Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
Starting Today! Use Adobe Acrobat Reader for PDFs protected by Microsoft Information Protection
Published Sep 26 2018 06:32 AM 40.3K Views

Overview

As part of the ongoing relationship between Adobe and Microsoft, as of October 12th, 2018, Microsoft’s Information Protection customers will able to use Adobe Acrobat Reader on Windows to open labeled and protected PDFs (public preview). Adobe Acrobat Reader is the preferred PDF reader for consuming protected PDF content for many customers.

 

Enhanced integration between Adobe and Microsoft Information Protection solutions

The integration with Microsoft Information Protection solutions enables enterprise customers to securely classify, label and protect PDF documents in a native way, similar to how Office applications (e.g. Word, PowerPoint, Excel, Outlook) implement information protection. This will help drive consistency in information protection practices across the enterprise between labels in Office documents and in PDFs.

 

How to get started

To see how the preview capabilities, work:

  • Install the latest Azure Information Protection client
  • Label and protect a PDF document
  • Try to open the PDF in a PDF viewer that cannot open the protected PDF
  • Install the public preview Adobe Acrobat Reader and plug-in
  • Open the same document using Adobe Acrobat Reader

To install the latest Azure Information Protection, client go to the following link.

After downloading the client, go to Windows File Explorer, right click on a PDF file and select Classify and protect.figure1.png

                                          Figure 1: Selecting a PDF file to label and protect

 

Using the Azure Information Protection client, select a label to apply. In this example we are applying a Confidential label to the PDF document.

Figure 2.png

 

                                     Figure 2: Azure Information Protection client labeling a PDF file

 

Notice the file extension of the PDF file extension does not change.Figure 3.png

                        Figure 3: Labeling and protecting the PDF file does not change the extension

 

When opening the PDF document in an application that is not able to read a labeled and protected PDF, this is what users will see:Figure 4.png

                   Figure 4: Cover page experience when opening a labeled and protected PDF file in an unenlightened reader

 

When users click on the Windows icon, it will take them to this page to download the preview Adobe Acrobat Reader:

 

Figure 5.png

                           Figure 5: Downloading the preview Adobe Acrobat Reader and the integration plug-in

 

Clicking on the above link starts the download. The Adobe Acrobat Reader integration with Microsoft Information Protection comes in two files:

  • Public preview of Adobe Acrobat Reader
  • Public preview of the integration plug-in

First, install Acrobat Reader. Then, install the Adobe plug-in. Please make sure to install in this sequence.

The preview of Adobe Acrobat Reader is a consumption experience for documents that are already labeled and protected.  The Adobe Acrobat Reader experience will enforce rights of the protection – based on the classification label associated with the file. Examples of protection enforcement capabilities include restricting copy and paste, restricting commenting and restricting printing.

After the installation, if you want to enable logging (to help troubleshoot issues that may arise), then you’ll need to disable protected mode.

To disable protected mode:

  • Start the preview Adobe Acrobat Reader application
  • Select the Edit menu and go to the Preferences option
  • In the preferences window select the Security (Enhanced) option

Select Ok and restart the Adobe Acrobat Reader application
figure 6a.png

 

Figure 6b.png                              Figure 6 Enabling logging for the information protection integration

 

After you’ve completed the installation steps and restart the application, you’ll now be able to open and view labeled and protected PDF documents directly from within Adobe Acrobat Reader.

Figure7.png

                                   Figure 7 Adobe Reader opening a labeled and protected document

Users will now see that Adobe Acrobat Reader shows the label and enforces the protection applied by the Confidential label.

 

Next steps

We’re excited to partner with Adobe to make secure collaboration easier. Microsoft and Adobe are looking forward to hearing your feedback on the public preview. Thank you all for your participation in the private preview earlier this year – and the guidance you provided.

We will provide a link to download the plug-in  starting early October.

 

 

 

 

 

 

 

 

 

32 Comments
Copper Contributor

Could you please add the download link to the Adobe preview ? I don't see it anywhere.

 

Clicking the Windows icon in a protected PDF takes me to here which doesn't have any Adobe links, so I am not able to test this based on your instructions and can't seem to find anything related to this on adobe's website either.

 

Update: Just realized that it's not October yet + you've mentioned that the links will be posted. So I guess I just have to wait.

First I thought that we can check the preview already.

 

Thanks

Hello Csaba,

                   Thank you for your interest. We will activate the link as soon as it is available. All I can say is stay tuned. 

 

Kartik

Copper Contributor

Hello, 

 

any word on when in October it will be available? we have two clients who are desperately waiting for this feature!

 

thanks

The release should be out in the next few days. When it goes live I will be posting an update on the yammer communities. We are  close to making it available

 

Copper Contributor

Please post it here as well - thanks!

Copper Contributor

Can the "Cover page experience" customized to point to an internal link / email if an on-prem AD RMS server is being used ? I am not seeing that option mentioned in the docs.

Thanks

Copper Contributor

Found the source for the "Cover page experience" and overwriting the PDF there works.

The cover pages are stored here in case anyone else were interested

C:\\Program Files (x86)\\Microsoft Azure Information Protection\\x86\\IRMProtectors\\1033

 

This is something which should be documented for those environments where an on-premise AD RMS is in use.

Copper Contributor

Hello,

 

Seems that pdfs downloaded from an IRM protected sharepoint library cannot be opened/read with the preview adobe reader (no problems with files encrypted with preview AIP client)..

Seems logical as the file has to be encrypted by the new AIP client (I suppose IRM is not using this technology yet).

 

Is there any plans to change that in the future so we will be able to read downloaded PDF's from IRM encrypted library ?

 

Regards

Eric Delmotte

Copper Contributor

thanks 

I have installed the latest azure client 

also the latest Adobe reader 

I still cannot open it unless I use the azure reader client as you can see 

the only thing changed is that when I press properties it show what permissions do I have 

so is that all?

that is all what the plug in does?

 

 

picazure.pngcommandazure.png

Deleted
Not applicable
Hi Kartik, all Firstly, a great thank you! to all who made this possible. It is a big leap forward after almost 2 years of anxious waiting for it to happen :smiling_face_with_smiling_eyes:. I have run some tests and got it working with all the latest downloads as you have documented it. One thing, though, was that I needed to set the EnablePDFv2Protection = True advanced property in the AIP policies. I haven't found that hint in your description – should it work without this setting? Another - much more worrying - finding was that PDF files protected with SharePoint 2016 or SharePoint Online IRM protection can still not be opened with Adobe Reader. While I am aware that this is "old style" document protection it is still in use and fully supported afaik. Do you have any plans in making this work as well with Acrobat Reader DC? Thanks -dani
Copper Contributor

Hello, 

 

wanted to check in and see if the plugin for adobe is ready to use yet? 

 

thanks

@Tanvir Panjwani yes it is in public preview.  Use the link in the blog 

 

Kartik

@Daniel Fischer We are working with the SharePoint team to address the issue, please stay tuned. 

 

Kartik

Copper Contributor
Hi, if I try to open a AIP protected PDF I Always get the following error message after entering my E-Mail-address: "The network location cannot be reached.". Could anybody help me, please?

@Ralf Feest Can you post your questions on yammer (https://www.yammer.com/askipteam/ ) with screen shots of your error. 

@Karim Zaki  Did you download the Adobe reader from the link on the blog or from the Adobe Website and did you install the Adobe plug from the download link?

Copper Contributor

Yea thanks the plugin was missing 

but i had another issue 

users used to edit PDF not after the docs is protected the adobe professional not opening the docs for edit i had to make it public first then edit then protect it. Is there a chance that the adope professional can open the protected pdfs or the the nito pro i had both can u advice please

Copper Contributor

Downloaded and tested, works fine so far. Thanks!

do you know Visual Markings (AIP label config- watermarks etc.) is available or going to be available for adobe pro as well ?

Copper Contributor

Thanks @Kartik Kanakasabesan. Will this plugin work with Adobe Acrobat XI And Adobe Pro DC?

We were able to get it working with Adobe Reader but our client is now asking about Acrobat XI and Pro DC.

 

thanks

@Tanvir Panjwani , no the plugin will not work with Acrobat Pro DC. The plugin works with the acrobat build provided for the time being. 

 

 

Copper Contributor

I have configured AIP /EMS E3 in my tenant and have installed Adobe and related plugin as mentioned in the link.I am seeing that once a pdf is protected via AIP then when I open the same very pdf (by a click)then it opens by default in AIP viewer(I don't have explicitly say to open ) .Is this the correct and expected behavior ?

 Also …if I have an Office 365  IRM protected pdf then this adobe will not work but rather I have to explicitly open the pdf in AIP viewer by open -AIP viewer

 Is my understanding correct and is that how it works ?Please let me know

Deleted
Not applicable

What is the current status for Adobe Professional ? Users need to edit these files they got. For now they can receive the file, open it with Adobe Reader which honors the AIP labels

 

IF they need to edit it, they have to make it public, go to their Adobe Pro or Nitro Pro, edit it then reclassify it. Very long loop

Deleted
Not applicable

Most of our files (50%) are PDF and they need to edit it ? Any suggestions ? Also is the plan to release this is Reader and Pro ? What is the expected dates

Copper Contributor

@Kartik Kanakasabesan This is great, much awaited feature!

1. If the PDF is viewed with Adobe pro, would it work?

2. Is there a plan to make this built into the native Adobe Reader, so that users don't have to install the integrations?  

3. Is there a plan to make editing in PDF possible for AIP protected files?

Copper Contributor

It would be nice if we could know when the issue on SharePoint IRM will be solved.

Copper Contributor

Looks like the Plug In for Acrobat is only for AIP protected documents and not SharePoint IRM. Any idea if this will be considered anytime soon. This is a much wanted feature users as our users are not comfortable with AIP client.

Copper Contributor

@Kartik Kanakasabesan Is the new preview now working for PDF files stored in SharePoint (RMS Protected libraries)?

Copper Contributor

I'm experiencing the same 'The network location cannot be reached' error when opening an protected PDF file. This is the latest version of Adobe Reader DC and has the AIP plugin installed. I'm not using any type of web proxy.  I am using a registered outlook.com address to open the file. If I use my work account i get a different error:

Failed API call

protection_engine_create_protection_handler_from_publishing_license_internal failed

Failed calling GetTimeFromGMTString

 

I can open the same PDF with the AIP viewer app (using my outlook.com account)

Copper Contributor

I am getting the same message when i open a protected PDF document.

 

Failed API call 

protection_engine_create_protection_handler_from_publishing_license_internal failed

Failed calling GetTimeFromGMTString @Kartik Kanakasabesan 

 

 

Copper Contributor

on another laptop I get a different message to say my account does not exist in tenant Adobe Inc, the same issue being reported in this post

https://techcommunity.microsoft.com/gxcuf89792/board/message?board.id=AzureInformationProtectionBlog...

 

The same post does state that Adobe will only work with Sensitivity Labels....

 

"Prior to downloading the latest Adobe Acrobat, please make sure that your labels are visible in the Security and Compliance center UI @ https://protection.office.com . If the labels are visible and are published by a label policy from the Security and Compliance center, the Adobe Integration will function"

 

We are using AIP  but I created some test sensitivity labels and it still did not make a difference. I am able to open the protected PDF files using the Foxit Reader and the AIP reader.

Copper Contributor

The latest version of the plugin still allows screenshots, whereas AIP app blocks this.  The same experience when attemting to share via Team Screen Sharing.   Adobe does not block this, but AIP does.  When will this be fixed, is creating issues for us?

Copper Contributor

@Kartik Kanakasabesan Is there any update on getting this to work with SharePoint Online IRM?

Version history
Last update:
‎May 11 2021 01:58 PM
Updated by: