This article answers common questions about the Microsoft Information Protection (MIP) SDK. For known problems and error messages, see MIP SDK troubleshooting.
General
How many labels are supported by MIP SDK?
MIP SDK supports up to 500 encrypted sensitivity labels. Labels that don't use encryption aren't subject to this limit. Tenants with a large number of sensitivity labels might experience some performance impact. For more information, see Sensitivity label limitations.
Does MIP SDK support relabeling .pfile types with classification labels?
No, this is by design because pfiles are protected file types. Decrypt with the Microsoft Purview Information Protection File Labeler before classification.
Why are protected files downloaded from Microsoft Teams failing to decrypt?
This is a known problem in unsupported versions of the MIP SDK. Upgrade to the latest version of the MIP SDK.
How do I check what labels are applied when multiple labels from different tenants are applied to a file?
Query the GetLabel method in the context of the user for each tenant.
Metadata storage changes
Are other formats impacted, such as PDF?
Microsoft announced a change to the label metadata storage location for Office files (Word, Excel, and PowerPoint) to support new features in Office 365, SharePoint Online, and other services. No other file formats are affected, only Office files, specifically Word, Excel, and PowerPoint files.
Is there a specific version of MIP SDK that is required?
MIP SDK 1.7 and later are fully compatible.
Is there a specific version of the Office client that is required to use this storage location?
All Microsoft 365 Apps clients released after September 2021 support this new metadata location. The new storage location isn't used until the tenant administrator enables the protected coauthoring feature.
Is existing metadata stored as a custom property in *custom.xml* kept up to date?
No. The first time you save the document after enabling the new storage location, label metadata moves to the new location. Metadata written by using LabelingOptions.ExtendedProperties remains in custom.xml.
Is it possible to read the label metadata without MIP SDK?
Yes, but you must implement your own code to parse the file and extract the information.
Currently, it's easy to "read" the label by extracting the key/value pair strings from the file. Can metadata still be read in this manner?
Yes, the metadata is still available in the Office file XML to be read. Your application must read the coauthoring setting from the policy file to know that the new feature set is enabled. This setting defines where to read/write the label data (custom.xml vs. labelinfo.xml). Review MS-OFFCRYPTO: LabelInfo versus Custom Document Properties for implementation details.
How do I determine if coauthoring is enabled in the label policy?
The policy engine returns the state of the coauthoring setting from the value of the enableLabelCoauth key. An application can read the raw bytes from the policy engine to determine coauthoring status.
How are labels migrated to the new location?
The MIP SDK uses the following logic to determine which section it reads and uses to read or write label data.
| Action | Feature not enabled | Feature enabled |
|---|---|---|
| Read | Label in custom.xml (unprotected) or Doc SummaryInfo (protected). | If a label exists in labelinfo.xml, it's the effective label. If there's no label in labelinfo.xml, the label in custom.xml or Doc SummaryInfo is the effective label. |
| Write | The MIP SDK writes all new labels to custom.xml (unprotected) or Doc SummaryInfo (protected). | The MIP SDK writes all new labels to labelinfo.xml. |
File parsing
Can I write to the same file that I'm currently reading with the File SDK?
The MIP SDK doesn't support concurrently reading and writing the same file. Any labeled files result in a copy of the input file with the label actions applied. Your application must replace the original with the labeled file.
SDK string handling
How does the SDK handle strings, and what string type should I use in my code?
The SDK is intended to be used cross-platform, and uses UTF-8 (Unicode Transformation Format - 8-bit) for string handling. Specific guidance depends on the platform you're using:
| Platform | Guidance |
|---|---|
| Windows native | For C++ SDK clients, use the C++ Standard Library type std::string for passing strings to/from API functions. MIP SDK internally manages conversion to/from UTF-8. When an API returns a std::string, you must expect UTF-8 encoding and manage accordingly if converting the string. In some cases, an API returns a string as part of a uint8_t vector (such as a publishing license (PL)), but you should treat it as an opaque blob.For more information and examples, see:
|
| .NET | For .NET SDK clients, all strings use the default UTF-16 encoding and no special conversion is needed. MIP SDK internally manages conversion to/from UTF-16. |
| Other platforms | All other platforms supported by the MIP SDK have native support for UTF-8. |
Content marking
Does the MIP SDK support content marking?
MIP SDK doesn't support direct application of content marking, including header, footer, or watermark, on any files. When the File SDK writes label metadata to a file, it writes the contentBits metadata property to indicate that the File SDK applied protection (if configured). It doesn't write the properties that indicate the application applied a header, footer, or watermark. When an application opens the file, the application should evaluate the content marking configuration and write it to the file on save.
Protection and Policy SDK on Android
Which shared library should I use to integrate the MIP SDK into my Android application?
The MIP SDK Android binaries include libmip_core.so, libmip_protection_sdk.so, libmip_upe_sdk.so, and libmip_unified.so. libmip_unified.so is the recommended library and includes the core, protection, and policy shared libraries.
Compliance
Is the Microsoft Information Protection SDK Federal Information Processing Standard (FIPS) 140-2 compliant?
Throttling
Are there any service-based throttling limits when using the MIP SDK?
The Rights Management Service, used by the Protection SDK or by protection operations in the File SDK, has a limit of 7,500 requests per 10 seconds for an entire organization. If Application A generates 4,000 requests per 10 seconds and Application B in the same organization generates 4,000 requests per 10 seconds, both applications might start to receive HTTP 429 Too Many Requests responses. Developers must implement a backoff period when they receive these exceptions. Future versions of MIP SDK implement this backoff period internally.