Microsoft Information Protection (MIP)

This document function applies Microsoft Information Protection (Microsoft Purview) sensitivity labels when generating Word, PowerPoint and Excel documents. The user selects the label in the generation form; primedocs applies the label's visual markings (headers/footers, watermarks) and — if enabled — rights-based protection.

Prerequisites

• An Azure AD app registration whose client ID is set in ApplicationId (used for MIP SDK operations).
• For rights-based protection (EnableProtection), the _System.MIP.Protection connected service must be configured.
• Selecting a label may require the user to sign in to the connected service first.
• The Visual C++ Redistributable must be installed on the server (or the system running the MIP operations), as it is required by the MIP SDK.

Basic structure

Configuration is done in the template editor under Document Functions. The settings can be defined either locally or referenced from a global configuration — mixing both is not allowed.

<MipConfiguration>
  <ApplicationId>00000000-0000-0000-0000-000000000000</ApplicationId>
  <EnableProtection>true</EnableProtection>
</MipConfiguration>

Configuration elements

Element	Required	Description
ApplicationId	required	Client ID of the Azure AD app registration used for MIP SDK operations. For a local configuration, ApplicationId must be set; when referencing a GlobalMipSettings entry instead, that global entry must provide the ApplicationId.
EnableProtection	optional	true if labels with rights management (protection) should be supported. Requires the _System.MIP.Protection connected service.
OverrideServiceUrl	optional	Overrides the MIP service endpoint (e.g. for local development).
GlobalMipSettings	optional	Reference to a global MIP configuration via the Key attribute. When used, all settings are loaded from the referenced global entry; must not be combined with local settings.

Reusing global MIP settings

If the same MIP configuration is needed across multiple templates, maintain it centrally as a global configuration of type MipGlobalSettings and reference it via GlobalMipSettings:

<MipConfiguration>
  <GlobalMipSettings Key="StandardMip" />
</MipConfiguration>

info

The sensitivity label selection appears to the user as a field in the generation form. Which labels are available depends on the tenant's MIP/Purview configuration.

Server-side application (dark processing)

Sensitivity labels are applied not only in the Office client but also server-side during document generation — in particular on the Document Creation Server (DCS) and for automated generation via Connect ("dark processing"), without any local Office add-in involved.

The label is applied as the last step of the document pipeline, directly on the document byte stream. The reason: when rights-based protection is active (EnableProtection), MIP encrypts the document, so it is no longer plain Office Open XML and cannot be processed further. Word, PowerPoint and Excel are supported.

Authentication

Server-side, no interactive Office sign-in is available. Authentication therefore runs through Connected Services:

• The user's OAuth access token is stored server-side as a connected service and decrypted per user. The user identity is derived from the token (JWT).
• An isolated MIP cache is used per user (relevant for terminal-server / Citrix environments).
• If the required connected service is not signed in, label selection is blocked (sign-in prompt). With EnableProtection enabled, both services (_System.MIP and _System.MIP.Protection) must be signed in.

Available labels

The available sensitivity labels are read at runtime directly from the MIP service (not from a local copy):

• Hierarchical labels are shown as Parent\Child.
• Only active labels appear.
• Labels with rights-based protection appear only if EnableProtection is set.

Label selection in the generation form of the desktop client. The entry Demo Group\Demo Label in Group shows how a hierarchical label is rendered.

The same selection in the web app, here with the description shown per label.

Visual markings

During server-side generation, no visual markings (headers/footers, watermarks) are burned in — only the label (including rights-based protection) is set. The visual markings are re-applied when the document is opened in the Office COM add-in (relabeling).