Add protection to a sensitivity label - What happens to already labeled files?




Lets say that we have already labeled several files with a basic sensitivity label does not apply encryption/protection. Then after labeling all these files for the last few weeks, we go back to the Office 365 SCC console and modify this sensitivity label to apply encryption.


What will happen with the files that were already labeled before this change? When will these files be protected and by how will th?


Thanks for clarifying.

7 Replies
best response confirmed by Chuck99 (Contributor)

Hello @Chuck99. That is a good question. If the file was labeled without protection and you later add protection to the label the file will still have the label settings that were set at the time you labeled the file. It will not be updated because you later add protection to it.

@Pål Winther  TY for that information which makes a lot of sense.


On another note, I did change the label of a file from a label with protection (Highly Confidential - All employees) to a General label without protection. Even though the General was now applied to the file, the RMS protection behind seems to stay. I had to go in the protection settings (In Excel: File - Info - Protect Workbook - Restrict) to remove the protection.


Is that by design?



@Chuck99How did you change the label? With the client? Or via the bar/sensitivity button in Office? I just had to test it here to see if I could reproduce this so I protected a document with Highly confidential and saved. Then I closed/opened the document and changed to Public (without protection). I provided as Justification that the previous label no longer applied and saved my document with the new label. Closed/opened and it was labeled Public. So, maybe you experienced a bug? Can you try again to see if you get the same behaviour?

@Pål Winther Hi again. I did change using the Sensitivity menu that was newly integrated in the Office apps. No AIP UL client is installed on the computer. I closed the file, opened it again and the label was General (no protection on this label) but the RMS restriction was still there.


I'll test that again later to see if it reacts the same way. I have a doubt about the validity of the first test because I was working on a file from my OneDrive client and I know that this does not work so well with protection.


I'll give an update about the results a little bit later. Thank you for your help.


Great @Chuck99  :) I look forward to hearing how it went. 

@Pål Winther I did test this again and didn't face any issue. Protection was gone once the HC label was removed. However, I had installed the AIP client before doing the test (initially did the label change with the Office ProPlus integrated Sensitivity label support). Also, I did the test from a local drive instead of the OneDrive client "folder".


So I have no clear conclusion for now and I don't have the time to do more tests for this week as I am overloaded of work. I might look at this again next week. 

@Chuck99 When you change the properties on a label (e.g. add protection), the new properties will for sure not be applied before you reopen the document and save it again. You also need time for the AIP client to receive the new policies (with the full client you can force the synchronization, with the built-in client you must sometimes be patient).

If you change the label from a label with protection to a label without protection, the protection should be removed. There may be some exceptions if you apply a label without protection, then manually apply custom protection (right click on the document, classify and protect, and apply custom permission). If you apply protection with the label and not manually, you should not have any issue.