Federal Modernization Workbook · Book 20 · How
Chapter 07 — SharePoint and OneDrive
An encrypted file that the service can’t read is invisible to search, to eDiscovery and to DLP; turning on label integration is what lets protection and oversight coexist.
What changes when SharePoint and OneDrive can read the files that sensitivity labels encrypt, and what stays broken until they can. How to turn label integration on, add PDF support, and avoid the label encryption settings the service can’t process. How to find libraries still protected by SharePoint Information Rights Management (IRM), and how to move them to labels, including what to do in GCC, GCC High and DoD, where the default library label is still in development. How to turn on co-authoring for encrypted files without breaking the apps that read labels the old way. Each procedure follows the How template, with rollback, telemetry, evidence and ownership.
Chapter 04 governed sites and teams as containers: privacy, guests, external sharing and unmanaged devices. This chapter is about the files inside them. A container label doesn’t label the files in the container;1 the files carry their own labels, applied by people (Chapter 03) or by policy (Chapter 09). When one of those labels encrypts, the file in SharePoint or OneDrive is ciphertext to the service unless the agency has told SharePoint and OneDrive to process labeled content.
That is the setting this chapter turns on first, because without it the rest of the book quietly fails. Until it is enabled, SharePoint and OneDrive can’t process encrypted files, “which means that coauthoring, eDiscovery, data loss prevention, search, and other collaborative features won’t work for these files.”2 An agency that publishes encrypting labels before enabling it ends up with its most sensitive documents being the ones its DLP can’t see and its records team can’t find.
- Microsoft Zero Trust pillar: Data
- CISA ZTMM pillar: Data (Data Encryption; Data Access; Data Inventory Management)
- Depends on: Rights Management active (Chapter 05); the label design and publication (Chapter 02, Chapter 03); container labels (Chapter 04); for DLP and search on encrypted content, Chapter 08 and Chapter 10
- Attack chain interrupted: Collection and Exfiltration (encrypted content stays inspectable by DLP and eDiscovery inside the tenant, and protected when downloaded)
Control states.
| State | This page | Evidence |
|---|---|---|
| Designed | Decide | Decision record (template) for integration, PDF support, each IRM library’s disposition and co-authoring |
| Configured | Label integration; IRM inventory | Get-SPOTenant export; IRM library inventory |
| Enforced | Enforcement; IRM enforcement; co-authoring | Integration and PDF settings True; IRM disabled on migrated libraries; co-authoring on |
| Evidenced | Validate | Test record with audit events for label applied, changed and removed |
| Operated | Day-two ownership | Monthly IRM library reconciliation; drift check on the tenant settings |
A finding this page addresses is ready for closure when every applicable state has evidence; the authorizing official or assessor decides.
What label integration changes
After integration is enabled, for new and changed files whose label encrypts with a cloud-based key (not Double Key Encryption), Microsoft documents that:3
- SharePoint and OneDrive recognize the label on Word, Excel, PowerPoint and uploaded PDF files and can process their contents;
- users can open and edit those files in Office for the web, with the label’s permissions enforced, and apply labels from the ribbon or the details pane, including from the Files tab in Teams;
- eDiscovery supports full-text search, and DLP policies support the content;
- the label and its encryption stay with the file when it is downloaded;
- three audit events become available: Applied sensitivity label to file, Changed sensitivity label applied to file and Removed sensitivity label from file.
What it doesn’t change matters as much, because each item below is a way a protected file can drop out of view:4
| Limit | Consequence | The program’s response |
|---|---|---|
| Files already in SharePoint, labeled with encryption before integration was turned on | Not processed until they are edited, or downloaded and uploaded again | Count them in the Validate step; touch them through the owners’ review in Chapter 12 |
| Labels whose encryption sets User access to content expires to anything but Never, or uses Double Key Encryption | The service can’t process them; the labels aren’t shown in Office for the web, and nor are their sublabels if they are parents | Don’t set expiry on labels used in SharePoint (Book 12, Chapter 09 already rules out default expiry); keep DKE to the narrowest set and store it outside the collaboration path |
| Password-protected documents | Labels can’t be read or applied | DLP condition on password-protected attachments where needed (Chapter 08) |
| Encrypted Office files over 12 MB copied or moved to a different site | No longer processed; label not shown | Move large protected files within the site, or relabel after the move |
| Files with Power Query data, custom XML parts, a bibliography or a Document ID added on upload, labeled and encrypted in desktop apps | Not processed | Label without encryption where these features are needed, or open in desktop apps |
| A label deleted rather than removed from its policy | Files downloaded from SharePoint are no longer labeled or encrypted | Never delete a production label; retire it through the label policy (Chapter 03) |
| Printing, downloading, exporting or copying an encrypted file from Office for the web | Not supported | Users open the desktop app; the help desk script says so |
Authority: Microsoft-recommended. Microsoft’s guidance is to enable sensitivity labels for Office files in SharePoint and OneDrive so that the services can process encrypted files, and to tell users to protect documents with labels only.5 Applies: License-dependent: encrypting labels need a Rights Management service plan (Chapter 05). Environment-dependent: see the availability table.
How: move legacy IRM libraries to sensitivity labels
SharePoint IRM is the older protection: it applies encryption and restrictions to files at the list or library level when they are downloaded, so that a downloaded file stays protected outside SharePoint.29 Learn describes three costs: documents in an IRM-enabled library can’t be created or edited in Office in a browser, one person at a time downloads and edits, and collaboration falls back to check-in and check-out.30 It also interacts badly with labels: a file uploaded with an encrypting label into an IRM library isn’t processed, so co-authoring, eDiscovery, DLP and search don’t work for it.31 Labels carry the same protection, plus markings and the full set of usage rights, and travel with the file wherever it is stored.
Prerequisites
- Label integration on (previous procedure).
- For each library, an owner and a target label from Chapter 02 whose permissions match what the IRM policy allowed (who can open, print, copy, and for how long).
- Inventory tooling. No SharePoint Online Management Shell cmdlet reports IRM per library. The
IrmEnabledproperty is on each list in the SharePoint client object model.32 The script below reads it with PnP PowerShell, a community-maintained module that isn’t a Microsoft-supported product; the agency’s change board approves its use, and it needs an app registration (<app-id>) with read access to the sites.
Pilot
Inventory every site, then migrate one library whose owner volunteers. Run the inventory first (read-only):
# 1. List sites with the SharePoint Online Management Shell (connected above).
$sites = Get-SPOSite -Limit All | Select-Object -ExpandProperty Url
# 2. For each site, read IrmEnabled on every list (PnP PowerShell, read-only).
# GCC High and DoD: add -AzureEnvironment USGovernmentHigh or USGovernmentDoD to Connect-PnPOnline.
Install-Module -Name PnP.PowerShell -Scope CurrentUser
$rows = foreach ($site in $sites) {
Connect-PnPOnline -Url $site -Interactive -ClientId <app-id>
foreach ($list in Get-PnPList) {
$null = Get-PnPProperty -ClientObject $list -Property IrmEnabled
if ($list.IrmEnabled) { [pscustomobject]@{ Site = $site; Library = $list.Title; IrmEnabled = $true } }
}
}
$rows | Export-Csv -Path "<inventory-file>" -NoTypeInformationThe pilot succeeds when the pilot library’s files all carry the target label, owners can co-author them in the browser and desktop apps, and a downloaded file opens only for holders.
Report-only or audit phase
The inventory is the report-only phase: nothing changes until each library’s owner signs its row. For each IRM library, record the IRM policy settings from Library Settings > Information Rights Management (the restriction on download, the policy title and the extra options), which Learn documents per library.33
Enforcement
Per library, in this order:
- Label the files.
- Commercial: set the library’s default sensitivity label (Library settings in SharePoint) so new and unlabeled uploads take the target label, then have owners label existing files from the details pane, which supports labeling without opening each file.34
- GCC, GCC High and DoD: the default library label is In development on all three government pages,353637 so owners apply the target label to existing files from the details pane or in Office for the web, and a service-side auto-labeling policy scoped to the site (Chapter 09) catches files that match its conditions. IRM stays on the library during this step, so downloads remain protected.
- Check coverage. Search the library for files without the target label. The managed property
InformationProtectionLabelId:<label-guid>finds files that carry a label;Get-Label | Format-Table Name, Guidin Security & Compliance PowerShell gives the GUID.38 - Turn IRM off on the library, in Library Settings > Information Rights Management, by clearing Restrict permission to documents in this library on download.39 From then on, downloads carry the label’s protection rather than IRM’s.
- Edit or re-upload any file that was labeled and encrypted before integration was turned on, so the service processes it.40
Change safety
| Ring | Scope | Exit criteria |
|---|---|---|
| 0 | A test library with IRM on | Labeled files remain protected on download after IRM is turned off |
| 1 | The volunteer library | Owner sign-off; no access complaints for two weeks |
| 2 | Libraries holding CUI Basic | Coverage check 100 percent before IRM is turned off |
| 3 | Remaining IRM libraries | Inventory shows no IRM library without a signed disposition |
- Emergency access: not applicable.
- Change window: agreed with each library owner.
- Backout triggers: files found unlabeled after IRM was turned off; owners unable to open their own files.
- Post-change validation: Validate, plus a download test from the migrated library.
Rollback
Turn IRM back on for the library in Library Settings > Information Rights Management; the labels already applied stay on the files. Learn’s coexistence rules then apply: files labeled with encryption keep the label’s settings on download, and unencrypted Office and PDF files get the IRM restriction.41 A site owner or SharePoint administrator can do it in minutes.
Exclusions
Libraries whose content the records officer says can’t be relabeled (for example a closed records library under a hold) keep IRM, recorded in the exception register with the reason and a review date.
Telemetry
The inventory, rerun monthly, is the drift signal for IRM. Label audit events show the labeling progress per library.
Evidence
Evidence checklist
Day-two ownership
The policy owner approves each library’s target label; the platform owner runs the monthly inventory; site owners label their files. The program’s metrics in Chapter 12 count IRM libraries remaining, not libraries migrated.
Validate: labeled files behave
| Test | Expected outcome | Evidence |
|---|---|---|
| A holder applies an encrypting label in Office for the web in a pilot library | Label shown in the Sensitivity column; Applied sensitivity label to file in audit | Audit record |
| A second holder opens the same file in Office for the web | Opens and edits with the label’s rights | Tester’s record |
| Search for a unique phrase in the encrypted file | Found by a holder | Screenshot |
| A DLP test policy matching the phrase (Chapter 08) | Matches the encrypted file | DLP activity record |
| Download the file and open it as a non-holder | Refused | Usage log denial (Chapter 05) |
| Two holders co-author in desktop apps (after co-authoring is on) | Both edit at once; AutoSave works | Tester’s record |
| A file labeled before integration was turned on | Not processed until edited; processed after editing | Before-and-after record |
| An administrator removes a label and encryption from a test file for recovery | Label and encryption removed; Removed sensitivity label from file carries the justification | Audit record |
For the last test, a SharePoint administrator can remove both the label and the encryption even without access to the site or file, provided the encryption came from a label with admin-defined permissions; the justification goes into the audit event and the Rights Management usage log:55
Unlock-SPOSensitivityLabelEncryptedFile -FileUrl "<file-url>" -JustificationText "<ticket-number>"Because that cmdlet bypasses the file’s permissions, the program holds it to the same approval as a super user recovery (Chapter 05) and alerts on its use.
Key takeaways
- Turn label integration on before encrypting labels go wide; until it is on, encrypted files are invisible to search, eDiscovery and DLP and can’t be co-authored.
- Labels with expiry or Double Key Encryption can’t be processed in SharePoint; keep them out of collaboration.
- Move IRM libraries to labels library by library. In the government clouds, where default library labels are still in development, keep IRM on until the files are labeled.
- Co-authoring for encrypted files changes labeling metadata and can’t be cleanly reversed; inventory every label-reading app first.
Book 12, Chapter 09, “Labels on Teams, groups and sites,” which cites Microsoft Learn, “Use sensitivity labels to protect content in Microsoft Teams, Microsoft 365 groups, and SharePoint sites” (files in a labeled container don’t inherit the container label), Book 12, Chapter 09.↩︎
Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable co-authoring for files encrypted with sensitivity labels,” sections “Metadata changes for sensitivity labels,” “Prerequisites,” “Limitations,” “How to enable co-authoring for files with sensitivity labels” (portal steps; wait 24 hours) and “If you need to disable this feature” (
Set-PolicyConfig -EnableLabelCoauth:$false; labeling information lost), https://learn.microsoft.com/purview/sensitivity-labels-coauthoring (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC deployments,” Step 4 table, Sensitivity labeling rows (status “subject to change”), https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC High deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-high-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions - DoD deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC deployments,” Step 4 table, Sensitivity labeling rows (status “subject to change”), https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC High deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-high-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions - DoD deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC deployments,” Step 4 table, Sensitivity labeling rows (status “subject to change”), https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC High deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-high-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions - DoD deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC deployments,” Step 4 table, Sensitivity labeling rows (status “subject to change”), https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC High deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-high-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions - DoD deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Connect-SPOService,” Example 4 (
-Region ITAR, the authentication region) and Description (SharePoint Administrator required), https://learn.microsoft.com/powershell/module/microsoft.online.sharepoint.powershell/connect-sposervice (accessed Nov 11, 2026).↩︎Microsoft Learn, “Microsoft 365 U.S. Government GCC High endpoints,” section “SharePoint Online and OneDrive for Business” (
*.sharepoint.us), https://learn.microsoft.com/microsoft-365/enterprise/microsoft-365-u-s-government-gcc-high-endpoints (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive,” section “SharePoint Information Rights Management (IRM) and sensitivity labels” (IRM protects files at list and library level on download), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Set up Information Rights Management (IRM) in SharePoint admin center,” section “IRM-enable SharePoint document libraries and lists” (can’t create or edit in Office in a browser; one person at a time; check-in and check-out), https://learn.microsoft.com/purview/set-up-irm-in-sp-admin-center (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “.NET API reference, List.IrmEnabled Property (Microsoft.SharePoint.Client),” https://learn.microsoft.com/dotnet/api/microsoft.sharepoint.client.list.irmenabled (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Apply Information Rights Management (IRM) to a list or library,” section “Apply IRM to a list or library” (Library Settings > Information Rights Management; “Restrict permission to documents in this library on download”), https://learn.microsoft.com/purview/apply-irm-to-a-list-or-library (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC deployments,” Step 4 table, Sensitivity labeling rows (status “subject to change”), https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC High deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-high-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions - DoD deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Apply Information Rights Management (IRM) to a list or library,” section “Apply IRM to a list or library” (Library Settings > Information Rights Management; “Restrict permission to documents in this library on download”), https://learn.microsoft.com/purview/apply-irm-to-a-list-or-library (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable co-authoring for files encrypted with sensitivity labels,” sections “Metadata changes for sensitivity labels,” “Prerequisites,” “Limitations,” “How to enable co-authoring for files with sensitivity labels” (portal steps; wait 24 hours) and “If you need to disable this feature” (
Set-PolicyConfig -EnableLabelCoauth:$false; labeling information lost), https://learn.microsoft.com/purview/sensitivity-labels-coauthoring (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable co-authoring for files encrypted with sensitivity labels,” sections “Metadata changes for sensitivity labels,” “Prerequisites,” “Limitations,” “How to enable co-authoring for files with sensitivity labels” (portal steps; wait 24 hours) and “If you need to disable this feature” (
Set-PolicyConfig -EnableLabelCoauth:$false; labeling information lost), https://learn.microsoft.com/purview/sensitivity-labels-coauthoring (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable co-authoring for files encrypted with sensitivity labels,” sections “Metadata changes for sensitivity labels,” “Prerequisites,” “Limitations,” “How to enable co-authoring for files with sensitivity labels” (portal steps; wait 24 hours) and “If you need to disable this feature” (
Set-PolicyConfig -EnableLabelCoauth:$false; labeling information lost), https://learn.microsoft.com/purview/sensitivity-labels-coauthoring (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable co-authoring for files encrypted with sensitivity labels,” sections “Metadata changes for sensitivity labels,” “Prerequisites,” “Limitations,” “How to enable co-authoring for files with sensitivity labels” (portal steps; wait 24 hours) and “If you need to disable this feature” (
Set-PolicyConfig -EnableLabelCoauth:$false; labeling information lost), https://learn.microsoft.com/purview/sensitivity-labels-coauthoring (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable co-authoring for files encrypted with sensitivity labels,” sections “Metadata changes for sensitivity labels,” “Prerequisites,” “Limitations,” “How to enable co-authoring for files with sensitivity labels” (portal steps; wait 24 hours) and “If you need to disable this feature” (
Set-PolicyConfig -EnableLabelCoauth:$false; labeling information lost), https://learn.microsoft.com/purview/sensitivity-labels-coauthoring (accessed Nov 11, 2026).↩︎Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC deployments,” Step 4 table, Sensitivity labeling rows (status “subject to change”), https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions – GCC High deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-gcc-high-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Plan for Microsoft Purview compliance and risk management solutions - DoD deployments,” Step 4 table, Sensitivity labeling rows, https://learn.microsoft.com/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/plan-for-microsoft-purview-dod-deployments (accessed Nov 11, 2026).↩︎
Microsoft Learn, “Enable co-authoring for files encrypted with sensitivity labels,” sections “Metadata changes for sensitivity labels,” “Prerequisites,” “Limitations,” “How to enable co-authoring for files with sensitivity labels” (portal steps; wait 24 hours) and “If you need to disable this feature” (
Set-PolicyConfig -EnableLabelCoauth:$false; labeling information lost), https://learn.microsoft.com/purview/sensitivity-labels-coauthoring (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable co-authoring for files encrypted with sensitivity labels,” sections “Metadata changes for sensitivity labels,” “Prerequisites,” “Limitations,” “How to enable co-authoring for files with sensitivity labels” (portal steps; wait 24 hours) and “If you need to disable this feature” (
Set-PolicyConfig -EnableLabelCoauth:$false; labeling information lost), https://learn.microsoft.com/purview/sensitivity-labels-coauthoring (accessed Nov 11, 2026).↩︎Microsoft Learn, “Connect to Security & Compliance PowerShell,” section “Step 2: Connect and authenticate” (GCC High and DoD ConnectionUri and AzureADAuthorizationEndpointUri values for an interactive sign-in; the app-only page gives a different DoD address,
https://compliance.dod.microsoft.com/powershell-liveid, for unattended scripts), https://learn.microsoft.com/powershell/exchange/connect-to-scc-powershell (accessed Nov 11, 2026).↩︎Microsoft Learn, “Set-PolicyConfig” (Security & Compliance PowerShell;
-EnableLabelCoauthparameter) and “Get-PolicyConfig,” https://learn.microsoft.com/powershell/module/exchangepowershell/set-policyconfig (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable co-authoring for files encrypted with sensitivity labels,” sections “Metadata changes for sensitivity labels,” “Prerequisites,” “Limitations,” “How to enable co-authoring for files with sensitivity labels” (portal steps; wait 24 hours) and “If you need to disable this feature” (
Set-PolicyConfig -EnableLabelCoauth:$false; labeling information lost), https://learn.microsoft.com/purview/sensitivity-labels-coauthoring (accessed Nov 11, 2026).↩︎Microsoft Learn, “Enable sensitivity labels for files in SharePoint and OneDrive” (until enabled, the services can’t process encrypted files; what changes for new and changed files; three audit events; existing files must be edited or re-uploaded; PDF support and its effect on auto-labeling; Limitations; the opt-in steps with
Set-SPOTenant -EnableAIPIntegration $true, about 15 minutes, per geo; module versions; the publishing safeguard; “SharePoint Information Rights Management (IRM) and sensitivity labels”;InformationProtectionLabelId;Unlock-SPOSensitivityLabelEncryptedFile; opt-out behavior), https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files (accessed Nov 11, 2026).↩︎