Azure AIP Portal Label & Policy Management Admin Experience - Post March 31st Deprecation

To provide a unified and streamlined customer experience, the Azure Information Protection labeling and policy management in the Azure Portal, and the AIP classic client, will be deprecated on March 31st, 2021as announced in our previous blog.

We highly recommend customers on classic AIP labeling to migrate to unified labeling before this sunset timeline for a seamless transition to unified labeling.

Note: This deprecation does not apply in the following scenarios:

• For customers who have already been approved for extended support. Customers with extended support will continue using the AIP area in the Azure Portal with no impact until the end date of their extended support.
• For GCC/GCC-H/DoD customers. Support is extended for GCC/GCC-H/DoD customers until the end of September 2021.

The deprecation does not affect the Azure Information Protection areas in the Azure portal related to the on-premises scanner and analytics. AIP analytics is still available in the Azure Portal, but we encourage customers to start using the Microsoft 365 Compliance center Activity Explorer.

After deprecation, editing labels and policies in the Azure portal will no longer be available. The only admin action that will still be available after deprecation is to activate unified labeling. Classic client will continue to function as configured; however, no further support is provided, and maintenance versions will no longer be released for the classic client.

This blog lists key admin components that will be deprecated and describes how this impacts the admin. For details on migration, see the previous communications on UL migration steps.

1) Admin tries to add new labels in AIP portal

• Admins will not be able to add new labels in the AIP portal.
• The Add a new label link and the ellipses link (…) next to each label will be disabled or removed.
• Admins will not be able to do any of the following:
  • Add new labels
  • Add new sub-labels
  • Delete a label
  • Move labels up or down

Fig 1: Home > Azure Information Protection > Labels

2) Admin tries to edit labels in AIP portal

• Labels will be set to read-only mode.

Fig 2: Home > Azure Information Protection > Labels > Label Name

3) Admin tries to edit label conditions in the AIP portal

• The Add new condition link will be removed.

Fig 3a: Home > Azure Information Protection > Labels > Label Name > Configure Condition

Fig 3b: Home > Azure Information Protection > Labels > Label Name > Configure Condition

• Admins will be able to view conditions in read-only mode.
• Admins will not be able to edit condition settings.

4) Admin tries to edit policies in the AIP portal

• Admins will not be able to add new policies.
• Admins will only be able to view the policy.
• Admins will not be able to save or delete policies.

Fig 4: Home > Azure Information Protection > Policies > Policy

5) Admin tries to edit policies (export, advance settings)

• Admins will not be able to add new policies.
• Admins will be able to select the ellipsis (…) and right-click each to manage a policy. Admins will be able to select the Export and Advanced settings options.
• In the ellipses link (…), the Move up/down and Delete options will not be available.

Fig 5: Home > Azure Information Protection > Policies > Policy

6) Admin tries to add users to policies

• Admins will be able to view users.
• Admins will not be able to add or remove users.

Fig 6a: Home > Azure Information Protection > Policies > Policy >

Fig 6b: Home > Azure Information Protection > Policies > Policy > Select which users or groups get this policy.

7) Admin tries to edit the advanced setting configuration in the AIP portal

• Admins will be able to view settings in read-only mode.
• Admins will not be able to add new settings or remove settings.

Fig 7: Home > Azure Information Protection > Policies > Policy > Advanced Settings

8).Admin tries to activate protection in the AIP portal

• Admins will only be able to see the status (activated/deactivated).
• Admins will not be able to activate/deactivate.

Fig 8: Home > Azure Information Protection > Protection Activation

9) Admin tries to edit protection templates in the AIP portal

For customers that are working with protection templates instead of labels, Admins could manage the protection templates from the portal. Moving forward:

• Admins will be able to view protection templates in read-only mode.
• Admins will not be able to edit/change protection settings in the AIP Portal.
• Admins can use AIP PowerShell cmdlets to edit protection.
• Admin will not be able to convert templates to labels using the portal but can still use PowerShell command

Fig 9: Home > Azure Information Protection > Labels

10) Admin tries to edit protection in the AIP portal

• Admins will be able to view protection in read-only mode.
• Admins will not be able to edit/change protection settings in the AIP Portal.
• Admins can use AIP PowerShell cmdlets to edit protection.

Fig 10: Home > Azure Information Protection > Labels > Label Name > Protection Settings

11) Admin tries to add, import, delete languages in the AIP portal

• Admins will only be able to export language settings.
• Admins will not be able to add, import, or delete languages.

Fig 11: Home > Azure Information Protection > Languages

12) Admin tries to activate/deactivate unified labeling in AIP portal

• Admins will be able to activate unified labeling from the AIP portal.
• Admins will be able to copy policies to the Microsoft 365 Compliance center.
• Admins will not be able to publish policies in the AIP portal.

Fig 12a: Home > Azure Information Protection > Unified Labeling > Activate

Fig 12b: Home > Azure Information Protection > Unified Labeling >

13) Using the AIP classic client

• Users will be able to apply label and protection and to consume protected files.
• The AIP classic client is out of support. 
• Maintenance versions for the AIP classic client will not be released.

14) AIP labels in Microsoft Cloud App Security

Managing labels and policies in the Microsoft 365 Compliance center

Fig 14a: Microsoft 365 compliance > Solutions > Information Protection > Labels >

After you activate and migrate to unified labeling, your labels will be available in the Microsoft 365 Compliance center.

• Moving forward, you can manage your labels and policies in the Microsoft 365 Compliance center.
• For more information about creating, managing labels and policies in the Compliance center, see the Microsoft 365 compliance documentation.

Fig 14b: Microsoft 365 compliance > Solutions > Information Protection > Label policies >  

AIP portal and classic client admin experience summary

Some important links about unified labeling

• Deprecation notice for sunsetting label management in the Azure portal and AIP client (classic)
• Understanding Unified Labeling migration
• Identify the Office 365 versions that support unified labeling
• How to migrate Azure Information Protection labels to unified sensitivity labels?
• Where can I find information to compare labeling clients?
• How to install unified labeling clients?
• What is the user experience across platforms?
• How do I file for a support extension?

Frequently asked questions

How can I find my status on extended support?

• CSS will be able to assist you to find status on extended support.

       Who should I contact regarding migration questions?

• There are various channels. Yammer, CSS, or your CXE representative.

Will the AIP Classic client work after the deprecation?

• Yes, AIP classic client will work. AIP classic is out of support. Maintenance versions will not be released.