Microsoft Information Protection - Step by Step

[@samanthamccarthy9765]

this is the best explanation so far . very Clear and thank you so much

[@alexthannah]

Didn't realise that IP labels could be applied to specific sites using DLP - been targeting IP labels at specific users for a while. Thanks for the info Andy!

[@shannelson9892]

Thanks Andy , The explanation is very clear and easy to follow👍

[@jabra1946]

Nicely explained. Thank you!!

[@Timmy-Hi5]

SuperStar 🎅🎄🎁 Andy, We all can only wish if this was a longer video to show us from the end-user experience. And to mention "legacy" MIP local software that is now retired. Old school CFO like to see their banner across the Outlook everytime when creating the email, and now they have to click on "Sensitivity" drop down .... too much work for those Finance guys😁

[@AndyMaloneMVP]

No worries. You saw it from the user perspective Word when I applied a label 😊

[@patrick__007]

Yes, that is the manual labeling. Isn't this a risk the users are too lazy and will not apply labels? Auto label policy does this automatic for you, right?

[@Timmy-Hi5]

@@patrick__007 if only CFO allows it 😁

[@AndyMaloneMVP]

@@patrick__007 DLP policies can take quite a while to kick in. I couldn’t wait that long when I’m recording the video, however, I will look at this in the future for you.

[@patrick__007]

@@AndyMaloneMVP Awesome!

[@Kids-wy8su]

Gr8. Simple and best way to explain.

[@dirceumachadojunior3166]

Hi Mister Andy, tks a lot for video. I just would like to suggest , you could add instructions to verify and generate report where those label are applied. Your content is always so amazing, tks for your job!

[@dominicmounsey1715]

Great content thank you. Side note, still bugs me that Word online formatting is STILL all over the place

[@samlimam2740]

Thanks Andy ! A fabulous video on Microsoft Information protection😊 this is really helpful !

[@AndyMaloneMVP]

Thanks Sam 👍😊

[@simple-security]

I don't understand your comment at 11:50 "50 labels and 50 policies" if you just create the default label for your policy. Thanks very much for your video! great job.

[@AndyMaloneMVP]

By default every time you create a label it will create a policy. You don’t want that right?

[@ivan40229]

Very useful! Thanks

[@hanzwo]

Hello Andi. Thank you for great video. You have right, i learned somethink new! :) I'm not sure if i heard the point, that the group must bee a e-mail activated securety group. Sorry, if i overheard this point. If you want to create a extra group for the labels and want to use a dynamic group, than you can create a m365 group. The special on a m365-Group is the e-mail notification - the feature on this step by the labling is a bit hmmm. The notification can be desablet by the command: Set-UnifiedGroup -Identity GROUPNAME -UnifiedGroupWelcomeMessageEnabled:$false But remember the microsoft cloud-speed. Wait until you change to a dynamic group. P.S.: I bomb the like button :) [sorry, i'm not a nativ englisch speaker]

[@AndyMaloneMVP]

Hey thanks for the pitch in. Awesome 👍

[@devilmaycry10001]

Thank you very much for this and other video tutorials. How do files with sensitivity labels applied to them behave when membership to the label is based on dynamic group? I have create a label and distributed it to a dynamic group. I have later tagged a word document with this label. At a later stage I also amended the dynamic group to include more users, however the new employees in the group never get access to the previous old word document. How does this work? I have waited a couple of days, still the behaviour is that new employees within the group still do not have access to old documents.

[@AndyMaloneMVP]

They are dynamic and should work. That said sometimes it can take up to 72 hours for labels to fully filter through.

[@santhoshshashi303]

Thanks for more useful information ❤

[@rybad95]

It'd be nice if people would start out these videos saying what level of M365 is required to use the features described in the video

[@doctor24UA]

Rights Management is not active for the tenant. Its after click create label

[@AndyMaloneMVP]

Check your licence

[@movsho77]

Great topic!

[@karvarokk]

Hey. You should do a Office 365 tutorial from start to finish. What policies do you apply and why. The tenant has Business Premium

[@AndyMaloneMVP]

I did a session on business premium. Hardly anyone looked at it😳😩

[@robertjopling9217]

@@AndyMaloneMVP i did!!!

[@murattasova7598]

Thanks again for your very informative video Andy. Little question. Is it possible to force users to choose a sensitivity label. Thanks again.

[@alexthannah]

Yes when creating a label and targeting it at users you can force them to apply an info protection label before they save the file (for supported file types)

[@alexthannah]

As always with IT, it's security VS usability... great from a compliance standpoint if you force your users to label everything but you will get a lot of noise from users if they're not trained properly on why/how they're forced to label ALL files. Probably best to integrate this with DLP and just enforce the important Sensitive Information Types that are key to your organisation.

[@murattasova7598]

@@alexthannah you absolutely right. Probably the amount of people who like me (so far they exist :) will increase dramatically. Therefor it can only be done after a good campaign and convincing the management. Thanks and have great weekend.

[@giftysingla8841]

can you please do another video on how to enable sensitivity labels for groups and sites and on prem repository

[@AndyMaloneMVP]

Absolutely

[@selimshixmambetov9706]

Thank you Sir 😊

[@butterz5876]

Is there a way to apply labels to existing documents? (without opening each one up and applying it!)

[@AndyMaloneMVP]

This can be done is Cloudapp Security by an Admin. Or use a script

[@PhilipLemon]

At 5:04 Groups & Sites and Schematized data assets is greyed out saying I need to enable and leading me to a page that still requires copious amounts of powershell commands to enable. :(

[@AndyMaloneMVP]

I’m afraid so sorry.

[@holaconn1754]

Thank you Andy for the amazing video. 🍵 I have a question: when we create a label, we assign permissions to the label including which users and groups will have the permission to use the content that has the label applied. and we also have permission assignment in the label policy. So when we publish the label to the policy, which permission assignment has the higher priority? For example, a user A is in the scope of the label permission assignment, but he is not in the scope of the label policy's permission assignment, will user A be able to use the contents that applied this label? 👀🤔

[@AndyMaloneMVP]

The most restrictive permission takes precedence

[@MilanRoy-r4e]

@@AndyMaloneMVP sorry not clear... my bad... if the label is created for ALL USERS and the label policies mentioned say 3 SPECIFIC USERS which one it will go for? please clarify

[@AndyMaloneMVP]

@@MilanRoy-r4e specific use past as these are explicit restrictions

[@sunrose007]

How about to show the behaviour on teat scenarios? I suggest you should add them in demo for more understanding and end user experience

[@AndyMaloneMVP]

Nice suggestion, I'll see what I can do.

[@BACS_Amrutha_channalli]

If we don't see the label for Data Loss Prevention , Can we conclude that we don't have license or subscription to it ?

[@AndyMaloneMVP]

Correct

[@PoplarMAT]

Thanks Andy, any advice is "Groups and Sites" is greyed out under label details?

[@AndyMaloneMVP]

You need to activate it via a power shell script. It’s in the video. I explained it.

[@pwerautomatetestvideo2270]

Thanks Andy, great video. Something we are currently looking at although the licensing is confusing. To my knowledeg, using DLP in for Teams is E5 as well as auto labelling. Auto labelling is classed as automation (questionable) so requires the high licensing/addons.

[@AndyMaloneMVP]

Unfortunately a P2 licence is required

[@whoismob]

@@AndyMaloneMVP does that require every user to have the p2 license for auto labeling?

[@malikmalik-us3nw]

thanks alot

[@emmanuelchrispher8958]

Thanks

[@ifeanyionwuka5825]

Thanks Andy for the video. Please what are the Microsoft Information Protection (MIP) encryption types? What MIP features/encryption can be used in PDF?

[@AndyMaloneMVP]

It’s a fairly simple process and yes, you can do it by using a number of methods. Here are a couple of useful links. helpx.adobe.com/uk/enterprise/kb/mpip-support-acrobat.html and here support.microsoft.com/en-us/topic/create-protected-pdfs-from-office-files-aba7e367-e482-49e7-b746-a385e48d01e4

[@ifeanyionwuka5825]

@@AndyMaloneMVP thanks. the links were very helpful. especially asr regards application of sensitivity labels to pdf.

[@aravind642]

Hey Andy, That was a wonderful information thank you . If you could include the license requirement to use this feature that would be much helpful. As we have multi licensed user and just to know who get this.

[@AndyMaloneMVP]

No worries. Everyone gets information protection. Azure AD P2 get automated labels

[@asimsherwany7529]

Options in define protection setting are greyd i am unable to check privacy and external user access.What is the reason?

[@AndyMaloneMVP]

This is either a permissions issue, or you don’t have the correct license. I suspect permissions is the problem here.

[@asimsherwany7529]

@@AndyMaloneMVP Yes ur right i gues its license issue i will check it.Thanks for reply.

[@MilanRoy-r4e]

hi thanks for the awesome video... i am facing an issue while creating a label (user wise) giving error. when i am creating org wise it is creating nicely. i need to apply the same for some specific users... not for whole company. can u plz help on that? currently using business basic and eop1 license

[@AndyMaloneMVP]

Business premium is the subscription you need.

[@arun16kb]

How to convert this kind of word file into pdf withoutloosing Microsoft protection?

[@AndyMaloneMVP]

Check out the docs at Learn.Microsoft.com you create a secure ppdf

[@asimsherwany7529]

I applied label but when user send email to any client it's not readable client complaints that email not readable I guess it's encrypted for client how can I resolve this.

[@AndyMaloneMVP]

I’ve not heard of this, it sounds like a technical support issue. I would submit a ticket with Microsoft

[@asimsherwany7529]

@@AndyMaloneMVP Thanks for reply.

[@peacejon2019]

Hi Mr. Andy. Great Job you are doing. Do I need to download AIP labelling client on Windows to have this labels showing up on Desktop clients?

[@AndyMaloneMVP]

This is called windows information protection and yea you would need to download the client. From settings in compliance centre.

[@peacejon2019]

@@AndyMaloneMVP Thanks a bunch

[@priyankakapruwan1665]

Is there any way to see Alert of DLP policy more than 1 month? As of now it is confined to 1 month period only

[@AndyMaloneMVP]

Docs.microsoft.com

[@SunShinepkg]

Thank Andy but what is the most common use case of this feature, just sharepoint?

[@AndyMaloneMVP]

Microsoft 365 groups, teams, and SharePoint, document libraries as well as email

[@SunShinepkg]

@@AndyMaloneMVP thank You

[@chrismorganofficial]

Hey Andy, I connected with Microsoft support and they were still not able to rectify the issue with Groups (Enabling this with powershell commands). If you have done this and have a video for this could you please share the link

[@AndyMaloneMVP]

I mainly work in cloud nowadays. Sorry I couldn’t help on this occasion.

[@bdproductions]

So I've added the Sensitivity Label to a Sharepoint Site, but it doesn't then apply the label to the documents. Any ideas?

[@AndyMaloneMVP]

This has to be done separately

[@albertk3677]

Hi Andy, an unrelated question, I was wondering where I could find the registry keys of the group policy editor snap-in, I assume that all of its values must be stored somewhere in Regedit, but after hours of searching on the web, I couldn't find it, do you? I really appreciate any help you can provide. I also posted it here just to be sure it came through.

[@AndyMaloneMVP]

Dude, I’m good but not that good, I can’t remember every single registry key. Try the Microsoft tech community. Good luck 😊

[@jbijdevier6640]

Is auto-Labeling possible without a E5 license?

[@AndyMaloneMVP]

I’ll be honest, I’m not a licensing specialist. But if you check out M365maps.com, that’s a great resource if you want to know what features are available.

[@clifffernandes5814]

I am not sure but I also think you need Azure Information Protection 2. Need to with Microsoft.

[@AndyMaloneMVP]

@@clifffernandes5814 Azure AD plan 2 is required.

[@clifffernandes5814]

@@AndyMaloneMVP I thought so. And AIP is considerably more expensive. Thanks

[@AndyMaloneMVP]

@@clifffernandes5814 just to be clear AIP is the old name. Microsift information protection is the new name 😊

[@MartinMangaard]

Hi Andy, is it possible to add multiple labels to a document? - like label1 assigned a Group that can only view. and label2 assigned a Group that can Edit. - or should i create a label for each combination of group acces?

[@AndyMaloneMVP]

Unfortunately not

[@rob5800can]

Thank you for this video. You just got another subscriber

[@AndyMaloneMVP]

Thank you and welcome aboard 😊

[@CurtisM-vu7zb]

How can we revoke access to a specific user? Example: A user is part of a sensitive project and the label was created using specific defined users in both the access and policy. If that user no longer is on the project but still with the company, how can the access be removed? In my testing, after removing the user from the label access and policy to use the label, they can still open existing documents as they authenticated when they did have access.

[@AndyMaloneMVP]

Simply exclude the user from the policy

[@CurtisM-vu7zb]

@@AndyMaloneMVP The user (in my testing) still has access to the document. Example: User is not part of the policy and cannot open the document with label applied. User is added to label as owner and they can then open the document. Removed the user from being an owner but they can still open the document that was emailed. (Cache mode didnt make a change) You would think being removed as an owner would be real time and no be allowed to open the doc. We have waited 48 hours to ensure the policy was updated and the removed user could still access. Might have to open a ticket with MS on this one but wanted to see.

[@AndyMaloneMVP]

@@CurtisM-vu7zb I think that would be a good course of action. Good luck👍😊

[@mohamedbabers599]

Thank you so much Sir

[@AndyMaloneMVP]

All the best