What happens to a file that is labeled, but not protected, if we add encryption to the label at a later date?

Yes, this is another question that I have heard a few times, and I see why it sometimes can seem confusing. And today I was asked again: So, what does happens to a file that has been labeled, but not protected if we add protection to the label later. The answer is that label settings that were applied at the time will not be changed because the label has been changed, I said, and felt pretty sure about this, but I still wanted to make certain. So, to the lab I went.

First of all I want to apologize for another extremely long title for this post, but this is close to what this person googled ... eh.. I mean Binged, so if he forgets, and want to search again, he might find this post. I created a label called SecureInsecure and did not give it any encryption settings. After publishing this label I right clicked a word file and chose Classify and protect.
Classify and protect

In the Classify and protect client, I selected the label and applied it to the document.

So, we now have labeled our document. I opened the Word document to see that it had the label applied.

Here we have chosen to see the Sensitivity bar.
Everything looks good and as we can see. The SecureInsecure label has been selected. Now back to our tenant to change the sensitivity label to include protection. I open the label and select Edit label.

Edit label
I go to Encryption, change the Encryption slider to On, and Assign permissions.

In our case I select the Add all tenant members option and then Save.
I go back to my client and open the word document. I see that it is labeled with the SecureInsecure label as before. But as we expected it is not encrypted although the label now includes encryption.
SecureInsecure label in place
"Are you sure?" you might ask and since you ask, we will make 100% certain that the document is still just labeled and not encrypted and. And how will we do that? In this case we will email it to an external recipient. 
Adding the document as an attachment and send to external recipient
We know that only members of our tenant should be able to read content protected with the SecureInsecure label, so if the protection settings had been added, the recipient should not be able to read the content.

Readable, also in the preview pane

The external recipient can open and read the document, and we verify that it is not protected. So, in conclusion: if we want to add protection later, we will have to re-label the documents.



Post a Comment

Popular posts from this blog

Do not Forward and the protection of attachments

Using Do not Forward or Encrypt Only as the results of a Sensitivity Label