microsoft-information-protectionmip-sdk

MIP SDK setting unexpected ContentBits metadata

We are using the MIP SDK to apply sensitivity labels to files (using the c# Microsoft.InformationProtection.File nuget package). We use the IFileHandler.SetLabel method for this. This seems to protect the file and apply most of the metadata as expected, except for the ContentBits metadata.

Based on the MIP SDK metadata documentation: enter image description here

And based on the answer here and here, I do not expect the MIP SDK to watermark the content, but instead to add the ContentBits metadata that tells the AIP client to watermark the document.

If we have a label that is both encrypted and has a watermark, and we use the MIP SDK to apply that label to a file, the file is protected and the metadata added, however the ContentBits property is set to "8". If its a Word document, and we then open it, no watermark is applied. If we manually change the ContentBits property to "12", the Watermark is added on save.

If we use Word to manually select the same encrypted / watermarked sensitivity label from the ribbon, the document is watermarked and protected. The ContentBits metadata is set to "12".

Is this behavior expected? We tried applying the label using the AzureInformationProtection powershell module's Set-AIPFileLabel and it also sets the ContentBits property to "8". I would have expected both the MIP SDK and powershell to set the ContentBits to "12". If this isn't by design, is there a suggested work around?

Solution

  • Ok, I checked in with engineering and discovered that this is working by design. I will work to clarify this in the docs.

    ContentBits is set to reflect what action has been taken by the application setting the label. In the case of the File SDK, it doesn't support content marking. Therefore, the ContentBits value will always be 0 or 8 - the only thing it can do is protect.

    When an application that does support content marking saves the document, it should evaluate the current ContentBits value with the actions it supports. In your example, the SDK would see that ContentBits is 8, but the AIP add-in supports all three forms of marking, making the expected value 15. The client will apply the content marking, then set the value to 15.

    I hadn't repro'd this in my initial comment, I only saw that the SDK was applying 8. I've now tested this end to end with the AIP client opening a file protected by MIP SDK and it seems to be working as expected. That is, the content markings are applied on save and ContentBits is updated to 15.

    I performed my test with:

    Can you share your version details? I'd expect this to work on any of the AIP UL clients.