Show
Page 2
This article lists the file types and sizes supported by the Azure Information Protection (AIP) unified labeling client. For the listed file types, WebDav locations are not supported.
Tip To protect generic file types, which do not have built-in support for protection, while ensuring that recipients will be able to access them as expected, we recommend that you define the recipient as a co-owner of the file. For more information, see Protecting generic file types. File types supported for classification onlyThe following file types can be classified even when they are not protected.
Other file types support classification when they are also protected. For these file types, see the Supported file types for classification and protection section. Examples:
File types supported for protectionThe Azure Information Protection unified labeling client supports protection at two different levels, as described in the following table.
You cannot change the default protection level that the Azure Information Protection unified labeling client or the scanner applies. However, you can change which file types are protected. For more information, see Change which file types to protect. The protection can be applied automatically when a user selects a sensitivity label that an administrator has configured, or users can specify their own custom protection settings by using permission levels. Supported file types for classification and protectionThe following table lists a subset of file types that support native protection by the Azure Information Protection unified labeling client, and that can also be classified. These file types are identified separately because when they are natively protected, the original file name extension is changed, and these files become read-only. When files are generically protected, the original file name extension is always changed to .p<file-type>.
Warning If you have firewalls, web proxies, or security software that inspect and take action according to file name extensions, you might need to reconfigure these network devices and software to support these new file name extensions.
File types supported by Office The following list includes the remaining file types that support native protection by the Azure Information Protection unified labeling client, and that can also be classified. You will recognize these as file types for Microsoft Office apps. The supported file formats for these file types are the 97-2003 file formats and Office Open XML formats for the following Office programs: Word, Excel, and PowerPoint. For these files, the file name extension remains the same after the file is protected by a Rights Management service.
.doc .docm .docx .dot .dotm .dotx .potm
.potx .pps .ppsm .ppsx .ppt .pptm .pptx
.vsdm .vsdx .vssm .vssx .vstm .vstx .xls
.xlsb .xlt .xlsm .xlsx .xltm .xltx .xps File types excluded from classification and protectionTo help prevent users from changing files that are critical for computer operations, some file types and folders are automatically excluded from classification and protection. If users try to classify or protect these files by using the Azure Information Protection unified labeling client, they see a message that they are excluded.
By default, the scanner also excludes the same file types as the Azure Information Protection unified labeling client. For the scanner, the following file types are also excluded: .msg, .rtf, and .rar To change the file types included or excluded for file inspection by the scanner, configure the File types to scan in the content scan job.
Note If you include .rtf files for scanning, we recommend that you carefully monitor the scanner. Some .rtf files cannot be successfully inspected by the scanner and for these files, the inspection doesn't complete and the service must be restarted. By default, the scanner protects only Office file types, and PDF files when they are protected by using the ISO standard for PDF encryption. To change this behavior for the scanner, use the PowerShell advanced setting, PFileSupportedExtensions. For more information, see Use PowerShell to change which file types are protected from the scanner deployment instructions. Files that cannot be protected by defaultAny file that is password-protected cannot be natively protected by the Azure Information Protection unified labeling client unless the file is currently open in the application that applies the protection. You most often see PDF files that are password-protected but other applications, such as Office apps, also offer this functionality. Limitations for container files, such as .zip filesFor more information, see the Azure Information Protection known issues. File types supported for inspectionWithout any extra configuration, the Azure Information Protection unified labeling client uses Windows IFilter to inspect the contents of documents. Windows IFilter is used by Windows Search for indexing. As a result, the following file types can be inspected when you use the Set-AIPFileClassification PowerShell command.
With extra configuration, other file types can also be inspected. For example, you can register a custom file name extension to use the existing Windows filter handler for text files, and you can install other filters from software vendors. To check what filters are installed, see the Finding a Filter Handler for a Given File Extension section from the Windows Search Developer's Guide. The following sections have configuration instructions to inspect .zip files, and .tiff files. To scan .zip filesWhen your scanner is installed on a Windows server machine, you must also install the Microsoft Office iFilter in order to scan .zip files for sensitive information types. For more information, see the Microsoft download site. You can use the AIP scanner or the Set-AIPFileClassification PowerShell command to inspect .zip files. After finding sensitive information, if the .zip file should be classified and protected with a label, specify the .zip file name extension with the PowerShell advanced setting, PFileSupportedExtensions, as described in Use PowerShell to change which file types are protected from the scanner deployment instructions. Example scenario: A file named accounts.zip contains Excel spreadsheets with credit card numbers. You have a sensitivity label named Confidential \ Finance, which is configured to discover credit card numbers and automatically apply the label with protection that restricts access to the Finance group. After inspecting the file, the unified labeling client from your PowerShell session classifies this file as Confidential \ Finance, applies generic protection to the file so that only members of the Finance groups can unzip it, and renames the file accounts.zip.pfile. To scan .tiff files by using OCRThe Set-AIPFileClassiciation PowerShell command can use optical character recognition (OCR) to inspect TIFF images with a .tiff file name extension when you install the Windows TIFF IFilter feature, and then configure Windows TIFF IFilter Settings on the computer running the PowerShell session. For the scanner: After finding sensitive information, if the .tiff file should be classified and protected with a label, specify this file name extension with the PowerShell advanced setting, PFileSupportedExtensions, as described in Use PowerShell to change which file types are protected from the scanner deployment instructions. Supported file sizesSupported file sizes for the Office add-inThe following table lists maximum sizes supported for protection using Office with the AIP add-in:
Supported file sizes for non-Office filesWhen protecting non-Office files, and opening them using the AIP Viewer, the maximum file size is limited only by available disk size and RAM, the lower of the two. Supported file sizes for the File Explorer and PowerShellThe following table lists the maximum sizes support for encryption and decryption using the File Explorer and PowerShell:
Next stepsFor more information, see:
|