Why Graph API Uploads Fail for Files with DKE Sensitivity Labels

Question

When using Microsoft Graph API to upload or overwrite files that are protected with Double Key Encryption (DKE) sensitivity labels, you may encounter the error:

 

"code":"notAllowed",

 

"message":"This operation has been disabled by policy"

 

This issue typically arises only when the file is protected with a DKE-enabled sensitivity label. Files with standard sensitivity labels or no labels at all upload successfully via Graph API.