How to use sensitivity labels with your PDF files

Adobe Message bar showing the PDF's sensitivity label

Did you know you can now label your PDF files with the same sensitivity labels you use with your Word, PowerPoint and Excel files?

Using Microsoft Purview sensitivity labels, you can add a visible classification label, protect your PDF files with encryption and add visible marking such as headers, footers and watermarks. Your PDF file now respects any Data loss Prevention policies, such as blocking external sharing of confidential data.

What protection can I apply to a PDF file?

When you use Microsoft Purview sensitivity labels with PDF files, the following functionality is available:

  • Visual label
  • Encryption – assign permissions now
  • Encryption user-defined
  • Headers and footers
  • Watermarks
  • Data Loss Prevention policies to stop oversharing

In addition, if you use Adobe Acrobat you can also:

  • View the sensitivity label and permissions
  • Add, update and remove sensitivity labels
  • Apply a default label
  • Require PDF files to be labelled

How do I add a sensitivity label to a PDF file?

There are two options for adding a sensitivity label to a PDF file.

  1. Convert a labelled Word document to a PDF file. This will automatically apply the same sensitivity label to the PDF file.
  2. Apply a sensitivity label to a PDF directly from Adobe Acrobat.

Option one – Convert a labelled Word Document to a labelled PDF

Firstly create a Word document and then add your sensitivity label.

Then convert your labelled Word document to a PDF file. You can convert a Word to PDF in three ways:

  1. Convert to PDF
  2. Export as PDF
  3. Share a copy of a file via PDF

Convert a Word document to a PDF

From your Word document, select File > Save as Copy, then select PDF from the file extensions list.

Export Word document to PDF

From your Word document, select File > Export > Create PDF/XPS document.

Share a copy of a file via PDF

From your Word document, select Share > Send a Copy > PDF.

Option two – Natively label your PDF from Adobe Acrobat

This option requires some initial configuration. However once enabled Adobe Acrobat provides the ability to:  

  • Automatically add a default label (if your label policy specifies a Default label)
  • Prompt you to add a label (if your label policy specifies Mandatory labelling)
  • Add a label
  • Apply a label with encryption and user-defined permissions
  • Update a label
  • Delete a label

Enable Adobe Acrobat to work with Microsoft sensitivity labels

To natively use Microsoft sensitivity labels in PDF files, you must install the latest version of Adobe Acrobat (Not Adobe Reader).

Secondly, remove any previous MIP plug-ins for Adobe Acrobat as this is no longer needed.

Finally, enable the document message bar and the default and mandatory labelling by adding three Windows Registry settings via GPO, Intune etc.

These are the registry entries for Windows:

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown
Set the value
bMIPCheckPolicyOnDocSave to 1

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown
And set the value
bMIPLabelling to 1

Computer\HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\MicrosoftAIP
And set the value:
bShowDMB value to 1

Full details of Windows and macOS settings Microsoft Purview Information Protection support in Acrobat (adobe.com).

To install via Intune read the blog from my colleague Simon Skotheimsvik Simon does… How to use Intune to enable sensitivity labels on PDF files (skotheimsvik.no)

Add a sensitivity label to a PDF file

From your PDF file, select  File > Protect PDF > Select a Microsoft Sensitivity Label

Or

Select Tools > Protect > Select a Microsoft Sensitivity Label.

To sync the sensitivity labels, you need to sign in to your Microsoft 365 account. Tick the Remember me option so you do not need to sign in each time you use Adobe Acrobat

Once you have signed in, you can select your sensitivity label.

The message bar at the top of the document now shows the sensitivity label.

If you have enabled a default label or required labelling, the functionality is available in Adobe Acrobat.

View sensitivity labels applied to your PDF files

To view the sensitivity labels applied to a PDF file, you need the following:

  1. The latest version of Adobe Acrobat or Adobe Reader
  2. Enable the document message bar. See Microsoft Purview Information Protection support in Acrobat (adobe.com)

The sensitivity label is automatically when you view a labelled PDF file in Adobe Reader.

Current Limitations (December 2022)

There are some limitations to using sensitivity labels with PDF files:

  • The Default labelling for a Document library does not label PDF files.
  • Microsoft Edge does not display the sensitivity label when viewing a PDF file.
  • PDF/A is incompatible with encryption.
  • When the source Office document is encrypted using a sensitivity label, PDF password protection is disabled.
  • The Adobe Teams app does not show the sensitivity label.
  • You cannot view an encrypted PDF in Teams or SharePoint or the Adobe Teams app. You must use Edge or Adobe Acrobat or Adobe Reader.
  • Print to PDF does not support sensitivity labelling. Printing to PDF causes an error message.

Microsoft References

Learn about sensitivity labels – Microsoft Purview (compliance) | Microsoft Learn

Manage sensitivity labels in Office apps – Microsoft Purview (compliance) | Microsoft Learn

Apply sensitivity labels to PDFs created with Office apps

Keep Reading

PreviousNext