Fix Azure Information Protection Mandatory Labels Not Working in Microsoft 365
Question details
The user is unable to use Azure Information Protection (AIP) mandatory classification labels on organizational devices, despite them working properly on personal devices and the web.
- Product
- Microsoft 365 / Outlook
- Device & OS
- not provided
- Scenario
- Attempting to apply mandatory classification labels to documents or emails using organizational hardware or managed mobile devices.
- Observed behavior
- Mandatory labels function correctly on personal devices and Outlook on the web, but fail to appear or work on organizational computers and organizational mobile devices.
Ensure that your organizational device has an active internet connection to sync the latest policies and verify that you are logged into the correct enterprise Microsoft 365 account.
Verify Office Versions and Test Web Access
Identify if the issue is version-specific or network-related by comparing desktop app configurations and testing Outlook on the web.
In many enterprise environments, differing Microsoft 365 versions between personal and managed devices can cause sensitivity labels to behave inconsistently. Checking the exact build numbers helps determine if an update is needed.
Open Outlook on the personal device where labels work. Go to File > Office Account, and note down the Version and Build number listed under 'About Outlook'.
Repeat the previous step on the affected organizational device. Compare the build numbers to see if the organizational device is running an outdated or different update channel.
On the organizational device, open a web browser, navigate to Outlook on the web, and attempt to compose an email to verify if the mandatory labels can be applied.
Check with colleagues to see if this issue affects only your account or all users in the organization. Collect screenshots of the missing labels and version numbers to provide to your IT administrator.
Refresh Local Office Policies
Force the Microsoft 365 desktop client to pull the latest Information Protection policies from Azure.
Try WPS Office for Secure and Compatible Document Editing
While resolving complex enterprise policy issues in Microsoft 365, consider using WPS Office as a lightweight, highly compatible alternative for processing your daily tasks without relying on heavy background syncs.
- 1. Download WPS Office: Visit the official WPS website and download the free desktop application for your system.
- 2. Open your files: Launch WPS Office and directly open your existing .docx, .xlsx, or .pptx files.
- 3. Secure your documents locally: Navigate to the Protect tab and select Encrypt to set a local password for your sensitive files.
Frequently Asked Questions
Why do mandatory sensitivity labels work on the web but not on the desktop app?
The desktop application relies on local policy synchronization and specific Office build versions to render labels. If the local cache is outdated, corrupted, or blocked by corporate firewalls, labels may not render correctly, whereas the web version communicates directly with Azure to fetch the latest active policies.
Can Mobile Device Management (MDM) settings affect Azure Information Protection labels?
Yes. Organizational devices managed by MDM solutions like Microsoft Intune might have strict Conditional Access or App Protection Policies configured. These policies can occasionally block or conflict with the Azure Information Protection client's ability to communicate with authentication servers.
How do I force Microsoft 365 apps to sync labeling policies?
You can force a sync by signing out of your Microsoft Office applications via File > Office Account, closing all Office apps, and then signing back in. This clears the current session token and forces the app to download the latest label definitions from the cloud.
