File types supported by the Microsoft Information Protection SDK

The Microsoft Information Protection SDK can apply the following to documents and emails:

• Labeling only

• Labeling and protection

• Protection only

The following information describes the file types supported by the MIP SDK.

File types supported for labeling only

You can label the following file types even when they aren't protected.

• Adobe Portable Document Format: .pdf

• Microsoft Power BI: .pbit, .pbix

• Microsoft Project: .mpp, .mpt

• Microsoft Publisher: .pub

• Microsoft XPS: .xps .oxps

• Images: .jpg, .jpe, .jpeg, .jif, .jfif, .jfi, .png, .tif, .tiff

• Autodesk Design Review 2013: .dwfx

• Adobe Photoshop: .psd

• Digital Negative: .dng

• Microsoft Office: File types in the following table.

  The supported file formats for these file types are the 97-2003 file formats and Office Open XML formats for the following Office programs: Word, Excel, and PowerPoint.

  Office file type	Office file type
  .doc .docm .docx .dot .dotm .dotx .potm .potx .pps .ppsm .ppsx .ppt .pptm .pptx .vdw	.vsdm .vsdx .vss .vssm .vst .vstm .vssx .vstx .xls .xlsb .xlt .xlsm .xlsx .xltm .xltx

More file types support labeling when they are also protected. For these file types, see the Supported file types for classification and protection section.

For example, if a General label doesn't apply protection, you could apply the General label to a file named sales.pdf, but you couldn't apply the label to a file named sales.txt.

If a Confidential \ All Employees label applies protection, you could apply the label to a file named sales.pdf and a file named sales.txt.

File types supported for protection

The Microsoft Information Protection SDK supports protection at two different levels, as described in the following table.

Type of protection	Native	Generic
Description	For text, image, Microsoft Office (Word, Excel, PowerPoint) files, .pdf files, and other application file types that support a Rights Management service, native protection provides a strong level of protection that includes both encryption and enforcement of rights (permissions).	For all other applications and file types, generic protection provides a level of protection that includes both file encapsulation using the .pfile file type and authentication to verify if a user is authorized to open the file.
Protection	Native protection enforces file protection in the following ways: - Users who receive the file through email or get access to it through file or share permissions must authenticate successfully before protected content renders. - When the content renders in the Microsoft Purview Information Protection viewer for protected text and image files or in the associated application for all other supported file types, the viewer or application enforces usage rights and policy that the content owner set when protecting the files.	Generic protection enforces file protection in the following ways: - People who are authorized to open the file and given access to it must authenticate successfully before protected content renders. If authorization fails, the file doesn't open. - The file displays usage rights and policy set by the content owner to inform authorized users of the intended usage policy. - Audit logging records authorized users opening and accessing files. However, usage rights aren't enforced.
Default for file types	The following file types use native protection by default: - Text and image files - Microsoft Office (Word, Excel, PowerPoint) files - Portable document format (.pdf) For more information, see the following section, Supported file types for labeling and protection.	All other file types that aren't supported by native protection, such as .vsd and .rtf, use generic protection by default.

You can change the default protection level that the Microsoft Information Protection SDK applies. You can change the default level from native to generic, from generic to native, and even prevent the Microsoft Information Protection SDK from applying protection.

File sizes supported for protection

In Microsoft Information Protection SDK 1.6, the default maximum file size is 6 GB. You can override this setting if needed. Lesser defaults for legacy Office platforms still apply.

Starting in MIP SDK 1.7.133, you can override the 6-GB default by setting the max_file_size_for_protection custom setting on FileEngineSettings. Specify the value in bytes. The following C# example raises the limit to 10 GB.

engineSettings.CustomSettings = new List<KeyValuePair<string, string>>();
engineSettings.CustomSettings.Add(new KeyValuePair<string, string>("max_file_size_for_protection", (10L * 1024 * 1024 * 1024).ToString()));

Caution

Decryption requires at least the file size in available memory. Raising this limit increases memory use, so set the value only as high as your application requires.

• For Office files:

  Office application	Maximum file size supported
  Word 2007 (supported by AD RMS only) Word 2010 Word 2013 Word 2016	32-bit: 512 MB 64-bit: 512 MB
  Excel 2007 (supported by AD RMS only) Excel 2010 Excel 2013 Excel 2016	32-bit: 2 GB 64-bit: Limited only by available disk space and memory
  PowerPoint 2007 (supported by AD RMS only) PowerPoint 2010 PowerPoint 2013 PowerPoint 2016	32-bit: Limited only by available disk space and memory 64-bit: Limited only by available disk space and memory

• Power BI

The Microsoft Information Protection SDK supports labeling and protection of Power BI .pbix files. You can label these files with the File SDK and open them in Power BI Desktop, or upload them to the Power BI service.

• For all other files:

  When you protect other file types or remove protection from them by using the MIP SDK, available disk space and memory limit the maximum file size.

Supported file types for labeling and protection

The following table lists a subset of file types that support native protection by the Microsoft Information Protection SDK, and that can also be labeled.

This table identifies these file types separately because when they're natively protected, the original file name extension changes and these files become read-only. When you protect files generically, the original file name extension always changes to .pfile.

Warning

If your environment has firewalls, web proxies, or security software that inspect and take action according to file name extensions, you might need to reconfigure these network devices and software to support these new file name extensions.

Original file name extension	Protected file name extension
.txt	.ptxt
.xml	.pxml
.jpg	.pjpg
.jpeg	.pjpeg
.pdf	.ppdf [1]
.png	.ppng
.tif	.ptif
.tiff	.ptiff
.bmp	.pbmp
.gif	.pgif
.jpe	.pjpe
.jfif	.pjfif

Note

When you use the File SDK's FileHandler with an output stream, open it with read/write access. Using a stream that doesn't support read and write access might result in an Unknown Error.

Footnote 1

In the latest version of the Microsoft Information Protection SDK, the file name extension of the protected PDF document remains as .pdf.

The following table lists the remaining file types that support native protection by the Microsoft Information Protection SDK, and that can also be labeled. These file types are for Microsoft Office apps. The supported file formats for these file types are the 97-2003 file formats and Office Open XML formats for the following Office programs: Word, Excel, and PowerPoint.

For these files, the file name extension remains unchanged after a Rights Management service protects the file.

File types supported by Office	File types supported by Office
.doc .docm .docx .dot .dotm .dotx .potm .potx .pps .ppsm .ppsx .ppt .pptm .pptx .vsdm	.vsdx .vssm .vssx .vstm .vstx .xls .xlsb .xlt .xlsm .xlsx .xltm .xltx .xps

Limitations for container files, such as .zip, .msg, and .eml files

Container files include other files. For example, .zip files contain compressed files. Other examples include .rar files, .7z files, .msg files, .rpmsg files, and PDF documents that include attachments.

You can label and protect these container files, but the SDK doesn't apply labeling and protection to each file inside the container. Similarly, you can unprotect a protected container file with the SDK, but removing protection from the container doesn't recursively remove protection from the files inside it. Application developers are responsible for recursing and unprotecting any files within the containers.

If a container file includes labeled and protected files, first extract the files to change their label or protection settings.