File/Content Protecton Using Purview Encryption

Question

I am looking to achieve the following:

1. Apply a default Microsoft Purview file label of "Internal" to all files created by an end-user. This "Internal" label can (if necessary) be modified by the end user to one of 2 other alternate labels --- "Public" or "Confidential". If the user chooses to downgrade the classification to "Public" they are engaged with a visible prompt requesting justification. In none of these cases is encryption/protection applied to the file.
2. Apply a "Restricted" label (using the on-premise Purview scanner" to files located in policy-driven locations (such as a specific on-premise file share). Applying this label removes the "EXTRACT permissions and thus applies file-level encryption (my understanding is those 2 things are always true --- once you apply granular permissions, the file itself is also encrypted).
3. Allow the ability for an end-user to attach a file with a "Restricted" label and send it to a 3rd-party outside of the organization and ensure they can open the file without issue (regardless if they are a Microsoft customer or not).
4. Ensure certain Microsoft Office files (specifically those labeled as "Restricted") are not leveraged by Microsoft Copilot (mitigating the likelihood that someone in one departmentA cannot leverage an AI prompt that will surface "restricted" information from another departmentB (that was not meant for visibilty by department A). My understanding is that this can be accomplished by removing the "EXTRACT" permission applied to the file as mentioned earlier in #2.

We have attempted to use service-side auto-labeling to modify the label from "Restricted" to "Restricted_External (a label that does not have permissions applied) but have not been successful so far. Is this simply a limitation of the auto-labeling (in that it does not have the ability to modify the attachment itself)?

Answer 1

Hello, Jacob O'Mara

Thank you for visiting Microsoft Community. 

I realize that you have some problems with file/content protection in Microsoft Purview. I understand how you feel.  
 
You may refer to the following article:

Microsoft Purview Information Protection | Microsoft Learn

Since your problem is related to Microsoft Purview, I sincerely recommend you publish it on Microsoft Learn if you need further assistance. 

More users post these issues there. There are experts who can provide more professional solutions in that place.

Here is a link to the forum: Microsoft Purview - Microsoft Q&A 

You can click on "Ask a Question". 

Sincerely hope that your question will be dealt with appropriately after contact the correct department. Thank you for your understanding! 

Best wishes, 

Lucia Wu - MSFT | Microsoft Community Support Specialist