Sensitivity Button not showing in Office Web Apps

[Paul Saldanha]

I am trying to understand the process for enabling the sensitivity button in Office Web Apps (Word, Excel, PowerPoint).  The following is confirmed.

1. Have the correct licensing.
2. Set-SPOTenant -EnableAIPIntegration $true is true
3. Label is created automatically apply label when SIT is detected

I do not see the label in Word Online, nor do I see a sensitivity button.  I do now that the SIT was detected because the file is protected with a DLP policy.

What I don't get is why the sensitivity button and corresponding labels aren't in the web app if the integration is set to true.  After reading this ( https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-teams-groups-sites?view...) and this (https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-fil...) many times, I think that the set-spotenant is only required for the web apps integration.  However, if this step is required along with other configuration for integrating labels with groups and sites. Correct?

I feel I am missing something obvious here but I cannot find it.  All I need at the moment is the Office Web Apps integration.

[#2]

Hello, I get that this can be confusing. Yes, the EnableAIPIntegration is only for enabling sensitivity labels for Office files in SharePoint and OneDrive. When you want to add labels on containers too you use the $Setting["EnableMIPLabels"] = "True" in the group setting for the org. (containers are groups, team sites, teams, SharePoint sites).

When it comes to the issue you are having now I believe you might not have published your labels? See this article https://support.microsoft.com/en-us/office/known-issues-with-sensitivity-labels-in-office-b169d687-2...

Other than that just go through the prereqs and limitations https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-fil...

[#3]

@ChristianJBergstrom 
Thanks for the reply and the confirmation that I only need the set-spotenant command.  I wish the docs delineated this more.
So I am currently testing in a demo Contoso tenant. The labels were already published to the user and I republished them about 1.5 hrs before your response (about an hour after I posted the question). Perhaps I am in the requisite 24hr waiting period (I did not change any labels)?

[#4]

Hi, propagation time for sure then.

[#5]

Its got to be something else. Its been slightly over 24 hrs and there is still no button. Very frustrating if the only thing to integrate with Office Apps is set-spotenant. Still open to other ideas or things to check...

[#6]

And I checked that the user has labels published by installing word and the desktop UL client. See the button in client app with labels. But not on the web

[#7]

Hi, the process is really straightforward so agree there must be something else if you waited over 24 hours. You don't have to install the UL client as the sensitivity button appears anyway in Office desktop apps. Kind of makes me think of the prerequisites again.

I believe I know too little about your environment to assist here, so instead of giving your org. config to me I suggest you reach out to the official support with a ticket.

@Paul Saldanha Out of curiosity, what licensing do you have? You only say "Have the correct licensing."

[#8]

@ChristianJBergstrom I am also facing the same issue I have applied the same command Set-SPOTenant -EnableAIPIntegration $true. it's been more than 24 hours but still can't see the button. I am using a demo tenant with an M365 E5 license.

[#9]

@Mitul_Pansuriya Hello, so I had to test this with a test tenant again to see if there's something going on but I have no issue disabling the integration (make the button go away) and enabling (make the button appear again). Are the labels published too? Have a look at the docs and if that's not helpful I suggest reaching out to the official support with a ticket.

Enable sensitivity labels for Office files in SharePoint and OneDrive - Microsoft 365 Compliance | M...

@Paul Saldanha @Mitul_Pansuriya The only way I've been able to reproduce what you're experiencing is to not publish my labels.

[#10]

@ChristianJBergstrom 

I am also using the demo environment. The users all have EMS E5 or the full compliance suite licensed.

I agree that the documented process is super simple so it is unclear why this is not working as expected.  Is there any special way to get support for these demo tenants?

@Mitul_Pansuriya thankfully you are having the same issues.  At least I know it might be something other than my incompetence...

[#11]

As mentioned, the only way I've been able to reproduce what you're experiencing is to not publish my labels.

[#12]

@Paul Saldanha 

Have you ever found a solution to this?

I'm facing the same issue. Can see the button and my labels in desktop apps, but nada in web apps.

i can't also see the sensitivity label in the sensitivity column in SharePoint so this could be part of that problem. I followed the same Microsoft guides.

Cheers.

[#13]

Hi, as mentioned above the first command is what you use to enable the sensitivity integration in OneDrive and SharePoint (Office on the web), so look at what value you have using.

Get-SPOTenant | select EnableAIPIntegration

This need to be set to $true so if not Set-SPOTenant -EnableAIPIntegration $true

For the container part (sites, teams, groups) you need to use the group directory setting $Setting["EnableMIPLabels"] = "True"

Look at your labels Get-Label | ft Name, Guid
Look at your label policies Get-Labelpolicy | ft Name, Guid
What label is published to a site?
Get-SPOSite -Identity https://xxxx | Select Sensitivitylabel

Have you read all at the Docs?

The Sensitivity button is available if the user account that is signed into Word, Excel, PowerPoint, or Outlook is a Microsoft 365 subscriber and has labels published in the Security and Compliance Center.

https://support.microsoft.com/en-us/office/known-issues-with-sensitivity-labels-in-office-b169d687-2...

https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-sharepoint-onedrive-fil...

https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-assign-sensitivity-l...

[#14]

@ChristianJBergstrom 

The issues is that labels are not published to the site. Not to SharePoint at all. I don't even get the 'Sensitivity' field when i create a new site or edit existing sites.
i tried setting the SensitivityLabel using Set-SPOSite, but when I ran Get-SPOSite, it's still blank.

I can only publish labels to Users and Groups. Should i be able to publish to Sites?

[#15]

Hello, well it seems as your MIP settings is configured OK according to your dumps. And it look as it should as when you publish from the GUI those are the options, e.g. what users or group members do you want to publish to (i.e. they will have the option to select that label). You don't have to publish the created sensitivity label if you choose to use PowerShell for adding it to the site. But bear in mind that there are some propagation time.

Just for confirmation I set up a new container label, without publishing it, yesterday and it took quite some time before I could publish/add that to my site using PowerShell with Set-SPOSite -Identity xxx -Sensitivitylabel <put label guid here>

[#16]

Hi @ChristianJBergstrom 

I checked it today again, and I saw that I could select the sensitivity label In SharePoint Admin center for each of my sites.

I hadn't changed anything since my first post and it turned out to be some kind of propagation on Microsoft side. Annoying, but very happy that I hadn't done anything wrong :)

Thanks for your help and quick response.

[#17 · Accepted solution]

@MarcinUK @ChristianJBergstrom @Mitul_Pansuriya 

Sorry for the radio silence. Dealing with a family emergency.
After banging my head on the wall a few things happened:

1. After about 5 days, the sensitivity button showed up in the Office Web Apps.  I didn't do anything different from when I first posted my question.
2. I had reached out to CDX Support (through the partner site) for help.  That was very slow and not fruitful but I did get an out-of-the-blue email from someone stating that they had uncovered a bug in the CDX tenants and were applying a fix to my tenant.  This was after the button showed up in one CDX tenant and not in the other CDX tenant.  The button is in both tenants now.  I can't say for certain that the "fix" had anything to do with anything since I had the button prior to receiving the email from Support.
3. I learned that there are different SLAs for the CDX tenants.  These SLAs are not published but they can be throttled arbitrarily.  Maybe this is what is going on?  Colleagues spun up a MSDN tenant and clicked on the yellow highlighted text (instead of using the Set-SPOTenant) and it configured the button in the documented 15 minutes.
4. I had to log out of the tenant and sign back in to see the change.

[#18]

Although this specific question was answered, there is solid guidance in the Microsoft 365 Admin Center on the general topic of MIP deployment, including configuration of Sensitivity Labels so that they work for Office Web Apps.

If you are an IT Admin with access to the Admin Center, and you are planning or deploying Microsoft Information Protection (MIP) (or would like to review your deployment), be sure to check-out the MIP setup guide.

The setup guide simplifies MIP deployment, with steps in chronological order, including automating some deployment steps.

If you do not have access to the Admin Center, similar content (with less automation) can be found at the  MIP setup guide, located at the assistants.microsoft.com M365 Deployment site.

[#19]

Hi@Paul Saldanha ,

There may be some commands that you try to run but they fail, giving you errors like "term not recognized," "object not found," or "command cannot be executed because running script is disabled."
In this case, just use the below command to get around the running script and run the instructions.

1> Verify that the user has the necessary licenses for AIP by checking their licenses.

2> Typically, this occurs when AIP is not connected to SPO (Sharepint Online). In this situation, you must enable AIP and SPO integration. To do this, follow the procedures below:

On your computer, launch a Windows PowerShell window. with administrative rights

Execute these commands: 

- Install-Module -Name Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser

- Update-Module -Name Microsoft.Online.SharePoint.PowerShell

- Connect-SPOService -Url https://msdxXXXXX-admin.sharepoint.com -Credential email address removed for privacy reasons

(Here Url: yoursharepointlink-admin.sharepoint.com , Credentials: credential of global admin)
( Eg: Contoso- admin.sharepoint.com , Credential: email address removed for privacy reasons)

- Set-SPOTenant -EnableAIPIntegration $true
Once this command has been executed, AIP and SPO Integration is enabled.

- Get-SPOTenant
You can check here to see if EnableAIPIntegration is now true.