5.3 Protection Settings and Content Marking
Key Takeaways
- Item protection is configured on the label: Control access (Azure Rights Management encryption) and content marking (header, footer, watermark)
- Assign permissions now lets the admin set users, usage rights, expiry, and offline access; Let users assign permissions provides Do Not Forward or Encrypt-Only in Outlook and/or a custom-permissions prompt in Word, Excel, and PowerPoint
- The default Rights Management use license period is 30 days; user-defined-permission labels use that tenant period instead of a per-label offline-access control
- Standard markings are inserted into the file and can be edited; dynamic watermarks require encryption, show the opener's UPN, and are not a substitute for headers on email
- Double Key Encryption remains a current label option; after you save a DKE label you cannot edit it
The third blueprint bullet is Configure protection settings and content marking for sensitivity labels. These settings live on the label, not on the publishing policy. The policy later decides who may see the label. The label decides what happens when someone applies it to a file, email, or meeting invite. Container labels do not use this page to encrypt library files; that remains an item-scope configuration.
On Choose protection settings for the types of items you selected, the control you need for encryption is Control access. Content marking is a separate choice: headers, footers, and watermarks. You can mark a General label with only a footer, and a Highly Confidential label with encryption plus a watermark. You can also ship a label that classifies without protecting, then add encryption later — a documented rollout pattern.
Encryption: Azure Rights Management, not a password
Unless you configure a label to apply S/MIME in Outlook, item encryption uses the Azure Rights Management service from Microsoft Purview Information Protection. Encrypted content can be decrypted only by identities allowed in the label (or by RMS super users / the Rights Management issuer). Encryption stays with the file if it is renamed, emailed, or copied outside the tenant. It applies at rest and in transit.
Prerequisites Microsoft lists, with no wizard validation that you completed them:
- Activate Azure Rights Management (on by default in newer tenants).
- Allow the RMS network endpoints through firewalls.
- Check Entra Conditional Access and cross-tenant access so authorized people are not blocked from opening encrypted files.
- Configure Exchange for RMS if you want Outlook on the web and mobile to read encrypted mail, server-side search indexing of encrypted mail, and Exchange Online DLP against Rights Management protection. Users can still apply encrypting labels in Outlook before Exchange is fully configured; they just will not get those extra server features.
Teams meeting media encryption is a different mechanism from Azure RMS. Do not answer a document-encryption item with the Teams media article.
Assign permissions now versus let users assign permissions
| Choice | Who decides access | Typical labels | Offline access |
|---|---|---|---|
| Assign permissions now | Admin picks users, groups, domains, or any authenticated users, then assigns a permissions level (Viewer, Editor, Restricted Editor, Owner) or custom usage rights | Highly Confidential for all employees; partner read-only by domain | Never, a number of days, or Always |
| Let users assign permissions | User decides when they apply the label | Business Contracts; external email that must not be forwarded | Uses the tenant use license period (default 30 days), not the per-label offline control |
Assign permissions now also supports user access expires on a date or after N days (effective midnight in the admin's time zone; some mail clients cache past expiry). Recommended offline values from Microsoft: Never unless the content is time-bound; 7 days of offline access for sensitive business data such as contracts; Never for dynamic watermarks and highly sensitive data (HR, passwords, unreleased financials); Always for lower sensitivity where a 30-day (or tenant) cache after revocation is acceptable.
Identities you can grant: everyone in the organization (excludes guests); any authenticated users (encrypts and can restrict usage without restricting who); email-enabled security groups, distribution groups, or Microsoft 365 groups (static or dynamic Entra membership — not Exchange dynamic distribution groups, which do not sync to Entra, and not security groups that are not email-enabled); or any email address or domain. Specifying fabrikam.com includes all verified domains in that Entra tenant, not one subdomain. Mail contacts in groups have a documented intermittent-access issue.
The person who applies an encrypting label becomes the Rights Management issuer and always has Full Control, including after expiry, offline, and after revocation. Changing admin-defined users or rights on an existing encrypting label usually applies the next time users authenticate to RMS; a still-valid use license delays that until it expires. Switching between assign-now and user-defined, or between Do Not Forward and Encrypt-Only, applies only to newly labeled or relabeled items.
Let users assign permissions is what Microsoft still calls user-defined permissions:
- In Outlook: Do Not Forward (no forward, print, or copy; To/Cc/Bcc locked) or Encrypt-Only (recipients keep most rights except Save As, Export, and Full Control — they can forward and print). Encrypt-Only is newer; unsupported Outlook builds hide the label. Do Not Forward is the widely supported option.
- In Word, Excel, and PowerPoint: the user is prompted for people, groups, or organizations, unless the label extends SharePoint library permissions. Unsupported Office builds hide the label or show it but refuse to apply it.
If you enable only the Outlook restriction, the label is invisible in Word. If you enable only the Office prompt, it is invisible in Outlook. Enable both to show in both. Scope must include Email for the Outlook options and Files for the Office prompt. A user-defined label can be recommended, but automatic application is supported only for Do Not Forward and Encrypt-Only — not for the Word custom-permissions prompt.
Unencrypted Office attachments on an encrypted email or meeting invite inherit the message encryption. You cannot turn that inheritance off with scoping. Already-encrypted attachments keep their own encryption. Applying a new encrypting label (or the Remove access control option) to content that is already encrypted requires Export, Full Control, Rights Management issuer/owner, or super user; otherwise the user sees that they do not have permission to change the sensitivity label.
Dynamic watermarks and Double Key Encryption
Dynamic watermarks are an encryption setting, not a content marking. By default they insert the opener's UPN on each page. Optional custom text can include date and time. They persist when printed, not when exported. Microsoft recommends Allow offline access = Never. Apps that do not understand dynamic watermarks refuse to open the file (exceptions include Outlook attachment preview and PowerPoint Live). Use them as a screen-capture deterrent on the most sensitive documents, not on every Confidential file.
Double Key Encryption (DKE) is still in the current encryption article. Select it only after the DKE service is deployed. After the label is configured and saved, you cannot edit it. Built-in labeling support depends on the Office capabilities table row for DKE. HYOK/DKE files also have extra limits in SharePoint/OneDrive Office for the web. Do not turn on DKE because an exam stem said "very confidential"; turn it on when the organization must hold a second key Microsoft cannot use.
Content marking: header, footer, watermark
Markings are visual, not access control. They are written into the document or message and stay until someone edits them. Watermarks as content markings apply to documents and Loop components/pages, not to email or meeting invites. Headers and footers can apply to email, meeting invites, and documents.
Published limits:
- Watermarks: 255 characters.
- Headers and footers: 1,024 characters, except Excel, which has a 255-character total that includes hidden formatting codes. If you hit Excel's limit, the string does not display.
Variables (case-sensitive) include ${Item.Label}, ${Item.Name}, ${Item.Location}, ${User.Name}, ${User.PrincipalName}, and ${Event.DateTime}. ${User.PrincipalName} is the applier. Dynamic watermarks show the opener. You can branch text per app with ${If.App.Word} … ${If.End} (abbreviations W, X, P, O). Unsupported Office versions stamp the raw ${...} text instead of resolving it.
| Behavior | Standard header / footer / watermark | Dynamic watermark |
|---|---|---|
| Requires encryption? | No | Yes |
| Who is named? | User who applied the label (if you used a user variable) | User who opens the file |
| Can a user delete it in the file? | Yes, it is ordinary document content | Not without removing the label or Export/Full Control |
| Font, color, diagonal layout? | Yes | No |
| Email? | Header/footer yes; watermark no | Not a content marking |
Office applies markings and encryption on different schedules: Word/Excel/PowerPoint apply both immediately. Classic Outlook for PC encrypts immediately but applies markings after Exchange Online sends. New Outlook, Outlook on the web, Mac (16.79+ new Outlook), iOS, and Android apply both after send, so copies in Sent may be unencrypted until the user removes and reapplies the label before resending.
Labels applied outside Office (Information Protection client in File Explorer or PowerShell, SharePoint/OneDrive auto-labeling policies, Power BI export, Defender for Cloud Apps) write metadata and encryption but do not insert content markings. Opening the file in Office does not backfill the header. The user must temporarily remove and reapply the label to stamp markings.
Collaboration side effects you should expect
If SharePoint and OneDrive labeling is not enabled, encrypted files are invisible to search, eDiscovery, and Delve; DLP can see metadata but not file contents; Office for the web cannot open them. Enabling that integration restores web open (with limits for DKE/HYOK and encryption applied outside a label). Co-authoring and AutoSave on encrypted files require the co-authoring-for-encrypted-files switch plus supported Office builds; otherwise AutoSave is off and desktop apps show File In Use. Applying encrypting labels offline works in Office for Windows; macOS, iOS, Android, and the Information Protection client must be online to apply those labels. Opening encrypted content offline depends on the use license. Power BI Desktop will not open labeled encrypted files while offline.
When you can distinguish Control access from content marking, pick assign-now versus user-defined permissions, quote the 30-day use license, and refuse to treat a header as encryption, you have this bullet.
You need a sensitivity label named Partner Review that encrypts a Word file and lets the author pick which external people can edit it. How should you configure Control access?
Security wants a visual deterrent that shows the identity of whoever opens a Highly Confidential spreadsheet, and they do not want that marking edited out of the file. Which label setting matches Microsoft's current documentation?
A label named External Mail uses Let users assign permissions with Do Not Forward. An admin asks how long recipients can open the encrypted message offline after they first authenticate. What is the correct statement?