Table of Contents
Sensitivity Label PDF Support Increases Coverage for Protection
In my review of sensitivity labels for 2023, I noted that the only way to apply a sensitivity label direct to a PDF was with:
- The paid-for versions of Adobe Acrobat.
- Generating PDFs from Office documents (subscription apps only).
- Applying a label through the unified labeling client.
Unlike retention labels, it wasn’t possible to apply a sensitivity label to a PDF using the SharePoint Online browser client. Now it is, and it’s an important update given the widespread use of PDFs within Microsoft 365. Between Office documents and PDFs, sensitivity labels can now protect over 90% (my estimate) of all files stored in SharePoint Online and OneDrive for Business. It’s another step to making PDFs a fully functional format within the Microsoft Information Protection ecosystem.
What Sensitivity Label PDF Support Means for SharePoint Online
In an update announced by principal program manager Sanjoyan Mustafi on LinkedIn, the preview of SharePoint Online support for PDFs is available to all commercial tenants worldwide. Support extends to sensitivity labels with predefined permissions. Labels with user-defined permissions or those that use Double Key Encryption (DKE) are unsupported.
Supporting sensitivity labels for PDFs means that people can use SharePoint Online and OneDrive for Business to:
- Apply sensitivity labels to PDFs through the browser interface (Figure 1) and amend or remove the label afterwards, including forcing the user to provide justification if required by policy. This includes applying the default sensitivity label defined for a document library to PDFs as users load them into the library (requires the SharePoint-Syntex advanced management license).
- Apply sensitivity labels to PDFs stored in SharePoint Online and OneDrive for Business through auto-label policies. This feature is covered in message center MC644060 (14 July, 2023).
- Apply sensitivity labels to PDFs using the assignSensitivityLabel Graph API (if your app has permission to do so).
- Display the names of sensitivity labels for protected PDFs in document libraries.
- Index the content of PDFs protected by sensitivity labels. This supports Microsoft Purview solutions like Data Loss Prevention, content searches, and eDiscovery.
Like Office documents protected by a sensitivity label with encryption, SharePoint Online can’t display a thumbnail of a protected PDF (Figure 2). I believe that this has something to do with the inability to fetch the necessary use license to decrypt the file. Thumbnails are shown for PDFs assigned a sensitivity label with no encryption. To open a document, use the Edge browser (which supports reading protected files) or download the file and use an app that understands how to open protected PDFs (like Acrobat).
I hear that Microsoft is working on the viewing issue and expects to have a fix by the end of 2023.
Enabling Sensitivity Label PDF Support for SharePoint Online
By default, SharePoint Online support for PDFs is disabled. To enable support, load the SharePoint Online administration PowerShell module and run the Set-SPOTenant cmdlet. You’ll need a recent version of the module (use this script to update your Microsoft 365 modules to the latest version):
Set-SPOTenant -EnableSensitivityLabelforPDF $True
To revert, run the command to update the setting to $False.
Set-SPOTenant -EnableSensitivityLabelforPDF $False
Disabling SharePoint support for PDFs has no effect on PDFs with sensitivity labels. It will stop users being able to assign or update labels through the SharePoint Online and OneDrive for Business browser interfaces and SharePoint Online will cease indexing protected PDF content.
If you don’t want to use PowerShell, check the Information protection section of the Purview compliance portal, and go to Auto-labeling. You might see a message inviting you to turn on support for PDFs. If you do, select Turn on now and the job is done.
More information about PDF support for sensitivity labels in SharePoint Online is available in Microsoft documentation.
Sensitivity Label PDF Support is an Important Step Forward
I don’t think it is an exaggeration to say that some organizations have been waiting years for PDF support to arrive in SharePoint Online. Given the widespread use of PDFs in many organizations, this is an important step forward for those wishing to protect their most sensitive information stored in SharePoint Online and OneDrive for Business.
Support the work of the Office 365 for IT Pros team by subscribing to the Office 365 for IT Pros eBook. Your support pays for the time we need to track, analyze, and document the changing world of Microsoft 365 and Office 365.
Hi, thank you so much for the details. It’s been extremely useful for us, and I have also used it for thousands of PDF documents.
i tried this , its working stop after few hours not able to see Sensitivity option in properties for section.could you please share how we can add the setting agin.
Microsoft still have issues with sensitivity labels not support on the power platform and can use power automate or power apps to strip labels from documents. Microsoft are aware but so far haven’t address the problem.
Power Platform is different from SharePoint Online. More work needs to be done to achieve full coverage for protected PDFs across the Microsoft 365 ecosystem, but in this case it’s up to the Power Platform people to take advantage of the work done in SPO and bring it to their platform.
Yeah, it’s just disappointing Microsoft haven’t address it, considering they are pushing/promoting as a secure way of protecting documents but forgetting to tell people that these can easily be remove using the power platform.
As I have said for years, never confuse Microsoft marketing pronouncements with engineering reality.