Azure information protection custom policies not working

[Ion Zubia]

Hello,
I'm playing around with an Enterprise Mobility + E3 license and security and I was following the next tutorial/document from Microsoft: https://docs.microsoft.com/en-gb/information-protection/get-started/infoprotect-quick-start-tutorial

However, after completing every step the following error will pop up when trying to select a custom policy. I have tried creating different policies with different setups in vain:

 
 

I wonder what else is needed?

Thank you. 

[#2]

I'm getting the same error with and without firewall,   We don't see any of the templates downloaded.

 any Other help would be appreciated.

-Fermin

[#3]

One thing that worked for me after getting this error message was to go to a random Word document saved anywhere on your computer. In File Explorer, right-click the Word document and click Classify and protect to open the AIP Client. 

Next, select one of your custom labels, it shouldn't matter which one and click apply. This forces the custom label in a way that you can't do in Word. After that I was able to assign custom labels within Word after that with no issues. Hope that helps.

[#4]

I've got same problem with you today.

I created a label and a label policy in M365 Security Center (I'm using Unified Labeling client as required)

But it doesn't work well.

After hours of troubleshooting and found that I've met all of those requirements mentioned in technet docs.

But, a strange default "Archived" state of the label (template) caused my custom label to stop working.

You can try using the following commands to troubleshoot:-

Set-ExecutionPolicy Bypass
Install-Module AIPService

Import-Module AIPService

Connect-AIPService

Get-AipServiceTemplate | FL

Get-AipServiceTemplateProperty -TemplateId <xxxxxxxx> -Status  <--- this reports the custom label is at "Archived" state by default, what the hell.

To fix it:-

Set-AipServiceTemplateProperty -TemplateId <xxxxxx> -Status Published

After these, I can now apply the label in either Office apps or File Explorer

This link helped me in troubleshooting

https://docs.microsoft.com/en-us/azure/information-protection/configure-policy-templates#considerati...

@Ion Zubia 

[#5]

@Larry_ChanThanks for the update, as I have expanded my uses of Labels and Policies I encountered this and this fix one of my label issues.

[#6]

@Ion Zubia  and other in this thread

I have been following the entire thread and some of these solutions may not work. I found a solution that always works and I have tested all of the scenarios as follows:

• Improper installation of AIP Unified Labeling Client
• Improper upgrade of AIP Unified Labeling Client
• UL Client was unable to download protection template from RMS Service due to network issue
• UL Client unable to update stale protection template tokens cache stored locally in user profile

Check the following before proceeding

• User has AIP P1/P2 license
• User is logged into office App with correct account. If multiple account is used to login, please log out from all other account except the account that is supposed to use the AIP Protection.
• Ensure that there are no additional Work Account added to windows 10 other than the account using AIP Protection.

Solution 1: - Delete Crypto Keys from the effected user profile

• Close all the office apps. Word, Outlook, Excel and PowerPoint.
• On file explorer navigated to the folder "%APPDATA%\Microsoft\Crypto\" in there please rename the folder Keys to any name.
• Open Word and click on Sensitivity Icon -> Help and Feedback -> Reset Settings.
• Close Word and re-open, give couple of minutes for the UL client to retrieve labels and your Client will re-build the protection template cache too.

[#7]

You are life saver. Thank you!

[#8]

Glorious, after struggeling with the problem for 4 days your answer resolved my issues!

[#9]

Buenos días,
el problema tambien se corrige abriendo un archivo ya cifrado en el equipo con problemas. Este procedimiento forzará una configuración "pendiente o incompleta en los equipos que muestran el mensaje de error".
Al abrir un archivo ya cifrado por ejemplo un Word, este mostrará el mensaje: "Configurando el equipo para Information Rights Management ....", debemos esperar unos segundos que culmine de abrir el archivo cifrado. Una vez abierto, podemos concluir que ya termino la configuración del RMS, procedemos a cerrar el archivo cifrado y realizamos una prueba abriendo un nuevo archivo e ingresamos datos de tarjetas.
Slds