Microsoft Purview Sensitivity Labels removed when printing

[Tai-D]

Does anyone know how to stop users removing sensitivity labels (Microsoft Purview) by using Print to PDF?

Users can remove encryption and it doesn't track as an activity in Purview to know their doing it. would be good to block printing to PDF altogether if there's a way to do it

[Stefan - PDF-XChange]

Hello Tai-D,
Welcome to our forums!

I am afraid that the "printing" process creates a new file, and the original labels are lost in such a printing.
So the only way I can think of is if you can make those file non printable so that users can not create the unprotected copies.

Kind regards,
Stefan

[Tai-D]

Hi Stefan, thanks for the advice.
How do you suggest the documents be made unprintable? I tried creating a DLP policy to block print to pdf but it looks like it only works in Microsoft not PDF Xchange.

[Stefan - PDF-XChange]

Hello Tai-D,

I am not sure how Purview Sensitivity Labels work, but when creating a PDF file you can place restrictions on the PDF itself and e.g. prevent printing of the file:
https://www.pdf-xchange.com/knowledgeba ... -be-edited

Kind regards,
Stefan

[Tai-D]

ah, ok. Yeah I don't think it's feasible in a large organization to get every user to manually remove the ability to print. Plus PDFXchange already removed the label from the file when it was pdf'd, so removing ability to print on the pdf won't be effective.

We use Purview sensitivity labels as I'm sure a lot of companies do, but PDFXchange removes the label when printing to PDF. And even if user reapplies the label in Purview, they have to also remove the ability to print the file in order to stop users from removing the label/security protections??

Is this something PDFXchange is looking into?

Appreciate any info or guidance as would be good to stay with PDFXchange if we can.

[Stefan - PDF-XChange]

Hello Tai-D,

This is not really an "issue" or "oversight" but rather how the PDF file format works, and when you "Print" a document - you are creating a new copy. So there's no way for the printer to know that the source document has any security, or for the printing application to know if the printer it is outputting to is a hardware device that will generate pieces of paper with the content, or a virtual printer that will create a new PDF.

So if you want to prevent copying of that info - you will have to prevent the original file from being printable.
If it can be printed (even to paper only) - the paper can then be scanned back into a new PDF file, OCRed - and that will still be an unprotected PDF copy. So the only way to prevent information copying is to control it at the source and prevent the file from being printable at all. Sorry that I can not offer any other solution.

Kind regards,
Stefan