How to migrate to Azure Information Protection from other labeling solutions

[Hen David]

Classification and labeling solutions are important tools for organizations to get control over their data, understand where their data resides, the sensitivity of documents and apply actions based on the information’s sensitivity, such as applying encryption.

Some of organizations have already implemented classification and labeling solutions in the past for their unstructured documents (like Secure Islands IQP for example) and are now looking to migrate from another labeling solution to Azure Information Protection to enjoy the benefit of having a labeling solution that is highly integrated with their Office 365 environment and integrates with a growing ecosystem of 3^rd-party solutions, such as Adobe Acrobat reader, among many others.

For such organizations it’s important to have the ability to leverage the existing labeled documents and have these labels automatically converted to the labeling used in Azure Information Protection.

Usually the document label is stored as metadata in the form of a Custom Property within the document itself.
The Azure Information Protection client can be configured to pick-up the Custom Property, and Azure Information Protection admins can create a mapping between the old labels and the new Azure Information Protection labels.

There are a few things you should be aware of when implementing this:

1. This configuration uses an advanced client setting that you must configure in the Azure portal.
2. This configuration is currently not compatible with the new default behavior that protects PDF files by using the ISO standard for PDF encryption. In this scenario, .ppdf files cannot be opened by File Explorer, PowerShell, or the Azure Information Protection scanner. To resolve this, use the advanced client setting to not use the ISO standard for PDF encryption.
3. This feature is currently only available on Windows running the Azure Information Protection client and at a later stage will be supported with the unified labeling client for Windows. This functionality is not implemented in the native sensitivity labeling experience in the Office apps.
4. If you have files other than PDF and Office documents that are protected by Secure Islands, these can be relabeled after you edit the registry as described in the preceding section.

When setting up the below configuration, the new Azure Information Protection label is applied by the Azure Information Protection client as follows:

• For Office documents: When the document is opened in the desktop app, the new Azure Information Protection label is shown as set and is applied when the document is saved.
• For File Explorer (Right Click -> Classify and Protect experience): In the Azure Information Protection dialog box, the new Azure Information Protection label is shown as set and is applied when the user selects Apply. If the user selects Cancel, the new label is not applied.
• For PowerShell: Set-AIPFileLabelapplies the new Azure Information Protection label. Get-AIPFileStatus doesn't display the new Azure Information Protection label until it is set by another method.
• For the Azure Information Protection scanner: Discovery reports when the new Azure Information Protection label would be set and this label can be applied with the enforce mode.

Mapping old labels to Azure Information Protection labels in documents

To be able to setup a mapping between the old labels and the new Azure Information Protection labels, the admin should follow these steps:

1. Identify the Custom Properties added by the old labeling solution.
2. Define the logical mapping between the old labels by the Custom Property and the new Azure Information Protection labels by the Azure Information Protection label ID.
3. Configure the AIP Advanced Settings to identify the old labels and apply the new Azure Information Protection labels.

Identify the Custom Properties added by the old labeling solution

1. Open a file labeled by the old solution and navigate to the Advanced Properties section
   
2. Navigate to the Custom tab and identify the added property name and the value. In our example, the Custom Property added by the old solution is “Classification” and the value is “Internal”
   
3. Identify the rest of the label names available from your previous solution (the possible values of the above “Classification” Custom Property).This can be done by opening different already labeled documents OR by getting this information from the management portal of the old solution if available.

4. By now, you should have the knowledge about the old label custom property name and all the possible values (previously configured labels). For example:

• Custom Property name: “Classification”
• Custom Property values (old labels): “Public”, ”Internal” ,”Confidential”, ”Secret”

Define the logical mapping between the old labels by the Custom Property and the new Azure Information Protection labels by the Azure Information Protection label ID.

1. Identify the Azure Information Protection label IDs that you would like to map from the Azure Information Protection portal
   1. In the Azure Information Protection admin console (https://aka.ms/AIPConsole), select Labels in the blade on the left, and then click the label you want to create the mapping for
   2. Copy the label ID located at the bottom of the page to a document for use later.

      Repeat this for each label in the target and source tenant you wish to create a mapping for.

2. By now you should have all the Azure Information Protection label names and ID. For example:
   1. “Pubic” Label ID 11ba5c36-b7cf-1234-bbc2-bd5b3a9f9511
   2. “General” Label ID 22ba5c36-b7cf-1234-bbc2-bd5b3a9f9522
   3. “Confidential” Label ID 33ba5c36-b7cf-1234-bbc2-bd5b3a9f9533
   4. “Secret” Label ID 44ba5c36-b7cf-1234-bbc2-bd5b3a9f9544

3. Now you can create the logical mapping between the old labels and the new Azure Information Protection labels. For example:

Old label Custom Property Name	Old label Custom Property Value (Old label name)	Azure Information Protection equivalent label name	Azure Information Protection equivalent label ID
Classification	Public	Public	11ba5c36-b7cf-1234-bbc2-bd5b3a9f9511
Classification	Internal	General	22ba5c36-b7cf-1234-bbc2-bd5b3a9f9522
Classification	Confidential	Confidential	33ba5c36-b7cf-1234-bbc2-bd5b3a9f9533
Classification	Secret	Highly Confidential	44ba5c36-b7cf-1234-bbc2-bd5b3a9f9544

Configure the Azure Information Protection Advanced Settings to identify the old labels and apply the new Azure Information Protection labels.

This configuration requires you to specify an advanced client setting named LabelbyCustomProperty for each Azure Information Protection label that you want to map to the old label. Then for each entry, set the value by using the following syntax:

[Azure Information Protection label ID],[migration rule name],[Old custom property name],[Specific label name OR Regex value matching the old custom property values (label names)]

In our example we will create 4 new Advanced Setting entries – one for each of the labels.

Specify your choice of a migration rule name. Use a descriptive name that helps you to identify how one or more labels from your previous labeling solution should be mapped to an Azure Information Protection label. The name displays in the scanner reports and in Event Viewer.

To configure the Azure Information Protection Advanced setting:

1. Connect to the Azure Information Protection portal and navigate to the Policies tab
2. Decide to which scope you would like to have this automatic mapping apply to. You can apply it to the global policy for everyone in your organization to have this feature enabled, or scope it for a specific audience (usually used for testing purposes)
3. Right click on the relevant policy and click Advanced Settings

4. In the Advanced Settings blead, you should create 4 new entries with the name LabelbyCustomProperty, and the value based on the syntax above.
   in our 4-label taxonomy example, the 4 entries would look like the following

Advanced Setting Name	Value
LabelbyCustomProperty	11ba5c36-b7cf-1234-bbc2-bd5b3a9f9511,"Old Public label mapping",Classification,Public
LabelbyCustomProperty	22ba5c36-b7cf-1234-bbc2-bd5b3a9f9522,"Old Internal label mapping",Classification,Internal
LabelbyCustomProperty	33ba5c36-b7cf-1234-bbc2-bd5b3a9f9533,"Old Confidential label mapping",Classification,Confidential
LabelbyCustomProperty	44ba5c36-b7cf-1234-bbc2-bd5b3a9f9544,"Old Secret label mapping",Classification,Secret

5. Click Save and Close to save the new configuration.
6. Now, you can try and open an old labeled document and if the configuration was done properly, the Azure Information Protection client will be able to present you the relevant mapped Azure Information Protection label based on the old label.
   1. When testing, make sure to first close all Office applications and then reopen to make sure the new configuration is being used.
   2. Note that only users that have permissions to change the opened document will be able to use this feature. If the user does not have permissions to edit the document, the Azure Information Protection client will not be able to actually save the new Azure Information Protection

Advanced label mapping settings

In the above example we have presented the most common migration scenario we see configured (1-to-1 mapping between the old label taxonomy and the new Azure Information Protection label).

Although this is relevant for most organizations, sometimes there are cases in which an organization has more than 1 label from the old taxonomy that they would like to associate with a specific Azure Information Protection label.

Usually this situation is one of two scenarios:

1. The old labeling system had multiple labels that contain the same label name, like:
   1. Confidential – HR
   2. Confidential – Finance
   3. …..

For such cases, the Azure Information Protection Advanced Settings supports a Regex value that can be configured to map all labels that start with “Confidential” to a specific Azure Information Protection label by using the “.*” wildcard at the end.

[Azure Information Protection label ID],[migration rule name],[Old custom property name],[Specific label name OR Regex value matching the old custom property values (label names)]

Advanced Setting Name	Value
LabelbyCustomProperty	11ba5c36-b7cf-1234-bbc2-bd5b3a9f9511,"Old Confidential label mapping",Classification,Confidential.*

2. There are other old labels\tags that needs to be mapped to Azure Information Protection labels, such as:
   1. PCI
   2. PII
   3. ProjectX

In our example we will associate such labels with the “Secret” label. For such a scenario, you should add another Advanced Setting entry to map each of these labels to the “Secret” label.

Advanced Setting Name	Value
LabelbyCustomProperty	11ba5c36-b7cf-1234-bbc2-bd5b3a9f9511,"Old PCI label mapping",Classification,PCI
LabelbyCustomProperty	11ba5c36-b7cf-1234-bbc2-bd5b3a9f9511,"Old PII label mapping",Classification,PII
LabelbyCustomProperty	11ba5c36-b7cf-1234-bbc2-bd5b3a9f9511,"Old ProjectX label mapping",Classification,ProjectX

Conclusion

Azure Information Protection enables you to easily migrate from a previous labeling\tagging solution to Azure Information protection by following the instructions above.
We recommend getting started with testing first the migration process with Azure Information Protection labels without protection action associate to it on a small set of users by using the scoped policies. After testing the migration process on small set of documents and users and found it working as you expect you can associate a protection action if needed.

Thanks,

The Information Protection Customer Experience Engineering Team

[enduser1]

Hi David, 

It is great article and thanks for writing this up. Do you have similar example for Unified labeling ? I created sensitivity labels and the policy that gets created is different compare to above mentioned settings.

I followed the instructions given under https://docs.microsoft.com/en-us/azure/information-protection/rms-client/clientv2-admin-guide-custom...for unified labeling advanced settings.

I created the advanced settings using the

Set-Label -Identity Confidential -AdvancedSettings @{labelByCustomProperties="Titus label is Confidential,Classification,Confidential"}.

But I did not see the AIP label applying automatically neither in metadata nor on sensitivity label. If i try to save the doco AIP-ul client prompts me to choose one of the label where i had to choose the label manually.

I also tested the option to remove the footer added by our previous solution by using the below commands. This also not working. 

Set-LabelPolicy -Identity Global default "-AdvancedSettings @{RemoveExternalContentMarkingInApp="WXP"}

Set-LabelPolicy -Identity Global -AdvancedSettings @{ExternalContentMarkingToRemove="*Classification*"}

Checked %AppData%\Local\Microsoft\MSIP\Logs but no useful info- to be honest i have no idea what i am looking for here

i am using current GA version of AIP-UL client - 2.5.33.0. users have M365 E3 assigned. 

Any guidance with this will be much appreciated.

[Samuel Agyei]

Hi Ken,

Thank you for this article.

I am busy migrating a client to AIP from RightsWatch/Symantec ICT. The custom properties from one of their documents shows as below. What do I use for the mapping in this instance.

Name:                                       Value
RightsWATCHMark                   2|IVC-GENERAL-INTERNAL|{53FCFECF-33CD-47AE-BE15-C709D8472407}

[pwelcome]

By now you should have all the Azure Information Protection label names and ID. For example:

1. “Pubic” Label ID 11ba5c36-b7cf-1234-bbc2-bd5b3a9f9511
2. “General” Label ID 22ba5c36-b7cf-1234-bbc2-bd5b3a9f9522
3. “Confidential” Label ID 33ba5c36-b7cf-1234-bbc2-bd5b3a9f9533
4. “Secret” Label ID 44ba5c36-b7cf-1234-bbc2-bd5b3a9f9544

I anticipate you will wish to update the typo

1. "Pubic"

to

1. "Public"

very clear and concise article

[Hen David]

@pwelcome You are correct - Thanks!

@Samuel Agyei it should be something like the below

<AIP\MIP label ID>,"Old PII label mapping",RightsWATCHMARK,*General*

do this for every label that you have.

@enduser1 best that i can recommend here is to open a support case to troubleshoot this 

[Samuel Agyei]

@Hen David Thank you for your response.

I have created a label called "Internal" and using the unified client labelByCustomProperties and the example here: https://docs.microsoft.com/en-us/azure/information-protection/rms-client/clientv2-admin-guide-custom...

Using this as an example: 

Set-Label -Identity General -AdvancedSettings @{labelByCustomProperties="Secure Islands label contains Internal,Classification,.*Internal.*"}

This is what I came up with:

Set-Label -Identity Internal -AdvancedSettings @{labelByCustomProperties="IVC-GENERAL-INTERNAL,RightsWATCHMark,.*Internal.*"}

Where does this part here fit in:  <AIP\MIP label ID>,"Old PII label mapping"

[Hen David]

@Samuel Agyei in the new UL experience you dont need to put the <AIP\MIP label ID>

in the UL client the label ID is replaced with "Set-Label -Identity Internal" when it points to what MIP label you would like to apply

[Samuel Agyei]

@Hen David Thank for the prompt response.

I take it the command I used then is correct?

Set-Label -Identity Internal -AdvancedSettings @{labelByCustomProperties="IVC-GENERAL-INTERNAL,RightsWATCHMark,.*Internal.*"}

[pheeeling]

Hi @Hen David 
Is this also the process I need to follow to migrate AIP protected data to a new tenant? My goal is to delete the old tenant after data migration.

Thanks for a feedback.

Best regards

[EAMageeHIG]

What would the answer be if you had legacy labels in your data in a document property that was not in the CUSTOM attributes but repurposed a field in standard? All the solutions seem to revolve around custom properties. How would you migrate the items without having to re-label?

[Argha Banerjee]

Recently, we have migrated Seclore deployment to Microsoft MIP to help our customers realize the full value of Microsoft 365. First, we determined that the Microsoft Information Protection (MIP) stack could meet all the customer requirements except for dynamic watermarking capabilities. Then we developed a custom component to fill the watermarking gap with MIP and undertook the migration on behalf of the client. In addition to significant cost savings after the migration, the customer has unlocked further efficiencies from having a single enterprise-wide data security technology stack.