Azure RMS Plugin allows removing Microsoft Purview sensitivity labels despite mandatory labeling

[Lennerd]

Hello,

we are using Microsoft Purview Information Protection with four sensitivity labels. Some of these labels also apply encryption (Microsoft Purview Information Protection encryption).

The sensitivity labels are displayed correctly in PDF-XChange Editor 10.8.5 Build 410 via the Azure RMS Plugin, and users are able to view and change them.

While changing a label on a PDF is not necessarily something we require, it is acceptable in our environment. However, what concerns us is that users can remove the sensitivity label completely.

In Microsoft Purview, the following setting is enabled in our published label policy:
Require users to apply a label to their emails and documents

Our understanding is that this setting should prevent documents from being saved without a sensitivity label. This behavior works as expected in Microsoft Office applications.

However, in PDF-XChange Editor, users are able to remove the sensitivity label completely and save the PDF without any label.

We would therefore like to ask:

1. Is this behavior of the Azure RMS Plugin expected or a known limitation?
2. Should the Purview setting "Require users to apply a label to their emails and documents" also prevent users from removing labels in PDF-XChange Editor?
3. Is there a way to prevent users from removing a sensitivity label while still allowing them to change it to another label?
4. Are sensitivity labels that apply encryption fully supported by the Azure RMS Plugin, or are there any known limitations regarding encrypted labels?

Thank you in advance for your support.

[Daniel - PDF-XChange]

Hello, Lennerd

Thank you for the questions, I am not the most involved in the Azure side of things - so I needed to confirm with the Dev team on this.
Their reply to your inquiries was thus:

At the moment, the Editor does not support the auto-labelling he mentioned (Require users to apply a label to their emails and documents). This feature will be added a little bit later and will be optional

So in effect, yes it is a known limitation, no there is no way to prevent removal, and to my knowledge, encryption labels should be supported, if you discover any that do not work, please let us know.

Kind regards,