Sensitivity labels and encryption fail in quiet ways. An auto-labeling policy skips a file and records a short failure code, a label never shows up in Outlook, or encryption doesn't work because a service switch is off. This page collects the codes and status values Microsoft documents, with what each one means, the usual cause and the first thing to check. Press Ctrl+F, type the code you see and follow the guide link.
Codes in this quick reference
EncryptedFileNotSupported: external encryption or a password prevents labelingPurview portal (auto-labeling failures)UnsupportedFileType: PDF labeling isn't enabledPurview portal (auto-labeling failures)DisabledOrUnsupportedLabel: label disabled or not supported for this tenantPurview portal (auto-labeling failures)InvalidFileName: the file name is invalidPurview portal (auto-labeling failures)CancelledByEventHandler: a SharePoint event handler canceled the updatePurview portal (auto-labeling failures)QuotaExceeded: the site storage quota is exceededPurview portal (auto-labeling failures)FileLocked: another user or process locked the filePurview portal (auto-labeling failures)FileCheckOut: a user has the file checked outPurview portal (auto-labeling failures)
+ 24 more codes in the tables below.
How to read these errors#
- Auto-labeling failure codes appear in the Microsoft Purview portal under Information Protection › Auto-labeling. Select the policy, open the Labeling failures tab, select a file and read Failure reason on the Details tab. The Overview tab's Labeling failures card shows the last 30 days and the top three reasons. Viewing them needs Compliance Administrator, Compliance Data Administrator, Information Protection Admin or Information Protection Analyst.
- A failed label isn't half-applied. The file keeps its previous label, or stays unlabeled.
- Missing labels and encryption problems rarely show an error code. The evidence is in PowerShell output (
Get-Label,Get-LabelPolicy,Get-AipService,Get-IRMConfiguration) and in one registry value, listed in the later tables.
Note: the Azure Information Protection add-in is retired. Office apps use built-in labeling, and the Microsoft Purview Information Protection client (without the add-in) covers File Explorer, the viewer and PowerShell.
Auto-labeling failures in SharePoint and OneDrive#
These codes come from service-side auto-labeling policies (auto-labeling guide). If many files fail with the same code at the same time, check SharePoint Online service health first. Spikes in SqlThrottled, TransientErrorStorageConnection or Unknown_SPException often match a known service event.
Codes you need to act on#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
EncryptedFileNotSupported | External encryption prevents labeling | Password protection or non-Microsoft encryption | Remove the password or other encryption |
UnsupportedFileType | PDF labeling isn't enabled | Sensitivity labels for files in SharePoint and OneDrive (PDF support) not turned on | Turn it on. Guide |
DisabledOrUnsupportedLabel | Label disabled or not supported for the tenant | The policy's label was turned off or unpublished | The label is active and published in a label policy |
InvalidFileName | The file name is invalid | Invalid characters or an over-long name | Rename the file |
CancelledByEventHandler | A site event handler canceled the operation | A custom SharePoint event receiver rejects label-property updates | Review the site's custom event receivers |
QuotaExceeded | Site storage quota exceeded | The site is full | Free space or raise the quota, then rerun the policy |
Codes that need no action or retry automatically#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
FileLocked | File locked by another user or process | File open or in use | Retried automatically |
FileCheckOut | File checked out | A user has it checked out | Retried automatically |
FileNotSupported | File type can't take a label | Unsupported format | None; expected |
FileExtensionNotSupported | Extension can't take a label | Unsupported extension | None; expected |
CannotOverrideCurrentLabel | Existing label has equal or higher priority | A user or another policy labeled it first | None; the existing label wins by design |
ZeroByteFile | File is empty | Label metadata can't be written to 0 bytes | None |
GetTagsFailure | Existing label metadata unreadable | SharePoint couldn't read the file's label metadata | Retried automatically |
RmsUnavailable | Azure Rights Management temporarily unavailable | The label applies encryption | Retried automatically |
Conflict | Version or save conflict | File edited at the same time | Retried automatically |
Transient | Temporary infrastructure error | Service side | Retried automatically |
UnauthorizedAccessException | Access denied while modifying the file | Service side | Retried automatically |
Unknown_SPException | Unclassified SharePoint error | Service side | Retried; if the same files keep failing, contact Microsoft Support |
TransientErrorStorageConnection | Temporary storage connectivity error | Service side | Retried automatically |
GenericException | Unexpected error | Service side | Retried automatically |
SqlThrottled | Requests throttled | High SharePoint database load | Retried automatically |
DirectoryNotFound | Folder no longer exists | Deleted after the file was classified | None |
FileNotFound | File no longer exists | Deleted or moved after classification | None |
Labels missing in Outlook and Office apps#
When users can't see a label or the Sensitivity button, the cause is usually one of these values (detailed guide). Publishing a label policy can take up to 24 hours.
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
UseOfficeForLabelling = 0 | Office isn't using built-in labeling | Value under HKCU\Software\Microsoft\Office\16.0\Common\Security\Labels (or the matching Policies key) left from the old add-in or set by Group Policy | Set it to 1 or remove the policy, then restart Office |
DistributionStatus isn't Success | Label policy not distributed | Recent change, or distribution failed | Wait, then check Get-LabelPolicy again |
Mode isn't Enforce | Label policy not enforced | Policy configuration | Fix with Set-LabelPolicy or in the portal |
Workload without Exchange | Policy doesn't reach Outlook on the web | No Exchange location in the policy | The Exchange location settings, and group membership if the policy targets groups |
Disabled : True | The label is turned off | Get-Label shows it disabled | Turn the label back on |
ContentType without File or Email | Label scope excludes the item | Label scoped to other item types | Edit the label's scope to include files and emails |
For a stuck Office client, exit all Office apps and rename %localappdata%\Microsoft\Office\CLP (for example to CLP_old). Office then downloads the labels and policies again. Other documented causes have no code: the signed-in account isn't a Microsoft 365 subscriber, no license is assigned, the app version doesn't support built-in labeling, or the file type isn't supported.
Encryption service, Exchange IRM and PowerShell#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
Get-AipService returns Disabled | Azure Rights Management isn't active | The service was deactivated | Connect-AipService as Compliance Administrator or Compliance Data Administrator, then Enable-AipService. Encryption options |
AzureRMSLicensingEnabled : False | Exchange Online can't connect to Azure Rights Management | Message Encryption not configured | Set-IRMConfiguration -AzureRMSLicensingEnabled $true. Guide |
Object reference not set to an instance of an object. | The client's PowerShell module failed | Run in PowerShell 7, which the Information Protection client doesn't support | Use Windows PowerShell instead |
The service can't be activated or deactivated from admin portals any more; it's PowerShell only. If only some users can't encrypt, check whether onboarding controls (Set-AipServiceOnboardingControlPolicy) limit who may protect content.
Protected files that won't open#
Most "can't open" cases have no code. Microsoft documents these causes (access-denied guide):
- The account has no rights. This is the usual cause. When a file does open, This document contains a permissions policy in the status bar and View Permission show what the account may do.
- Office too old. For example, files whose label uses dynamic watermarking open only in version 2411 or later; try Office for the web.
- Repeated sign-in prompts across tenants. The protecting tenant's Conditional Access can't be satisfied by a user who isn't provisioned there; invite them as a guest.
- Information Protection viewer: guest organizational accounts work, personal accounts don't, and AD RMS-protected files don't open on Android.
- Other encryption: files or emails signed or encrypted with S/MIME or other solutions can't be labeled, protected or decrypted.
- New labels fail to apply with co-authoring turned on, if the policy changed while Office was open. Close and reopen the app.
How to verify a fix#
- Run the diagnostic. Run Tests: Sensitivity labels in the Microsoft 365 admin center (Global Administrator) takes a label name and a user. Some tenants also have diagnostics under Information Protection › Diagnostics in the Purview portal.
- Check the configuration (connection help):
Good isPowerShell
Connect-IPPSSession Get-Label -Identity "Confidential" | Format-List DisplayName, ContentType, Disabled Get-LabelPolicy -Identity "Default label policy" | Format-List Mode, Workload, DistributionStatus Connect-AipService Get-AipService Connect-ExchangeOnline Get-IRMConfiguration | Format-List AzureRMSLicensingEnabled Test-IRMConfiguration -Sender adele@contoso.com -Recipient adele@contoso.comDisabled : False,Mode : Enforce,DistributionStatus : Success,EnabledfromGet-AipServiceandAzureRMSLicensingEnabled : True.Test-IRMConfigurationshould report:Text- PASS: RMS Templates acquired. - PASS: Encryption verified successfully. - PASS: Decryption verified successfully. - PASS: IRM verified successfully. - Rule out TLS inspection. If clients can't reach the service, check who issued the certificate on the Rights Management endpoint. Anything other than a Microsoft CA means a proxy or firewall is breaking the connection:
PowerShell
$request = [System.Net.HttpWebRequest]::Create("https://admin.na.aadrm.com/admin/admin.svc") $request.GetResponse() $request.ServicePoint.Certificate.Issuer - Auto-labeling: rerun the policy where the code calls for it (for example
QuotaExceeded). Once the policy processes the file again, confirm the label on the file itself in SharePoint or OneDrive.
For DLP messages, see the DLP messages quick reference. For the label rollout itself, see rolling out sensitivity labels.
References#
- Resolve auto-labeling failures in SharePoint and OneDrive files (Microsoft Learn), the source of the failure codes
- Sensitivity labels are missing in Outlook, Outlook on the web, and other Office apps (Microsoft Learn)
- Known issues for the information protection client (Microsoft Learn)
- Activating the Azure Rights Management encryption service (Microsoft Learn) and Set up Microsoft Purview Message Encryption (Microsoft Learn)
- Resolve Microsoft Purview Message Encryption issues (Microsoft Learn) and Credentials don't work for IRM-protected content (Microsoft Learn)
