Microsoft Information Protection (MIP)
This document function applies Microsoft Information Protection (Microsoft Purview) sensitivity labels when generating Word, PowerPoint and Excel documents. The user selects the label in the generation form; primedocs applies the label's visual markings (headers/footers, watermarks) and — if enabled — rights-based protection.
- An Azure AD app registration whose client ID is set in
ApplicationId(used for MIP SDK operations). - For rights-based protection (
EnableProtection), the_System.MIP.Protectionconnected service must be configured. - Selecting a label may require the user to sign in to the connected service first.
Basic structure
Configuration is done in the template editor under Document Functions. The settings can be defined either locally or referenced from a global configuration — mixing both is not allowed.
<MipConfiguration>
<ApplicationId>00000000-0000-0000-0000-000000000000</ApplicationId>
<EnableProtection>true</EnableProtection>
</MipConfiguration>
Configuration elements
| Element | Required | Description |
|---|---|---|
ApplicationId | optional | Client ID of the Azure AD app registration used for MIP SDK operations. |
EnableProtection | optional | true if labels with rights management (protection) should be supported. Requires the _System.MIP.Protection connected service. |
OverrideServiceUrl | optional | Overrides the MIP service endpoint (e.g. for local development). |
GlobalMipSettings | optional | Reference to a global MIP configuration via the Key attribute. When used, all settings are loaded from the referenced global entry; must not be combined with local settings. |
Reusing global MIP settings
If the same MIP configuration is needed across multiple templates, maintain it centrally as a global configuration of type MipGlobalSettings and reference it via GlobalMipSettings:
<MipConfiguration>
<GlobalMipSettings Key="StandardMip" />
</MipConfiguration>
The sensitivity label selection appears to the user as a field in the generation form. Which labels are available depends on the tenant's MIP/Purview configuration.