Colleagues spun up a MSDN tenant and clicked on the yellow highlighted text (instead of using the Set-SPOTenant) and it configured the button in the documented 15 minutes.
    4. I had to log out of the tenant and sign back in to see the change.
  • HiPaul_Saldanha ,

    There may be some commands that you try to run but they fail, giving you errors like "term not recognized," "object not found," or "command cannot be executed because running script is disabled."
    In this case, just use the below command to get around the running script and run the instructions.

    1> Verify that the user has the necessary licenses for AIP by checking their licenses.

     

    2> Typically, this occurs when AIP is not connected to SPO (Sharepint Online). In this situation, you must enable AIP and SPO integration. To do this, follow the procedures below:

     

    On your computer, launch a Windows PowerShell window. with administrative rights

     

    Execute these commands: 

    - Install-Module -Name Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser

    - Update-Module -Name Microsoft.Online.SharePoint.PowerShell

    - Connect-SPOService -Url https://msdxXXXXX-admin.sharepoint.com -Credential email address removed for privacy reasons

     

    (Here Url: yoursharepointlink-admin.sharepoint.com , Credentials: credential of global admin)
    ( Eg: Contoso- admin.sharepoint.com , Credential: email address removed for privacy reasons)

     

    - Set-SPOTenant -EnableAIPIntegration $true
    Once this command has been executed, AIP and SPO Integration is enabled.

    - Get-SPOTenant
    You can check here to see if EnableAIPIntegration is now true.

     



  • Although this specific question was answered, there is solid guidance in the Microsoft 365 Admin Center on the general topic of MIP deployment, including configuration of Sensitivity Labels so that they work for Office Web Apps.

     

    If you are an IT Admin with access to the Admin Center, and you are planning or deploying Microsoft Information Protection (MIP) (or would like to review your deployment), be sure to check-out the MIP setup guide.

     

    The setup guide simplifies MIP deployment, with steps in chronological order, including automating some deployment steps.

     

    If you do not have access to the Admin Center, similar content (with less automation) can be found at the  MIP setup guide, located at the assistants.microsoft.com M365 Deployment site.

  • Hello, I get that this can be confusing. Yes, the EnableAIPIntegration is only for enabling sensitivity labels for Office files in SharePoint and OneDrive. When you want to add labels on containers too you use the $Setting["EnableMIPLabels"] = "True" in the group setting for the org. (containers are groups, team sites, teams, SharePoint sites).

    When it comes to the issue you are having now I believe you might not have published your labels? See this article https://support.microsoft.com/en-us/office/known-issues-with-sensitivity-labels-in-office-b169d687-2bbd-4e21-a440-7da1b2743edc

    Other than that just go through the prereqs and limitations https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-files?view=o365-worldwide#requirements
    • Paul_Saldanha's avatar
      Paul_Saldanha
      Brass Contributor

      ChristianJBergstrom 
      Thanks for the reply and the confirmation that I only need the set-spotenant command.  I wish the docs delineated this more.
      So I am currently testing in a demo Contoso tenant. The labels were already published to the user and I republished them about 1.5 hrs before your response (about an hour after I posted the question). Perhaps I am in the requisite 24hr waiting period (I did not change any labels)?

       

       

Resources