Defender for cloud apps does not block download of word (web apps) doc as PDF based on a sensitivity

[semangard-post]

Hello,

I have a .docx with a sensitivity label and a CASB session policy preventing it from being downloaded. It works well if I try to download it as a .docx or a .odt, but it does not work if I try to download it as a PDF (tested with Word web apps)

Why ?

Can it be related to https://insider.office.com/en-us/blog/apply-sensitivity-labels-to-pdfs-created-with-office-apps ?

Thanks and regards

[#2]

Hi,

Just to clarify, you've got 3 docs in Office. One saved as docx, another saved as .odt, and the last saved as a .pdf. And only the one with .pdf extension isn't being blocked when you try to download? I'm not aware of any limitations with PDF and session controls, I know there are some scenarios where the label isn't visible in the UI for PDF.

[#3]

Hi @Keith_Fleming 
To clarify:
0-> .docx created with Word online + apply a sensitivity label

1a-> try do download the doc with the label as .docx (with save-as a copy action) => blocked by our CASB policy

1b-> try do download the doc with the label as .odt (with save-as ODT action) => blocked by our CASB policy

1c-> try do download the doc with the label as .pdf (with save-as PDF action) => NOT blocked by our CASB policy

I would like to understand why 1c does not work and if it is planned to work quite soon.

Regards