Unified Label not recognized in SharePoint

%3CLINGO-SUB%20id%3D%22lingo-sub-1492151%22%20slang%3D%22en-US%22%3EUnified%20Label%20not%20recognized%20in%20SharePoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1492151%22%20slang%3D%22en-US%22%3E%3CP%3EI%20used%20a%20file%20policy%20to%20automatically%20label%20every%20document%20in%20a%20SharePoint%20folder%20with%20a%20sensitivity%20label%20(unified)%2C%20which%20applies%20encryption%20and%20has%20a%20pre-configured%20(not%20user-specified)%20permission.%26nbsp%3B%20Normally%2C%20when%20documents%20are%20labelled%20with%20that%20pre-configured%20label%20manually%2C%20and%20when%20they%20are%20uploaded%20to%20a%20SharePoint%20site%2C%20the%20labels%20are%20recognized%20and%20the%20documents%20can%20be%20opened%20in%20Word%20on%20the%20web%20(e.g.%20Excel%20or%20PowerPoint)%20for%20co-authoring.%26nbsp%3B%20However%2C%20when%20documents%20are%20labelled%20automatically%20by%20Cloud%20App%20Security%20by%20a%20file%20policy.%26nbsp%3B%20The%20documents'%20labels%20are%20not%20recognized%20in%20SharePoint%20and%20those%20documents%20cannot%20be%20open%20for%20co-authoring.%26nbsp%3B%20Is%20it%20an%20expected%20behavior%20or%20there%20are%20some%20settings%20that%20I%20have%20missed%3F!%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20encryption%20applied%20to%20the%20documents%20are%20owned%20by%20whom%3F%20I%20notice%20the%20%22Modified%20By%22%20column%20in%20SharePoint%20lists%20out%20the%20user%20%22SharePoint%20App%22%20for%20that%20document.%26nbsp%3B%20Does%20it%20mean%20the%20document%20is%20encrypted%20under%20the%20%22SharePoint%20App%22%20user%20account%3F%20and%20how%20do%20I%20use%20it%20to%20decrypt%20it%20if%20necessary%3F%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1492151%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECloud%20App%20Security%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1492899%22%20slang%3D%22en-US%22%3ERe%3A%20Unified%20Label%20not%20recognized%20in%20SharePoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1492899%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F398255%22%20target%3D%22_blank%22%3E%40Kenneth_Cheng%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHi%2C%20would%20you%20be%20able%20to%20share%20some%20screen%20shots%20of%20how%20you%20created%20your%20MCAS%20file%20policy%20please%20and%20I%20will%20see%20if%20I%20can%20reproduce%20the%20policy%20in%20my%20tenant%20to%20see%20how%20it%20responds.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1493513%22%20slang%3D%22en-US%22%3ERe%3A%20Unified%20Label%20not%20recognized%20in%20SharePoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1493513%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F616707%22%20target%3D%22_blank%22%3E%40PeterRising%3C%2FA%3E%26nbsp%3BThanks.%26nbsp%3B%20A%20screen%20shot%20showing%20the%20policy%20is%20now%20attached.%26nbsp%3B%20%26nbsp%3BBasically%2C%20the%20policy%20specifies%20a%20folder%20in%20SharePoint%20and%20it%20will%20automatically%20apply%20a%20sensitivity%20label%20to%20every%20file%20under%20that%20folder.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1494002%22%20slang%3D%22en-US%22%3ERe%3A%20Unified%20Label%20not%20recognized%20in%20SharePoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1494002%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F398255%22%20target%3D%22_blank%22%3E%40Kenneth_Cheng%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%2C%20I%20recreated%20your%20policy%20and%20the%20label%20auto%20applies.%26nbsp%3B%20However%2C%20when%20I%20try%20and%20open%20an%20existing%20file%20in%20the%20SharePoint%20Online%20library%20in%20the%20browser%2C%20I%20get%20this%20message%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Screenshot%202020-06-27%20at%2018.42.40.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F201694i1C1B7D4303DD0FE7%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22Screenshot%202020-06-27%20at%2018.42.40.png%22%20alt%3D%22Screenshot%202020-06-27%20at%2018.42.40.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EAnd%20if%20I%20try%20and%20open%20in%20the%20Word%20app%20I%20get%20the%20following%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Screenshot%202020-06-27%20at%2018.42.52.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F201695i8F882A5E4FD1FFEE%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22Screenshot%202020-06-27%20at%2018.42.52.png%22%20alt%3D%22Screenshot%202020-06-27%20at%2018.42.52.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EIs%20this%20the%20same%20as%20what%20you%20are%20seeing%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWeirdly%20though%2C%20if%20I%20create%20a%20new%20file%20in%20the%20library%2C%20the%20policy%20matches%20and%20I%20can%20continue%20to%20access%20the%20document.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1494342%22%20slang%3D%22en-US%22%3ERe%3A%20Unified%20Label%20not%20recognized%20in%20SharePoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1494342%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F616707%22%20target%3D%22_blank%22%3E%40PeterRising%3C%2FA%3E%26nbsp%3BYes%2C%20I%20encountered%20the%20same%20first%20error%20screen%20(IRM%20warning).%26nbsp%3B%20But%20I%20didn't%20encounter%20the%202nd%20warning%20screen.%26nbsp%3B%20%26nbsp%3BCan%20you%20open%20the%20document%20in%20Word%20for%20the%20web%20for%20co-authoring%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1494346%22%20slang%3D%22en-US%22%3ERe%3A%20Unified%20Label%20not%20recognized%20in%20SharePoint%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1494346%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F398255%22%20target%3D%22_blank%22%3E%40Kenneth_Cheng%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ENo%2C%20I%20am%20unable%20to%20open%20the%20document%20in%20Word%20Online.%26nbsp%3B%20As%20I%20said%2C%20this%20document%20existed%20already%20in%20the%20doc%20library%20before%20I%20created%20the%20MCAS%20file%20policy.%26nbsp%3B%20If%20I%20now%20create%20a%20new%20doc%2C%20it%20works%20as%20expected.%26nbsp%3B%20Very%20strange.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20going%20to%20play%20around%20with%20this%20some%20more.%26nbsp%3B%20In%20the%20meantime%2C%20I%20would%20recommend%20opening%20a%20Microsoft%20support%20case%20to%20see%20if%20they%20can%20advise%20on%20this%20behaviour.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
New Contributor

I used a file policy to automatically label every document in a SharePoint folder with a sensitivity label (unified), which applies encryption and has a pre-configured (not user-specified) permission.  Normally, when documents are labelled with that pre-configured label manually, and when they are uploaded to a SharePoint site, the labels are recognized and the documents can be opened in Word on the web (e.g. Excel or PowerPoint) for co-authoring.  However, when documents are labelled automatically by Cloud App Security by a file policy.  The documents' labels are not recognized in SharePoint and those documents cannot be open for co-authoring.  Is it an expected behavior or there are some settings that I have missed?!  

 

The encryption applied to the documents are owned by whom? I notice the "Modified By" column in SharePoint lists out the user "SharePoint App" for that document.  Does it mean the document is encrypted under the "SharePoint App" user account? and how do I use it to decrypt it if necessary? 

 

Thanks!

5 Replies
Highlighted

@Kenneth_Cheng 

 

Hi, would you be able to share some screen shots of how you created your MCAS file policy please and I will see if I can reproduce the policy in my tenant to see how it responds.

Highlighted

@PeterRising Thanks.  A screen shot showing the policy is now attached.   Basically, the policy specifies a folder in SharePoint and it will automatically apply a sensitivity label to every file under that folder. 

Highlighted

@Kenneth_Cheng 

 

So, I recreated your policy and the label auto applies.  However, when I try and open an existing file in the SharePoint Online library in the browser, I get this message;

 

Screenshot 2020-06-27 at 18.42.40.png

And if I try and open in the Word app I get the following;

 

Screenshot 2020-06-27 at 18.42.52.png

Is this the same as what you are seeing?

 

Weirdly though, if I create a new file in the library, the policy matches and I can continue to access the document.

Highlighted

@PeterRising Yes, I encountered the same first error screen (IRM warning).  But I didn't encounter the 2nd warning screen.   Can you open the document in Word for the web for co-authoring?

Highlighted

@Kenneth_Cheng 

 

No, I am unable to open the document in Word Online.  As I said, this document existed already in the doc library before I created the MCAS file policy.  If I now create a new doc, it works as expected.  Very strange.  

 

I'm going to play around with this some more.  In the meantime, I would recommend opening a Microsoft support case to see if they can advise on this behaviour.