Apply default label to emails - does not work

Question

Hi,

We have a single AIP Policy, and the "Apply default label to emails" is set to "same as document" - but this has never worked.
We are using the latest Office 365 (Word, Outlook, etc).

As a typical example - my attachment has been label as "Highly Confidential", but the email itself, stays at the default "General" label - and does not apply the same label as the attached document.

Any ideas why this basic AIP functionality might not be working?

Thank you
SK

Answer 1

It seems we found the issue shortly after posting. You need to change the Advanced Settings for the policy so that it is aware of this.

You need to do the following;

Connect to the Compliance Powershell

Import-Module ExchangeOnlineManagement
Connect-IPPSSession -UserPrincipalName %username%

Get the current Label Policy Settings

(Get-LabelPolicy -Identity "Global").settings

Enable the Advanced Settings for AIP in the Policy

Set-LabelPolicy -Identity "Global" -AdvancedSettings @{EnableCustomPermissions="False"}

Set the AttachmentAction Advanced Setting to Automatic

Set-LabelPolicy -Identity "Global" -AdvancedSettings @{AttachmentAction="Automatic"}

Give it 10-15 mins and it will work.

Answer 2

@Shim Kwan Make sure you are on the latest outlook version.

Answer 3

Hi @Shim Kwan , labels not updating could sometimes be fixed by just reopening the apps. From this document:

The Azure Information Protection client checks for any changes whenever a supported Office application starts, and downloads the changes as its latest Azure Information Protection policy. Additional triggers that refresh the policy on the client:

• Right-click to classify and protect a file or folder.
• Running the PowerShell cmdlets for labeling and protection (Get-AIPFileStatus, Set-AIPFileClassification, and Set-AIPFileLabel).
• Every 24 hours.
• For the Azure Information Protection Scanner: When the service starts (if the policy is older than an hour), and every hour during operation.

Note

When the client downloads the policy, be prepared to wait a few minutes before it's fully operational. The actual time varies, according to factors such as the size and complexity of the policy configuration, and the network connectivity. If the resulting action of your labels does not match your latest changes, allow up to 15 minutes and then try again.

Please let me know if this doesn't work or if you have any questions.

If this answer helped you please mark it as "Verified" so other users can reference it.

Thank you,
James