Prerequisites for Microsoft Purview Information Protection for the Australian Government

This article provides guidance for Australian Government organizations on the services and components that should be deployed to an organization to make best use of sensitivity labeling and other Microsoft Purview capabilities. Its purpose is to help organizations to understand the technical prerequisites for deployment of Microsoft Purview Information Protection to meet requirements outlined in the Protective Security Policy Framework (PSPF) and Information Security Manual (ISM).

To make best use of the configurations outlined in this guide, organizations should implement the following core set of Microsoft 365 services:

• Exchange online
• Microsoft Office online or Microsoft 365 Apps Office clients
• SharePoint online
• Microsoft Teams

The configurations discussed in this guide refer to markings and classifications up to and including PROTECTED, organizations should also use PROTECTED environment requirements beyond the scope of this guide.

ASD Blueprint alignment

  ASD's Blueprint for Secure Cloud provides detailed configuration guidance for Microsoft Purview Information Protection and related Microsoft 365 services. Organizations should review the Blueprint guidance in conjunction with this article, in particular:  

• Microsoft Purview Design
• Sensitivity label taxonomies
• Label publishing policies
• Data Loss Prevention (DLP) policies
• Auto-labeling policies 

The recommendations in this article are intended to complement and build on ASD Blueprint guidance. The ASD blueprint provides a standard configuration appropriate for most government entities, while the content included in this and associated articles builds on the standard and presents options for further enhancement of data security configurations.

Microsoft Office client support

Client support is key to successful implementation of Microsoft Purview Information Protection capabilities. The clients used by users to interact with Office files, email, and other services, need to be label and Microsoft 365 aware in order to facilitate label application. Capabilities such as label recommendations (provided via client-based auto-labelling) and in-client DLP features such as policy tips, are dependent on Office client version. This section discusses Microsoft Office client versions capable of this integration and seeks to identify any prerequisite work that is needed ahead of Purview deployment.

Microsoft 365 Apps for Enterprise

Microsoft 365 Apps is a version of Microsoft Office, which allows for integration with the Microsoft 365 suite of services. As Microsoft 365 is a cloud-based service that is continually evolving, the Microsoft 365 Apps version of the Office client receives a high frequency of updates to keep up with the cloud platform. This integration between the Office client and Microsoft 365 cloud services allows for a broader feature set to be made available to users than is achievable via standalone Office clients. Traditional clients offer a static feature-set and receive security updates, but typically don't receive newly released capabilities or access to cloud-centric capabilities.

For more information on update channels available to Microsoft 365 apps, see Overview of update channels for Microsoft 365 Apps.

Mac, iOS, and Android client support

New Purview features are typically made available to the Windows-based Microsoft 365 Apps version of the Office first and then to other Office versions. For the status of client versions capabilities, see minimum versions for sensitivity labels in different clients. Organizations deploying Microsoft 365 should review this information to ensure that all desired capabilities are available on the versions being used by the organization.

Microsoft 365 web clients

Minimum versions for sensitivity labels in Microsoft 365 Apps also includes information on features supported by Microsoft 365 web clients. This information should be reviewed to ensure that any sensitivity label capabilities required by your organization are available to web clients.

It's also worth noting that Microsoft Edge Chromium includes Microsoft Data Loss Prevention capabilities. Such capabilities can be added to other browsers like Chrome and Firefox via extensions. For example, Microsoft Purview extension for Chrome and Microsoft Purview extension for Firefox. These DLP capabilities can help to prevent the exfiltration of security classified or otherwise sensitive items, so should be considered for deployment if these browsers are being used in your organization.

Mandating client requirements

Client applications that have an understanding of a user’s requirement to apply security classifications to items help us by forcing users to apply classifications at time of item creation. Once items are classified and marked, operational controls to protect the item's enclosed content can then be enforced. Such configuration is often referred to as 'Mandatory Labeling.' Within Microsoft 365 this is primarily achieved via a label policy option, which is discussed in mandatory labeling. Mandatory labeling allows us to meet Release 2026 Requirement 59:

To demonstrate the importance of mandatory labeling, consider an email that sent without a protective marking first being applied, which could occur due to lack of client support. In such situations, we must assume that the user hasn't had an opportunity to assess the sensitivity of the enclosed information. We must therefore assume that distribution of the item is high risk. Options to enforce mandatory labeling can only be applied by clients that are aware of an organization’s Microsoft Purview configuration. Because of this, organizations should consider ensuring that users can only access Microsoft 365 services via clients that support such Microsoft Purview integration.

Restricting access to Microsoft 365 services through label-aware clients helps organizations meet both classification and access-control objectives. PSPF Section 9 requires information sensitivity to be assessed and classified appropriately, while PSPF Section 17 requires access to information to be limited according to business need and information sensitivity. Microsoft 365 access-control capabilities, including Data Loss Prevention (DLP), sensitivity label encryption, rely on accurate sensitivity labels being applied to items.

Enforcing the use of label-aware clients can be achived via Conditional Access policies requiring approved client apps. For more information on these capabilities, see Require approved client apps or app protection policy.

PDF integration

Windows-based Microsoft 365 Apps clients include the ability to maintain labels applied to Office documents when they're exported as PDF files. These PDFs maintain the protection settings that were applied to their source Office files, including encryption.

Protected PDF documents can be read in label-aware PDF readers including Microsoft Edge, Chrome, Foxit Reader, Nitro PDF, Gaaiho Doc and Adobe Reader.

Government organizations should deploy and use label-aware PDF clients or client plugins. Such clients help to maintain clear identification of sensitive information and application of controls when items are exported to PDF.

Optical Character Recognition

Optical Character Recognition (OCR) can be used to scan the content of images and image-based PDFs. Once scanned, Microsoft Purview capabilities such as Data Loss Prevention (DLP) can apply to them. OCR can also improve the effectiveness of content discovery, auto-labeling, and other Microsoft Purview classification capabilities when sensitive information is stored in image-based content. OCR can be particularly effective when used to identify content markings via Sensitive Information Types. SITs to identify protective markings includes a list of SITs that can be configured and used to identify protective markings. Once these SITs are configured and OCR enabled, SharePoint will index the text from image-based content and identify whether they contain a protective marking. If a protective marking is identified the image-based item can be protected via any DLP policies targeting the associated SIT. SIT-based DLP policy examples that would apply to indexed image-based content can be found in Controlling email of marked information.

For more information on the configuration and use of OCR, see Learn about optical character recognition in Microsoft Purview.

Required licensing

Entry level use of Purview Information Protection capabilities requires an E3 license. However, most Government organizations should consider using Microsoft 365 E5 (or equivalent Microsoft Purview Suite add-ons) to better provide for their data security requirements.

The following table has a subset of common government use cases and their minimum required license to perform that use case.

Compliance capabilities included in Microsoft 365 E5 provide automation and advanced controls that can help organizations to reach higher levels of compliance and data security maturity.

An important factor to achieving higher levels of compliance maturity is the use of sensitivity auto-labeling. Auto-labeling allows Government organizations to honor classifications that have been applied externally. If an email is classified and marked by one entity, when sent to a second entity the item is still marked but, by default isn't labeled. Because the email lacks a label, it's out of scope of a range of label-based data security controls, such as DLP policies. Auto-labeling allows for protective markings (as defined in Australian Government Email Protective Marking Standard) to be interpreted on email as it is received. Once interpreted, a matching label is applied during transmission, ensuring that all relevant controls apply to the item from that point forward. This will include DLP policies restricing Copilot from accessing items with certain sensitivity labels applied.