Data Protection Issues

Fix Azure Information Protection Scanner Changing File Ownership

Olivia Miller Sep 28, 2026 869 views

Question details

Users report that running the Azure Information Protection (AIP) scanner alters file and folder ownership in redirected network locations, preventing creators from viewing content.

Fix Azure Information Protection Scanner Changing File Ownership

Product: Azure Information Protection
Device & OS: not provided
Scenario: Scanning redirected network locations using the AIP scanner for classification and protection.
Observed behavior: File and folder ownership is changed, resulting in content becoming invisible to original creators and expected NTFS permissions failing to apply.

Before you start

Ensure you have administrative access to the Azure portal and have backed up your network drive's NTFS permission structure before making changes to scanner configurations.

Solution 1Recommended

Review Scanner Configuration and Consult Microsoft Q&A

Because this involves complex NTFS permissions and Azure configurations, reviewing your setup and escalating the issue to dedicated Microsoft specialists is the recommended path.

The Azure Information Protection scanner runs under a service account. If misconfigured, the classification and labeling process can accidentally assume ownership of files on network drives, stripping original creator permissions.

Verify current scanner permissions

Check the service account used by the Azure Information Protection scanner. Ensure it has the necessary read/write permissions without being forced to take ownership of files.

Review NTFS folder settings

Navigate to your redirected network location in File Explorer, right-click the affected folder, select 'Properties', and check the 'Security' tab to see how ownership and Access Control Lists (ACLs) have been altered.

Post to the Microsoft Q&A forum

Visit the dedicated Azure Information Protection Microsoft Q&A forum at https://learn.microsoft.com/en-us/answers/tags/24/azure-information-protection.

Provide specific environment details

When posting your support request, include detailed information about your scanner configuration, the redirected folders' setup, the observed ownership changes, and the expected NTFS permissions.

Review Scanner Configuration and Consult Microsoft Q&A

Microsoft Q&A Assistance: Microsoft engineers and community members who specialize in Azure Information Protection monitor the Q&A forum and can provide targeted PowerShell scripts or registry adjustments for your specific network architecture.

Free Microsoft Office alternative

Try WPS Office for Secure and Reliable Document Management

While resolving infrastructure and network-level file permission issues, you need a dependable office suite that doesn't unexpectedly alter file attributes. WPS Office is a free, lightweight alternative to Microsoft Office that offers excellent compatibility and respects standard Windows file ownership structures.

1. Download WPS Office: Visit the official WPS Office website and click the free download button for your operating system.
2. Install the software: Run the downloaded installer and follow the on-screen instructions to complete the setup in minutes.
3. Open your documents safely: Launch WPS Office and open your network files safely, knowing standard folder permissions and creator ownership will remain intact.

High compatibility with Microsoft Word, Excel, and PowerPoint file formats.Respects local and network NTFS permissions without overriding file ownership.Lightweight installation with a familiar, easy-to-use tabbed interface.Free alternative with robust built-in PDF editing and document protection features.

microsoft office alternative - wps office

Frequently Asked Questions

Why is the AIP scanner modifying file ownership?

The AIP scanner service account may have been granted broad 'Take Ownership' permissions or is misconfigured to alter file metadata and security attributes during the classification and labeling process on network drives.

Can I revert the NTFS permissions changed by the AIP scanner?

You can manually revert permissions via the folder's Security properties in Windows, or use ICACLS scripts to restore NTFS permissions in bulk if you have a prior backup of the original Access Control Lists (ACLs).

Does the Azure Information Protection scanner support scanning redirected folders?

Yes, but redirected network folders often have strict creator-owner permissions. Scanning them requires careful service account configuration to ensure the scanner can read and label files without stripping original user access.

Microsoft Office Security Issues