M365 Sensitivity Labels - Permissions

[simpsonj]

I'm trying to setup sensitivity labels for M365, but having difficulties with the access control element.

 

What I want is a Sensitivity Label called Read-Only that allows authenticated users to view the document, export it and print it, but not online edit it. This seems simple enough, but in practice I can't get it to work for love nor money.

 

Steps taken:

 

• Created a label, given it an appropriate name
• Scoped it for files, email and meetings (I don't really need the latter two)
• Ticked Control access
  • Configure access control settings
  • Assign permissions now
  • Left user access to content expires and allow offline access as their defaults
• Assign permissions
  • AuthenticatedUsers
    • View content
    • Print
    • Copy and extract contents
    • Export content
  • (I've also tried using the 'Add all users and groups in your organization')
• No auto labelling
• Definte protection settings for groups and sites can't be changed, so left as default
• I've then distributed the labels to two test users.

 

When I create a docuemnt with the senstivitly label applied and share it between the test users, the user that's the owner can still edit the document online, and the other user can't edit it, so that bit works. However, neither user can print, create a copy or download the document.

 

I must be missing something, but I can't for the life of me work out what it is. My assumption is that the users aren't fully authenticating against whatever service manages the user permissions, but I don't know how to troubleshoot it. Or is it a licence issue and it doesn't work on A3 licences?

 

Any help gratefully received!