7.2 Manage Files with the Information Protection Client

Three ways to manage files on Windows

Once the Microsoft Purview Information Protection client is installed and the signed-in user has a published sensitivity label policy, you manage files in three complementary ways: the File Labeler in File Explorer, the viewer for encrypted content, and the PurviewInformationProtection module for inventory and bulk change. SC-401 items in this skill are operational: which tool, which cmdlet, what happens to the file name extension, and what the client will refuse to do.

Built-in Office labeling still owns documents while they are open in Word, Excel, PowerPoint, or Outlook. The client is how you reach files that are sitting on disk, files Office will not open, and batches that would be miserable to click one at a time inside an app.

File Explorer and the File Labeler

In File Explorer, right-click a file, a multi-select set, or a folder and choose Apply sensitivity label with Microsoft Purview. That opens the Microsoft Purview Information Protection File Labeler. The user picks the same labels they would see in a Microsoft 365 app. Protection settings come from the label unless the administrator allowed user-defined / custom permissions.

Selecting a folder applies the chosen label and protection to the files in that folder and its subfolders now. Files created later in that folder are not auto-labeled by this action. Folder labeling is a one-shot bulk operation, not a folder policy. If the exam wants continuous labeling of a share, that is the scanner or a cloud auto-labeling policy—not a right-click on a directory.

When the label allows custom permissions, the user can choose a rights preset—Viewer, Reviewer, Co-Author, Co-Owner, or Only me—plus users, groups, or a domain, and optionally an expiry date (access ends at midnight in the applier's time zone; the owner can still open the original). Client 3.2.x looks up users and groups through Microsoft Graph rather than the classic Outlook contact picker; after that upgrade, run Clear-Authentication and then Set-Authentication so the module can obtain Graph tokens.

For file types that only support generic protection, the UI does not offer the full rights matrix. Generic protection authenticates the user, opens the file in a supported application, and displays intended usage rights. Those rights are not fully enforced the way native Rights Management protection is enforced.

After Apply, wait for Work finished. If protection uses native encryption for formats that change the extension, File Explorer replaces the original with a lock-icon file. Example: capture.png becomes capture.ppng. Office files that support native encryption keep .docx, .xlsx, and .pptx.

To inspect a file, open File Labeler again and use View Permissions to see owner, label, and rights. Removing a label that applies protection also removes protection. Policies that require justification will prompt for a reason. You do not have to remove a label first in order to replace it—repeat the File Labeler flow with the new label.

On recent Windows 11 preview clients, the right-click command can appear on the modern context menu without Show more options. GA behavior still depends on client version. For the exam, remember the command name, not the Windows 11 chrome.

Viewer, Endpoint DLP, and why extensions change

The information protection viewer opens encrypted files the associated application cannot. Use it for protected text and image files and for many generic-encrypted payloads. It does not show attachments inside a protected PDF; those attachments are not visible in the viewer.

Advanced label-based protection—the Endpoint DLP setting Advanced label-based protection for all files on devices—is the exception students mix up with ordinary File Labeler encryption. For non-Office/PDF types on a managed device, Endpoint DLP can enforce access locally and delay encryption until the file leaves the computer, so the local extension does not flip to .pfile or .ptxt while the user edits. Microsoft documents limits: it applies to labels that apply encryption; it is not for labeling files on network locations or USB drives; when a multi-select mix includes Office or PDF files, those Office/PDF files can be skipped with a failure in File Labeler. Treat it as an Endpoint DLP companion, not a replacement for File Labeler.

Firewalls and DLP products that allow or block by file extension may need to be updated for p-prefixed extensions (.ptxt, .pjpg, .pfile, and similar). Microsoft warns that inspection devices keyed only to .txt or .png can mishandle natively encrypted siblings.

PowerShell: inspect, label, autolabel, remove

Import PurviewInformationProtection (installed with the client). Core file cmdlets:

Set-FileLabel can target one file, a folder, or a folder tree. -PreserveFileDetails keeps timestamps such as Date modified. If the published policy requires justification for a downgrade or removal, supply -JustificationMessage. Label GUIDs are not shown as a simple column in the Purview portal UI; get them with Security & Compliance PowerShell Get-Label or by reading MainLabelId / SubLabelId from Get-FileStatus.

Autolabel mode inspects content with Windows IFilter—the same filters Windows Search uses. Microsoft documents inspection for Word, Excel, PowerPoint, PDF, and text (.txt, .xml, .csv). You can inspect .zip archives with the scanner or Set-FileLabel, but classification and protection of a container are not pushed into each inner file. To relabel files inside a zip, extract them first.

Remove-FileLabel can remove protection from supported containers (zip, rar, 7z, pst) only after that capability is enabled on the label policy. Microsoft publishes a 5 GB maximum for .pst with this cmdlet. Do not invent other container size caps.

Set-FileLabel also supports discovery-style switches such as -DiscoveryInfoTypes so you can report known or specified sensitive information types without applying a label. That is useful on a jump box when you are not ready to run the full scanner.

You must have usage rights, or be a configured super user for Azure Rights Management, to strip encryption. If the tenant still uses Rights Management onboarding controls for a phased rollout, include any account that must open already-protected files.

Client 3.2 preview notes described duplicate metadata streams on already-encrypted OpenXML Word, Excel, and PowerPoint files when enforce-plus-relabel or Set-FileLabel -Autolabel -Force reapplied the same encryption label. Microsoft's published repair is to update the client and reapply the label. Mention it as a known 3.2-era repair, not as an unpublished limit.

Supported files, generic encryption, and common refusals

WebDav locations are not supported for the file types the client lists. Plan local disks, SMB paths, and—for the scanner—supported SharePoint Server URLs.

Sensitivity labels without encryption can be applied to a published set that includes Office (97-2003 and Open XML for Word, Excel, and PowerPoint), PDF, Project, Publisher, XPS, common images, and similar types. Labels with encryption use native encryption where the format supports a Rights Management service (Office, PDF, many text and image types) and generic encryption otherwise. Generic encryption wraps the file (.pfile / .p<ext>) and authenticates on open. Usage rights are displayed, not fully enforced. Microsoft recommends granting co-owner when you encrypt types that fall back to generic encryption.

A classic exam distinction: the client (and scanner) cannot apply a classification-only label to a .txt file, because .txt does not support a sensitivity label without encryption. The same .txt can be labeled if the label applies encryption and .txt is included among types to protect—the file becomes something like .ptxt. By default the scanner encrypts Office files plus PDF files protected with the ISO PDF encryption standard. Other types must be added explicitly.

Container files (zip, rar, 7z, msg, PDF with attachments) can themselves be classified and protected, but inner files are not individually labeled. Saving a labeled modern Office file down to an Office 97-2003 format can drop the label. Coauthoring is not supported on those older formats once a label is involved.

Disconnected computers can use cached policy XML for classification-only labels. They cannot apply encryption offline.

Worked scenario

Finance has mixed .xlsx and .pdf files on D:\Share. An analyst multi-selects them in File Explorer, applies Confidential \ Finance, and waits for Work finished. A week later you must prove which files actually received the Finance sublabel. Run Get-FileStatus against the folder, filter on SubLabelName, and export CSV. To strip encryption from a zip of those PDFs after a legal hold, enable container decryption on the label policy, use an account that is a Rights Management super user (or that still has rights), and run Remove-FileLabel with -RemoveProtection. Do not assume that labeling the zip in File Labeler decrypts every inner PDF.