Sensitivity Label Retention: How Office Handles PDFs
Khurram Hafeez
MVP | M365 Copilot, M365 migrations, Active Directory deployments, MS Exchange deployments & migrations, Azure IaaS deployments & Migrations, Microsoft CSP Licensing, Technical Content Reviewer
When you create a PDF from any Office document, your existing sensitivity labels transfer automatically to the new file. This means your confidential, internal, or public classifications remain intact without any extra steps on your part.
How to Use This Feature
2. Creating a PDF is simple. From your Office document, just navigate to:
After creating your PDF, open it in a supported viewer to confirm that all protection settings have successfully transferred from your original document.
Password Protection Limitation: When source Office documents use sensitivity label encryption, PDF password protection is automatically disabled to prevent encryption conflicts.
View Protected PDFs Using Microsoft Edge
Microsoft Edge offers built-in support for viewing PDF files that are classified and protected. This native capability allows you to open protected PDF files without installing or configuring additional applications.
Requirements for Using Microsoft Edge to View Protected PDFs:
Supported Operating Systems
Authentication Requirements
Compatible File Formats
Support for Previous PDF Formats
If you're unable to open your protected PDF using Edge, the document may be protected in an earlier format. For example, Microsoft SharePoint currently uses an older format for PDF documents in IRM-protected libraries.
The following PDF readers support both protected PDFs with a .ppdf extension, and older formats with a .pdf extension:
Windows 11 and earlier through Windows 7 Service Pack
Android
iOS
View Protected Files in Windows
If you are trying to open a protected file in Windows and it does not open properly, then you will likely need to use the Microsoft Purview Information Protection viewer for the desktop.
The information protection viewer supports the following file types and environments:
Minimum operating systems include:
Sign in to the information protection viewer with:
Supported file types include protected email messages, PDF files, images, text files, and .pfile file name extensions.
For example, these .pfile files include the following extensions: .rpmsg, .pdf, .ppdf, .pjpg, .pjpeg, .ptiff, .ppng, .ptxt, .pxml
Prompts for Authentication
Before you can view a protected file, the Rights Management service that was used to protect the file must first confirm you are authorized to view it. The service performs this confirmation by checking your user name and password.
In some cases, these credentials might be cached, so you will not see a prompt asking you to sign in. In other cases, you will be prompted to supply your credentials.
Extend Sensitivity Labeling on Windows
The Microsoft Purview Information Protection client extends sensitivity labels beyond labels that are built into Microsoft 365 apps and services, and supports a wider range of file types.
It has the following components:
Information Protection Scanner
Information Protection File Labeler
Information Protection Viewer
Microsoft Purview Information Protection PowerShell Module
Requirements for Deploying the Information Protection Client
To use the Microsoft Purview Information Protection client, install this client on Windows computers where you want to use the client components.
The following operating systems support the Microsoft Purview Information Protection client:
Note: ARM64 isn't supported.
File Types That Can't Be Encrypted by Default
Any file that is password-protected can't be natively encrypted by the client unless the file is currently open in the application that applies the encryption.
Scanning .ZIP Files
You can use the information protection scanner or the Set-FileLabel PowerShell command to inspect .zip files.
Note: When your information protection scanner is installed on a Windows server computer, you must also install the Microsoft Office iFilter in order to scan .zip files for sensitive information types.
After finding sensitive information, if the .zip file should be labeled and encrypted with a label, from the scanner deployment instructions, specify the .zip file name extension with the PowerShell PFileSupportedExtensions advanced setting.
Label and Protect Files in File Explorer in Windows
You can label and protect files in File Explorer in Windows by using the Microsoft Purview Information Protection File Labeler. This method supports protecting Office documents, PDF files, images, text files, and a wide range of other files and is a convenient way to label and protect multiple files at once.
Label and Protect One or More Files
The label and protection that you apply to a file will stay with a file, even if you email the file outside your organization or save it to another location. You can use the following steps to apply a label for the first time or to change the label for already protected files.
Note: When you select a folder, all the files in that folder and any subfolders are automatically selected for the labeling and protection options that you set. However, new files that are created in that folder or its subfolders in the future will not be automatically configured with those options.
3. In the Microsoft Purview Information Protection File Labeler dialog box, use the labels the same way you would in a Microsoft 365 App, which sets the label and protection as defined by your administrator.
4. You can specify your own protection settings on labels that your administrator has defined can be set by users. To specify your own protection settings, select Protect with custom permissions. Then specify the options.
Remove Label and Protection from a File or Folder
When you use information protection file labeler, you can quickly remove labels and protection from a single file, multiple files, or a folder. When you select a folder, all the files in that folder and any subfolders it has are automatically selected.
When the label that you remove is configured to apply protection, this action also removes protection from the file. You might be prompted to document the reason why you are removing the label.
If you want to choose a different label or a different set of protection settings, you do not need to remove the label or protection first. Instead, choose a new label or define custom permissions by using the information protection file labeler. If you are downgrading a label (for example, moving a label from Highly Confidential to Confidential) then you might need to provide justification.
Important: You must be the owner of the file to remove protection, or you must have been granted permission to remove protection (the Rights Management permission of Export or Full Control).
3. Click Apply and Close.
Note: Some files, such as executable files and your Windows folder, are automatically excluded from labeling and protection because changing them might stop your PC from running. Although you can select these files, they will be excluded from labeling.