Microsoft Purview sensitivity labels in M-Files

If your organization uses Microsoft Purview sensitivity labels for files, you can see these labels also in M-Files. M-Files can also tell if the sensitivity label is encrypted and hide file previews when the encrypted label restricts user access.

To show Microsoft Purview sensitivity labels in M-Files, make sure that:

  1. The Microsoft 365 connection is set up and up to date in M-Files Manage. For instruction, refer to Setting up a Microsoft 365 connection in M-Files Empower.
  2. Microsoft 365 storage is enabled for a vault. For instructions, see Enabling Microsoft 365 storage .
  3. You have enabled communication between M-Files and Microsoft Purview. For instructions, see PowerShell commands for Microsoft Purview.
When you have enabled Microsoft 365 storage, your vault content has two separate security layers:
  • Microsoft Purview sensitivity labels classify and protect files.
  • M-Files permissions control who can access the object in M-Files.
Make a note that the sensitivity labels and M-Files permissions are managed separately. This means that M-Files only shows the sensitivity labels, it does not edit or manage them. Similarly, Microsoft Purview does not edit any permissions or other content in M-Files.

As an organizational admin, you can manage the sensitivity labels in Microsoft Purview. You cannot manage the sensitivity labels in M-Files.

The users can add and edit sensitivity labels only in Microsoft Office apps, not in M-Files. In the M-Files user interface, the sensitivity labels are called Microsoft sensitivity labels. Currently, M-Files can show the sensitivity labels for these file types:
  • DOCX (Microsoft Word)
  • XLSX (Microsoft Excel)
  • PPTX (Microsoft PowerPoint)
  • PDF

For more information on sensitivity labels, refer to Learn about sensitivity labels in Microsoft Learn.

PowerShell commands for Microsoft Purview

Important: To do this, you must have a Global Administrator role in Microsoft Entra admin center.
To enable communication between M-Files and Microsoft Purview:
  1. Run Windows PowerShell as an administrator.
  2. Install or update the module.
    1. If you have not yet installed the module, enter this command to install it:

      Install-Module -Name Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser

    2. If you already have installed the module, enter this command to update it:

      Update-Module -Name Microsoft.Online.SharePoint.PowerShell

  3. Enter this command and replace [SharePoint address] with the Microsoft SharePoint address of your Microsoft 365 tenant. For example, Connect-SPOService -Url https://mycompany-admin.sharepoint.com.

    Connect-SPOService -Url [SharePoint address]

    This connects to the admin site of the tenant, and opens a Microsoft sign-in dialog.

  4. In the dialog that opens, enter your Microsoft Entra admin credentials and sign in.
  5. Enter this command:

    (Get-SPOTenant).EnableAIPIntegration

    This allows SharePoint Online to recognize and process labeled and encrypted Microsoft Office files. It does not create, publish, or apply sensitivity labels.

    If this command gives you:
    1. True, continue to step 6.
    2. False, enter this command:

      Set-SPOTenant -EnableAIPIntegration $true

      Then, continue to step 6.

  6. Enter this command:

    (Get-SPOTenant).EnableSensitivityLabelforPDF

    This verifies if SharePoint Online is enabled to process sensitivity labels on PDF files.

    If this command gives you:
    1. True, you can close Windows PowerShell.
    2. False, enter this command:

      Set-SPOTenant -EnableSensitivityLabelforPDF $true

      Then, you can close Windows PowerShell.