Azure RMS Plugin allows removing Microsoft Purview sensitivity labels despite mandatory labeling

[Lennerd]

Hello,

we are using Microsoft Purview Information Protection with four sensitivity labels. Some of these labels also apply encryption (Microsoft Purview Information Protection encryption).

The sensitivity labels are displayed correctly in PDF-XChange Editor 10.8.5 Build 410 via the Azure RMS Plugin, and users are able to view and change them.

While changing a label on a PDF is not necessarily something we require, it is acceptable in our environment. However, what concerns us is that users can remove the sensitivity label completely.

In Microsoft Purview, the following setting is enabled in our published label policy:
Require users to apply a label to their emails and documents

Our understanding is that this setting should prevent documents from being saved without a sensitivity label. This behavior works as expected in Microsoft Office applications.

However, in PDF-XChange Editor, users are able to remove the sensitivity label completely and save the PDF without any label.

We would therefore like to ask:

1. Is this behavior of the Azure RMS Plugin expected or a known limitation?
2. Should the Purview setting "Require users to apply a label to their emails and documents" also prevent users from removing labels in PDF-XChange Editor?
3. Is there a way to prevent users from removing a sensitivity label while still allowing them to change it to another label?
4. Are sensitivity labels that apply encryption fully supported by the Azure RMS Plugin, or are there any known limitations regarding encrypted labels?

Thank you in advance for your support.

[Daniel - PDF-XChange]

Hello, Lennerd

Thank you for the questions, I am not the most involved in the Azure side of things - so I needed to confirm with the Dev team on this.
Their reply to your inquiries was thus:

At the moment, the Editor does not support the auto-labelling he mentioned (Require users to apply a label to their emails and documents). This feature will be added a little bit later and will be optional

So in effect, yes it is a known limitation, no there is no way to prevent removal, and to my knowledge, encryption labels should be supported, if you discover any that do not work, please let us know.

Kind regards,

[matthewscott]

I'm interested to see the development team's response, especially regarding whether preventing label removal is technically possible or if it's a limitation of the current plugin implementation. That distinction would help when deciding whether this needs to be addressed through application updates or through administrative policy.

[Ivan - Tracker Software]

Does the applied label prevent editing of the document? Can you please send a screenshot of the "Document Properties -> Security" page?

If document modification is permitted, then yes, the user can remove the applied label (i.e., change document protection).
For now, we do not support automatic labelling. This feature will be added later.

[charliehampton]

Thanks for sharing the clarification. It sounds like the ability to remove the sensitivity label is currently a known limitation of the Azure RMS Plugin rather than an issue with the configuration. It would be useful if future updates could support the “require users to apply a label” policy in PDF-XChange Editor as well. Being able to change a label while preventing users from removing it completely would provide better consistency with Microsoft Office. Hopefully the development team can add this functionality in a future update.