Purview Information Protection - is label override possible?

Shim Kwan 281

Hi,

We have a single AIP Policy and 4 default labels.
Data containing sensitive information (e.g. Credit Card) is automatically labelled as "Confidential".

Is there a way for someone to manually relabel the document that has been automatically labelled as Confidential to another label (either lower or higher in precedence - so 'General' or 'Highly Confidential') and for that new label to remain?

Because at the moment, after someone manually changes the label, they close and reopen the document, the document reverts back to "Confidential".

Is there a way to setup something to allow for "Label Overrides"?
Or perhaps something that would only auto-apply a label the first time to a document, and thereafter any manual change would be enforced?

Thank you,
SK

KranthiPakala-MSFT 46,422 Reputation points Microsoft Employee

2022-09-02T22:22:46.763+00:00

Hello @Shim Kwan ,

Thanks for the question and using MS Q&A platform.

As per my conversation with product team, Manual labeling takes precedence over auto labeling, which means that if a file is manually labeled and subsequently triggers an auto label policy, then the auto label won’t apply.

If the user has label downgrade justification in place, then manually downgrading an auto labeled file will result in a justification prompt to the user.

Seems like the behavior you have described abnormal and hence it should probably be investigated.

For deeper investigation of this issue, we recommend filing a support ticket and share the sR# with us here. In case if you don't have a support plan, please let me know here.

Thank you
KranthiPakala-MSFT 46,422 Reputation points Microsoft Employee

2022-09-05T23:51:14.177+00:00

Hello @Shim Kwan ,

Just checking to see if you have got a chance to file a support ticket. If yes, could you please share the SR# with us here. In case if you don't have a support plan, do let us know here.

Thanks
Shim Kwan 281 Reputation points

2022-09-07T04:06:52.473+00:00

Hi,
We are still testing and will post incident number in here, once submitted.
thank you for following up.
cheers
KranthiPakala-MSFT 46,422 Reputation points Microsoft Employee

2022-09-08T08:23:18.877+00:00

Hello @Shim Kwan ,

Thanks for the update. Please keep us posted as soon as you have an update regarding the same. Thank you
Shim Kwan 281 Reputation points

2022-09-12T04:42:49.567+00:00
Hi @KranthiPakala-MSFT

We have conducted a lot more testing, all resulting in the same behavior.

Create a new Word document with PCI data in it. Auto-label policy applies the 'Confidential' label as expected (although with some delays, of up to 2 hours!)

I open the document using the Word application on my laptop, manually downgrade the label to 'General' (a lower label). Save and Close the document.

I open the document using the Word application on my laptop, the 'General' label is displayed, but after a few seconds, the 'Confidential' label is auto re-applied

The logs clearly show re-application of the label by "AutoByPolicyMatch" and "LabelUpgraded"

What is very interesting though is that the behavior via the Word Online application is different and matches the expected behavior as described in: https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide#how-automatic-or-recommended-labels-are-applied

"When content has been manually labeled, that label won't be replaced by automatic labeling"

It might be time for a MS Support call.

Cheers.
KranthiPakala-MSFT 46,422 Reputation points Microsoft Employee

2022-09-15T16:48:55.06+00:00

Hello @Shim Kwan ,

Thanks for the update.

Yes, this definitely needs a deeper investigation. Could you please file a support ticket and do share the SR# with us here for tracking it internally. In case if you don't have a support plan, please let me know.

Thanks