Sensitivity labels in SharePoint and OneDrive: enable processing, co-authoring and PDFs

Until you opt in, SharePoint and OneDrive can't read files encrypted by a sensitivity label: no search, no eDiscovery, no DLP content inspection, no co-authoring and no Office for the web. In this post I'll switch that processing on, add PDF support, enable co-authoring for encrypted files, set default labels on libraries, and explain what changes for users and what still doesn't work.

How it works#

Once enabled, SharePoint and OneDrive can process new and changed Word, Excel, PowerPoint and uploaded PDF files whose label encrypts with a cloud-based key (not Double Key Encryption). Search, full-text eDiscovery and DLP work on their content, Office for the web opens them with the label's permissions enforced, and the label shows in the library's Sensitivity column and the details pane, where users can apply labels without opening files. On download, the label and its encryption stay with the file.

• Files encrypted before you enable it aren't processed until they're edited, or downloaded and uploaded again.
• Whoever uploads an encrypted file needs at least the View usage right, or the upload succeeds but the content isn't processed.
• New audit events appear: Applied sensitivity label to file, Changed sensitivity label applied to file and Removed sensitivity label from file.

Prerequisites#

• A Global Administrator for the portal switch, or a SharePoint admin with SharePoint Online Management Shell 16.0.19418.12000 or later (16.0.24211.12000 for the PDF setting).
• OneDrive sync app 19.002.0121.0008 or later; older versions are prompted to update.
• Encrypting labels with User access to content expires set to Never and no Double Key Encryption; labels with expiry or DKE aren't processed and don't show in Office for the web. Labels with user-defined permissions work for new and edited files, but enable co-authoring (step 3) before users apply them in Office for the web.

Step-by-step#

1. Enable processing for Office files#

In the Microsoft Purview portal, open Solutions › Information Protection › Sensitivity labels and select Turn on now if the message appears. Or use PowerShell (required for Multi-Geo, once per geo):

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOTenant -EnableAIPIntegration $true
(Get-SPOTenant).EnableAIPIntegration

The change takes about 15 minutes. Loop components follow automatically; OneNote needs Set-SPOTenant -EnableSensitivityLabelforOneNote $true.

2. Add PDF support#

Select the Protect PDFs with Auto-labeling banner on the auto-labeling policies page, or run Set-SPOTenant -EnableSensitivityLabelforPDF $true. PDFs then get label display, search, eDiscovery, DLP, auto-labeling and library default labels. Signed PDFs aren't supported, and existing auto-labeling policies may start labeling many more files per day.

3. Turn on co-authoring for encrypted files#

Without it, desktop apps open encrypted files in exclusive editing mode, AutoSave is off, and other users get a File In Use message. Enabling it changes where Word, Excel and PowerPoint store labeling metadata: unencrypted files no longer keep it in custom properties. Anything that reads the old location, such as scripts, older clients or a mail flow rule that checks custom properties, can then see files as unlabeled or mislabeled.

• Minimum Microsoft 365 Apps versions: Windows 2107 (Current or Monthly Enterprise Channel) or 2202 (Semi-Annual Enterprise Channel), macOS 16.51, iOS 2.58, Android 16.0.14931. The Microsoft Purview Information Protection client needs 3.0 or later.
• Turn it on under Settings › Solution settings › Information Protection › Co-authoring for files with sensitivity labels, with at least the Information Protection Admin or DLP Compliance Management role. It also enables step 1 if needed. Allow 24 hours.
• Turning it off is PowerShell-only (Set-PolicyConfig -EnableLabelCoauth:$false), and label information saved in the new format for unencrypted files is lost.

4. Set default labels on libraries#

A site admin opens the library's Library settings pane and selects a label under Default sensitivity labels, leaving Extend protection on download, copy, or move cleared (that's a separate preview scenario). New and edited files get the label when they're unlabeled or carry a lower-priority automatic or default label; manually applied labels are never replaced. Office for the web labels at once, uploads within minutes, and desktop apps after the file is closed.

Library defaults don't touch existing files at rest. For those, create an auto-labeling policy that applies the library default to existing files: one such policy per tenant, up to 10 sites at a time. If a site can't be added, you'll see No default library label is configured or Default labels couldn't be verified (the second is about your access, not a missing label). Libraries using SharePoint IRM can't have a default label.

What changes for users#

• Office for the web shows the Sensitivity button and the applied label. For encrypted documents, it doesn't support printing, downloading, exporting or making a copy, and blocks copying to the clipboard without the Copy right.
• Encryption a user strips from a labeled file is restored the next time it's opened or downloaded.
• Find files by label with the InformationProtectionLabelId managed property, for example InformationProtectionLabelId:8faca7b8-8d20-48a3-8ea2-0f96310a848e (not inside .zip files).

Verify#

• (Get-SPOTenant).EnableAIPIntegration and (Get-SPOTenant).EnableSensitivityLabelforPDF return True.
• A newly uploaded encrypted test file shows its label in the Sensitivity column, opens in Word for the web, and appears in search for a unique word in its body.
• After 24 hours, two users edit an encrypted document together in desktop apps with AutoSave on.
• Files labeled by a library default show the tooltip This file has been automatically labeled, and the audit log shows the label events.

Tips & gotchas#

• Files encrypted in desktop apps can't be processed if they contain Power Query data, custom XML parts, a bibliography or a Document ID added on upload. Password-protected files aren't supported, and encrypted files over 12 MB lose processing when copied or moved to another site.
• Files encrypted with an on-premises key (HYOK), DKE or a protection template without a label never open in Office for the web.
• Admins can strip label and encryption with Unlock-SPOSensitivityLabelEncryptedFile -FileUrl ... -JustificationText ...; the justification is audited. For other access problems, see can't open a label-encrypted file.
• Turning processing off later leaves a mixed state that's hard to support. Decide once.

Next, label content at scale with service-side auto-labeling and protect whole sites with container labels.

References#

• Enable sensitivity labels for files in SharePoint and OneDrive (Microsoft Learn)
• Enable co-authoring for files encrypted with sensitivity labels (Microsoft Learn)
• Configure a default sensitivity label for a SharePoint document library (Microsoft Learn)