Mip Document Control

Feature Details

warning

Please be informed that there are some restrictions on data access.

For detailed information on MIP document control features,nextYou can check it at.

Output Print Marking

Overview

When printing the MIP document, document security print marking will be applied.

Applying Print Marking When Outputting MIP DocumentDS_MIP_INITItem Settings

{
    "aipDoc":{
        "marking":"use"
    }
}

Constraints

• In MIP Label (RMS/intune), output permissions must be granted in advance.
• Marking Restrictions When Viewing MIP Documents in Teams or Web App

Right-click release

Overview

Users can release MIP documents to convert them into regular documents through the right-click menu. Related modules below the right-click menu link.

In the previous version, MIP release was possible regardless of the ztcap policy, but the MIP release function has been changed to be released according to the ZTCAP policy as a standard feature.

In some environments, when installing the optional module (SCAI_DS365_ShellEvent), the local policy (DS_MIP_DEC_POLICY) gate may take precedence, allowing this ZTCAP query to be skipped. For details, refer to "MIP Document Release Function Usage Guide."

Related Ztcap Policy

To release the Mip document, a ztcap policy is required. Please refer to the explanation of the ztcap policy settings below and add them. The basic explanation of the ztcap policy is omitted. If there is no policy, the release of the Mip document will fail.

Select Mip document from the target document

• All Mip document release policy - Select all Mip documents
• When releasing a specific MIP document - After selecting the designated MIP document -> Assign label -> Select specific MIP label (multiple selections possible)

Document Event: Right-click the mouse and click the [Unlink Mip Document] menu

Execution Policy: Mip Document Release Selection

After selecting a policy, you can click the corresponding icon to view and edit (modify) the policy in JSON code format.

{
  "name": "[개발]Mip해제정책",
  "description": "모든 Mip문서 해제하는 정책",
  ....
  "enforcementAttributes": [
    {
      "order": 0,
     "category": "MIPRemove"   // category에 MIPRemove로 추가
    }
  ],
  "decisionFactors": [
    {
      "category": "document",
      "targets": [
        {
          "type": "mip",
          "use": true,
          "operation": "AND"
        }
      ]
    },
    {
      "category": "storage",
      "targets": [
        {
          "type": "local",
          "use": true,
          "operation": "OR",
          "info": {
            "folder": [
              "*"
            ]
          }
        }
      ]
    },
    {
      "category": "fileEvent",
      "targets": [
        {
          "type": "local",
          "use": true,
          "operation": "OR",
          "info": {
            "event": [
-              "RButtonClickLabelRemove"             // event를 RButtonClickLabelRemove로 지정
            ]
          }
        }
      ]
    }
  ]
}

MIP icon display policy on/off

Overview

This is a custom policy that can turn the display of the MIP icon on/off as a policy.

Related Custom Policies

item	value
ID	DSICON_NOT_USE_AIP_ICON
TYPE	Check On/Off
Policy Value Format	Check On/Off
Explanation	MIP icon display usage (1: not used, 0: used)
Policy Value	1 (or Check)
Note	scsc DSICON_NOT_USE_AIP_ICON.scsc

Application Method: Module Patch, Custom Policy Setting, and Policy Retrieval

Notification window call when viewing a read-only document

Notification when opening read-only Mip document

If a read-only document is being viewed, display a popup after viewing to inform that this document is read-only (e.g., This document is read-only. Edit the document by saving it with a different name.)

Overview

When opening the Mip document, if it opens as a read-only document, the following notification message appears.

Policy

Mip Init policy with option values as below (NotifyReadOnlyDocA key ) must be added for it to work.DS_MIP_INITpolicy link

{
    "s365_url": "https://devlogin.softcamp.co.kr/",
    ...(생략)...
    "custom": {
        ...
        "NotifyReadOnlyDoc": "use"        
    },
    ...(생략)...
}

Constraints

• For documents opened through onedrive, sharepoint, and teams, the file path is generated as a URL, so it is not possible to determine whether it is a Mip document through the Mip SDK, and therefore no notification window appears. Thus, this feature operates only for local files.
• This feature works when opening an attached document after downloading it locally, but it is not supported when opening directly from cloud links such as SharePoint. (For the same reason as above.)

Notification message

Third-party Tenant MIP Document Viewing Confirmation Guide

Overview

When a user logged in with a company account opens a document protected by a MIP (Microsoft Information Protection) label from another company's tenant, a confirmation dialog will first appear stating, "The document is protected by another company and access may be restricted. Do you still want to open it?" This feature allows the user to directly choose whether to open or block the document.

Reason for Needing This Feature

MIP labels are tied to the permissions of the company (tenant) that protects the document. Therefore, if an employee of our company opens an MIP document protected by another company's tenant, such as a client or partner, they will not be able to pass the protection policy of that document with their company account, and normal access will not be possible.

The problem is that in the existing operation, the user could not know the cause of this situation. When opening third-party MIP documents, MIP authentication failed, resulting in a blank screen and an unknown error. In some cases, inaccurate messages like "The validity period has expired" were displayed, leading users to misunderstand the cause. As a result, inquiries (VOC) such as "The document is corrupted / The product is malfunctioning" were repeatedly received.

This feature is designed to eliminate this confusion by identifying in advance at the time of opening the document that "this document is protected by another company," providing accurate guidance, and allowing the user to choose whether to open it or not.

Operation Method — "Confirm and Select" Instead of Forced Blocking

This feature does not block third-party documents unconditionally. It leaves the decision to the user with a yes/no confirmation dialog.

• Yes selection → Proceed with document viewing as before (actual viewing may be restricted due to third-party protection).
• No / Close Window (X) / No Response → Blocks access to the document.

Summary: When an employee of our company opens a document protected by MIP from another company's tenant, a confirmation window will first appear stating, "This document is protected by another company, and access may be restricted. Do you still want to proceed?" Depending on the user's yes/no selection, access will either proceed or be blocked.

Application Entry Point

This feature applies to the two ways users open documents.

#	Entry Point	User Action
1	Explorer double click	When double-clicking an Office document in Windows Explorer to open it
2	Office 'Open' dialog box	When selecting and opening a document in the [File → Open → Browse] dialog box of Word / Excel / PowerPoint

Opening methods other than the two paths above — Drag & Drop · Select from Office Recent Documents List · Acrobat (PDF) — are excluded from the scope of this feature (see the constraints below).

User Screen (Notification Confirmation Window)

If it is determined to be a third-party tenant MIP document, a confirmation dialog with the following yes / no options will be displayed.

┌─────────────────────────────────────────────┐
│  Document Security                           │
│                                              │
│  '<file name>' is protected by an MIP label of │
│  another tenant. Do you still want to open it? │
│                                              │
│                   [ No(N) ]  [ Yes(Y) ]    │
└─────────────────────────────────────────────┘

The buttons are arranged on the screen in the order of No / Yes (same as the existing product message window UI).

User Selection Results

• No (N): Blocks document access.
• Yes (Y): Proceeding with document viewing (actual viewing may be restricted due to third-party protection).
• Close Window (X) / Unresponsive (Auto Close): It is safely blocked. (To ensure that 'Yes' is not automatically pressed, it defaults to 'No' when unresponsive.)

The text only displays the file name instead of the full path, so the path information is not exposed.

The guidance text is provided in six languages: Korean, English, Japanese, Chinese, German, and Russian, and is displayed according to the system locale (if the language resource is not available, it will be displayed in English).

Action Scenario Summary Table

#	situation	Operation Result
1	Open third-party tenant MIP document in Explorer/Office + User selects 'Yes'	Confirmation window display → Proceed with viewing (Actual viewing may be restricted due to third-party protection)
2	Third-party Tenant MIP Document + User selects 'No' / X / No response	Display Confirmation Window → Access Blocked
3	Company MIP Document (No Company Permission)	Do not intervene in this function → Fallback to existing message (Issued GUID = Our GUID, not third-party)
4	General Document / Company Authority Normal Document / Non-MIP Document	Do not intervene in this function → View normally as usual
5	Products Without Third-Party Identification Core	Identification core absence → No operation, all documents open as before
6	Drag and Drop / Recent Documents List / Open with Acrobat (PDF)	Outside of applying this feature — Display app errors and login windows as before without a notification window (refer to limitations)

This feature only intervenes when it is a third-party tenant MIP document (Scenario 1·2). Otherwise (in-house documents·general documents), it does not block or guide at all, so there is no impact on existing behavior.

Support Document Types

This feature operates on Office documents from the Office 'Open' dialog entry point. Supported Office versions/types are Word, Excel, and PowerPoint of 2016 / 202X. The Explorer double-click entry point works for document extensions supported by the product. PDF is not supported (see the constraints below).

Constraints

Unsupported document opening path (Drag and drop · Recent documents · Acrobat PDF)

There are four main ways to open a document, and this feature only supports the two paths that have a 'pre-opening blocking point'.

Open Path	support
a. Double-click in the explorer	support
b. Open the Office 'Open' dialog box and select	support
c. Open in Office by Drag & Drop	Not supported
d. Open by selecting from the recent documents list in Office	Not supported
(Open with Acrobat (PDF))	Not supported

There are two supported paths (Explorer double-click · Office 'Open' dialog) where a confirmation dialog can be intercepted and displayed before the document opens, but there are no such pre-blocking points in the drag-and-drop · recent documents · Acrobat (PDF) paths, making it currently difficult to support safely.

User Impact: When opening third-party MIP documents via the c·d·Acrobat path, the guidance window for this feature does not appear, and the error/login window of the respective app (Office/Acrobat) is displayed as before. It is possible to detect (recognize) that it is a third-party document, but due to the above reason, "safely stopping before opening" is currently not possible.

Other Constraints

• Third-party identification core excluded products: Since there is no third-party identification core, guidance and blocking do not operate, and all documents open as before (intended non-operation).
• Multilingual Notification Message Distribution Dependency: Notification message resources (ResUI*.rc 6 types, 6.0.0.33) must be distributed with the SDK installation package. In non-distributed environments, the default messages will be displayed in English.
• Identification failure safety block: In uncertain situations such as unresponsive pop-ups or display failures, we handle it safely by blocking.
• DS365 certification status dependency: Since the judgment of in-house/third-party requires the in-house tenant GUID, the DS365 agent must be in a normal login and MIP certified state to be accurately judged.

Conversion of MIP Documents from Other Organizations (Import/Export)

Overview

Documents protected by Microsoft Sensitivity Labels (MIP) can only be opened and handled within the organization that issued the label. When exchanging documents with other organizations, such as partners or affiliates, there was an issue where received documents could not be opened internally, and documents sent could not be opened by the recipient organization.

This feature is**Transformation that changes the label of documents between our organization and other organizations with a connection (Trust)**Provides. By right-clicking the document in the explorer and selecting "Convert to Internal Document" or "Convert to Document of Another Organization," the label will be replaced according to the policies set by the administrator.

info

Summary— Label documents of other organizationsChange to internal document (import), internal documentsChange to the label document of another organization (export). The user does not choose which label to attach.Policy specified in the management consoledoes. However,Only between organizations where trust is establishedIt works.

Reason for Needing This Feature

Existing Issues	What this feature solves
Documents labeled with a different organization do not have the conversion option in the right-click menu, so there was no way to handle them internally.	Display the import menu and convert it to an internal document.
The internal document could not be opened by the other organization with their own organization label.	Attach the counterpart organization label and deliver it through the export menu.
The properties window of another organization's document was empty, and I couldn't tell what was missing and why.	Connected organizational documents display protection information, while disconnected organizational documents provide reasons.
I could not visually distinguish between our organization's documents and other organizations' documents in the explorer.	Separate icon display in other organizational documents (reflected as a prerequisite task)

Operation Method

documentReading which organization issued the labelAfter that, if the organization is connected to usAttach and detach labels with organization-specific authentication.. A progress window will appear for the user, showing success or failure, and if it fails, the original will remain unchanged.

Scope / Entry Point

Entry Point	support	Explanation
Explorer right-click — "Convert to Internal Document"	support	Importing other organization's protection documents as internal documents
Explorer right-click — "Convert to another organization's document"	support	Exporting our organization's MIP document to another organization's label
Document Properties Window — MIP Information Tab	support	Display labels, owners, and protection status of connected documents from other organizations
Explorer Icon Distinction	support	Reflected in the preceding work
Automatic conversion when opening and closing documents	conditional	It can be applied with conditional policies, but the existing internal conversion policies andCannot walk together. Refer to limitation 5
Multi-file selection right-click	conditional	In multiple selection, you cannot filter by document type.Display all registered menusIt is possible. The conversion results for each item may vary depending on the selected document. See constraint 10.

User Interface (UX)

Explorer Right-Click Menu

The items that appear vary depending on the document type. (When a single file is selected)

[ Our Organization MIP Document ]
   Document Security
     Convert to DRM Document
     Convert to General Document
     Convert to Other Organization Document      ← New (Export)

[ Other Organization Protected Document ]
   Document Security
     Convert to In-house Document            ← New (Import)

[ Other Organization Classification Exclusive Document — Linked Organization ]
   Document Security
     (Existing General Document Menu)
     Convert to In-house Document            ← New (Import)

warning

**Selecting multiple files at once will not apply the above separation.**All registered menus will be displayed (Constraint 10).

Conversion Progress Window

When you select conversion, a progress window will appear and the results will be displayed by file.

result	screen	Original
success	"Success" indicator	Replace with the converted document
failure	Display Reason Text	Keep the original as is
Unsupported documents mixed in	Mark only this item as unsupported.	Maintain original

When you hover over the itemPath and Reason for Failureis visible together.

Document Properties Window (MIP Information Tab)

document	Display content
Our Organization Document	Same as before — Label name · Owner · Encryption status · Access permissions list
Connected Other Organization Documents	Display the same item.The owner is their own identifier valueIt seems (see explanation below)
Unconnected documents from other organizations	"Cannot display information because it is a document from an unconnected organization."

About Owner Identification— Since the documents exported to another organization are protected by app-specific authentication, the owner recorded in the document is not a person but an app identifier (형식: 식별번호@식별번호.rms.ap.aadrm.com) becomes. A value that has no meaning to the user.Only in the properties window DS6@security365.comIt will be shown as changed. The actual values recorded in the document remain unchanged, so there is no hindrance to failure analysis.

Policy / Settings

Right-click menu policy

The menu item itself is a policy. Custom policy in the management consoleDS_MIP_SHELL_MENUtoRegister command number and check usageThe menu will appear when you do __PH_0__.

Command Number	Menu	Target
276	Convert to internal document	Other Organization MIP Document (Import)
277	Convert to another organizational document	Our Organization MIP Document (Export)

warning

**If you forget to check the usage after entering only the value, the menu will not appear.**It does not operate quietly as it is not distinguished from unregistered, so be sure to check after setting it up.

Sample Policy

DS_MIP_SHELL_MENUofds6_ShellMenuarray inAdd the following two itemsYou can simply add to the existing items (250 · 251 · 252 · 253 · 254) without changing them.

[
  {
    "ds6_ShellMenu": [
      {
        "titleRes":   "SHELL_OTHER_MIP_TO_OURS",
        "titleDesc":  "UI_OTHER_MIP_TO_OURS_DESC",
        "targetCmd":  276,
        "targetIcon": "ConvertCrossTenant.bmp",
        "targetExt":  "docx|pptx|xlsx",
        "targetType": "otherMip"
      },
      {
        "titleRes":   "SHELL_OURS_MIP_TO_OTHER",
        "titleDesc":  "UI_OURS_MIP_TO_OTHER_DESC",
        "targetCmd":  277,
        "targetIcon": "ConvertCrossTenant.bmp",
        "targetExt":  "docx|pptx|xlsx",
        "targetType": "aip"
      }
    ]
  }
]

field	value	Explanation
titleRes	SHELL_OTHER_MIP_TO_OURS / SHELL_OURS_MIP_TO_OTHER	Menu text resource key. Defined in 6 language resources.
titleDesc	UI_OTHER_MIP_TO_OURS_DESC / UI_OURS_MIP_TO_OTHER_DESC	Description Text Resource Key
targetCmd	276 (Import) / 277 (Export)	Command number.The operation varies with this value.
targetIcon	ConvertCrossTenant.bmp	Menu Iconfile name. C:\Windows\Softcamp\SDS\ImageThe file must have the same name as the one deployed.
targetExt	docx · pptx · xlsx	The extension to display the menu. Write it as a single string separated by vertical bars.
targetType	otherMip(Import) /aip(Export)	Document types to display the menu.otherMipis the value added this time.

warning

targetIconto existingConvertAIP.bmpIf you set it to __PH_0__, the same icon as other conversion menus will appear. To distinguish, specify with the above value.

Conditional Policy (Transformation Rules)

The conditional policy determines which document is changed to which label of which organization.

Composition	Value to be contained
event	Event for Inter-Organization Transformation (Right-Click Transformation)
condition	Document Issuing Organization Identifier
Execution — Departure Point	Departure Organization's Company Identifier
Execution — Destination	Arrival Organization's Company Identifier · Label Identifier to Attach

warning

**Only one enforcement policy is valid under the same conditions.**The import policy and export policy must have different conditions (departure organization).

Inter-organizational connections

in the management console**Connection with the Other Organization (Trust)**This must be connected. Documents of unconnected organizations do not establish conversion and only display guidance in the properties window.

Action Scenario Summary Table

This is the criterion when a single file is selected.

Document Status	Right-click menu	Conversion result	Property Window
Our Organization MIP Document	Existing + "Convert to another organization's document"	Relative Organization Label Document	Same as before
Other Organization Protection Document — Connected	"Convert to internal document"	Company Document	Display Protection Information
Other Organization Protection Document — Not Connected	"Convert to Internal Document" (Displayed)	Failure — Guide to Disconnected Organizations	Guide text
Other Organization Classification Only — Connected	Existing + "Convert to Internal Document"	Company Document	Same as before
Other organization classification only — not connected	Existing Menu Only	Not applicable	Guide text
Issuing organization determination not possible	Existing Menu Only	Not applicable	Same as before
Plain Text · DRM Document	Existing Menu Only	Not applicable	Not applicable

Scope of Support

Document Type	support
Classification-only document with labels attached	support
Protected document with label information (LabelInfo)	support
Document without label information in CFB protection	Not Supported (Limitation 2)
Label requiring custom permissions	Unsupported (Limitation 9)

Show the menuextension is DS_MIP_SHELL_MENU policy's targetExt is determined(Right-click menu policy reference). The verification of this feature isdocx · pptx · xlsxwas performed.

Application Method (Administrator Procedure)

1. Module Deployment— Distributes the provided module to each installation location.
2. Rebooting— Rebooting is the most certain due to the explorer extension and resource cache.
3. Check Connection Between Organizations— Check if a connection (Trust) is established with the counterpart organization in the management console.Without this, the subsequent steps are meaningless.
4. Right-click menu policy registration — DS_MIP_SHELL_MENUafter registration 276·277Usage Check(Refer to the sample of the right-click menu policy).
5. Conditional Policy Registration— Register the conditions and execution values for both import and export.
6. Re-login— The menu policy is read once upon login. After changing the policy, you need to log in again or restart the explorer.
7. check— Check if the menu appears by right-clicking on another organization's document.

Constraints

1. **You can only transform between organizations where trust is established.**In the management console, a connection with the counterpart organization must be established for the authentication token for that organization to be issued. If there is no connection or it is disconnected, the conversion does not take place.It is not a feature to release arbitrary external organization documents or to label arbitrary organizations.
2. Documents without LabelInfo in the CFB protection document do not determine the issuing organization.The distinction between our organization and other organizations, as well as the conversion menu, does not appear. This isActions confirmed to prevent misjudgmentThe property area of the protection document is linked by name and value to an identification number, so if you pair it by looking only at the value without label information, records of previously removed labels can interfere and misjudge our document as another organization's document.
3. **There is no directional indication in the integrated log for the conversion of results to internal encryption documents or plaintext.**In that case, the log event type changes to document creation, which does not correspond to an event that includes inter-organizational notation.
4. If the transformation instruction fails (connection failure, no policy), only the direction remains in the integration log, and the organization identifier is empty.
5. You cannot apply both the "Internal Conversion" policy and the "Export" policy at the end of the document.The close·open event only distinguishes the document status and does not contain direction, so only one enforcement policy can be established under the same conditions. Registering two policies together isPolicy Configuration Erroris. Right-click conversion does not apply.
6. **The owner of the exported document is not designated as a user account.**The authority management service of the opposing organization does not accept external domain users as delegated subjects, resulting in protection through app-specific authentication. The properties window containsDS6@security365.comIt is indicated by __PH_0__, and the value recorded in the document is the app identifier.(Current verification environment standards, and may vary depending on the relative organization settings, so it is under separate verification.)
7. **The exported document cannot be opened by the person who executed the conversion.**The resulting document is protected with a label exclusive to the counterpart organization, so this is the expected behavior by design. It is shared with the counterpart organization for viewing.
8. **Unconnected documents from other organizations do not display protection information.**You do not have permission to view, only the guidance message will be displayed.
9. **Labels that require custom permissions are not attached.**We cannot arbitrarily decide what permissions to grant to whom. It is marked as a reason for non-support.
10. When you select multiple files and right-click, all registered menus will be displayed regardless of the document type.In multi-select, you cannot narrow down the menu by filtering the types of individual documents. Even if you press the visible menu, it depends on the selected document configuration.The results may vary by item.(The documents that do not apply will not be converted and the original will be maintained). Transformation between organizations isSingle file selectionWe recommend.