Microsoft Purview Email protection: How to Disable "Do not Forward" and Sensitivity label protection to attachments without protection

Question

Microsoft Purview Email protection: How to Disable "Do not Forward" and Sensitivity label protection to attachments without protection

Sergio Londono 886

Hello team,

I disabled the inheritance protection from email to attachment

Set-IRMConfiguration -DecryptAttachmentForEncryptOnly $true

https://learn.microsoft.com/en-us/azure/information-protection/configure-usage-rights#encrypt-only-option-for-emails

User's image

however, this settings only disable the protection inheritance for the "Only-encrypt", it doesn't disable the protection from sensitivity label or "do not forward".

is there any way to disable all the inheritance?

User's image

We need to be able to disable all the inheritance.

the command only apply to disable inheritance for the Only-encrypt template:

Set-IRMConfiguration -DecryptAttachmentForEncryptOnly $true

how can disable the inheritance from email to attachment?

phemanth 15,765 Reputation points Microsoft External Staff Moderator

2024-10-07T01:45:32.8466667+00:00
@Sergio Londono

Thanks for reaching out to Microsoft Q&A.

To disable all inheritance of protection from emails to attachments, including “Do not Forward” and sensitivity label protection, you need to adjust the settings for sensitivity labels and their associated policies. Here are the steps you can follow:

Remove Sensitivity Labels:

Navigate to the Microsoft Purview compliance portal.

Go to Information protection > Labels.

Review and modify the sensitivity labels and their associated policies.

Disable “Do Not Forward”:

Open the Registry Editor.

Navigate to HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\DRM.

Create a new DWORD (32-bit) Value named DisableDNF.

Set the value of DisableDNF to 1.

Adjust IRM Configuration:

Use the following command to disable inheritance for the “Only-encrypt” template:
Set-IRMConfiguration -DecryptAttachmentForEncryptOnly $true

Unfortunately, there isn’t a direct command to disable inheritance for all types of protection, but modifying the sensitivity labels and registry settings as mentioned above should help achieve the desired outcome.

1: Why are my emails being sent as protected emails and how do I turn it off?

2: Encrypt-Only and Do Not Forward Management

Hope this helps. Do let us know if you any further queries.
phemanth 15,765 Reputation points Microsoft External Staff Moderator

2024-10-08T06:17:10.7433333+00:00

@Sergio Londono We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Sergio Londono 886 Reputation points

2024-10-08T15:16:23.0833333+00:00
Hello @phemanth

Thanks for your reply,

unfortunately, from my research, there is not way to disable inheritance from email to attachment when email is protected by:

Template Do not forward

Sensitivity label with encryption

It looks like the AIP can't be disable and block the inheritance to attachment.

We will keep your answer here for the rest of the community until something new come up.

thanks for your quick reply and help with this question.
phemanth 15,765 Reputation points Microsoft External Staff Moderator

2024-10-09T08:04:58.3033333+00:00

@Sergio Londono

Glad to know your issue has been resolved. Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others "I'll repost your solution in case you'd like to accept the answer.

Appreciate if you could share the feedback on our feedback channel. Which would be open for the user community to upvote & comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature.

Accepted answer

0 additional answers

Your answer

phemanth 15,765 Reputation points Microsoft External Staff Moderator

2024-10-07T01:45:32.8466667+00:00

@Sergio Londono

Thanks for reaching out to Microsoft Q&A.

To disable all inheritance of protection from emails to attachments, including “Do not Forward” and sensitivity label protection, you need to adjust the settings for sensitivity labels and their associated policies. Here are the steps you can follow:

Remove Sensitivity Labels:

Navigate to the Microsoft Purview compliance portal.

Go to Information protection > Labels.

Review and modify the sensitivity labels and their associated policies.

Disable “Do Not Forward”:

Open the Registry Editor.

Navigate to HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\DRM.

Create a new DWORD (32-bit) Value named DisableDNF.

Set the value of DisableDNF to 1.

Adjust IRM Configuration:

Use the following command to disable inheritance for the “Only-encrypt” template:
Set-IRMConfiguration -DecryptAttachmentForEncryptOnly $true

Unfortunately, there isn’t a direct command to disable inheritance for all types of protection, but modifying the sensitivity labels and registry settings as mentioned above should help achieve the desired outcome.

1: Why are my emails being sent as protected emails and how do I turn it off?

2: Encrypt-Only and Do Not Forward Management

Hope this helps. Do let us know if you any further queries.
phemanth 15,765 Reputation points Microsoft External Staff Moderator

2024-10-08T06:17:10.7433333+00:00

@Sergio Londono We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Sergio Londono 886 Reputation points

2024-10-08T15:16:23.0833333+00:00

Hello @phemanth

Thanks for your reply,

unfortunately, from my research, there is not way to disable inheritance from email to attachment when email is protected by:

Template Do not forward

Sensitivity label with encryption

It looks like the AIP can't be disable and block the inheritance to attachment.

We will keep your answer here for the rest of the community until something new come up.

thanks for your quick reply and help with this question.
phemanth 15,765 Reputation points Microsoft External Staff Moderator

2024-10-09T08:04:58.3033333+00:00

@Sergio Londono

Glad to know your issue has been resolved. Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others "I'll repost your solution in case you'd like to accept the answer.

Appreciate if you could share the feedback on our feedback channel. Which would be open for the user community to upvote & comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature.

Answer 1

@Sergio Londono

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others ", I'll repost your solution in case you'd like to accept the answer .

Ask: I disabled the inheritance protection from email to attachment

Set-IRMConfiguration

https://learn.microsoft.com/en-us/azure/information-protection/configure-usage-rights#encrypt-only-option-for-emails

User's image

however, this settings only disable the protection inheritance for the "Only-encrypt", it doesn't disable the protection from sensitivity label or "do not forward".

is there any way to disable all the inheritance?

User's image

We need to be able to disable all the inheritance.

the command only apply to disable inheritance for the Only-encrypt template:

YAMLAI ConvertCopy

Set-IRMConfiguration

how can disable the inheritance from email to attachment?

Solution:

unfortunately, from my research, there is not way to disable inheritance from email to attachment when email is protected by:

Template Do not forward
Sensitivity label with encryption

It looks like the AIP can't be disable and block the inheritance to attachment.

We will keep your answer here for the rest of the community until something new come up.

Appreciate if you could share the feedback on our feedback channel. Which would be open for the user community to upvote & comment on. This allows our product teams to effectively prioritize your request against our existing feature backlog and gives insight into the potential impact of implementing the suggested feature.

If I missed anything please let me know and I'd be happy to add it to my answer, or feel free to comment below with any additional information.

If you have any other questions, please let me know. Thank you again for your time and patience throughout this issue.

Please don’t forget to Accept Answer and Yes for "was this answer helpful" wherever the information provided helps you, this can be beneficial to other community members.

Share via

Microsoft Purview Email protection: How to Disable "Do not Forward" and Sensitivity label protection to attachments without protection

0 additional answers

Your answer