Purview Label Inheritance from Attachments: iOS & Android

Roadmap ID 569021 finally closes the mobile parity gap for Purview sensitivity label inheritance. If you've already configured label inheritance on Outlook desktop and you're scratching your head wondering why your mobile users keep sending Confidential attachments under a General email label — this is the fix. This article walks through every layer: policy configuration, Intune APP, PowerShell automation, Graph API integration, and the production gotchas that will bite you if you skip them.

How Label Inheritance Actually Works

Label inheritance is not magic — it is a priority integer comparison. Every sensitivity label in your tenant has a numeric priority (0 = lowest). When a user attaches a file, Outlook reads the label metadata embedded in that file, compares its priority to the current email label, and if the attachment wins, one of two things happens: the label is silently promoted (Automatic mode) or the user is nudged with a recommendation bar (Recommended mode). The email is never allowed to leave at a lower classification than its most sensitive attachment.

Prerequisites Checklist

Step-by-Step Implementation

1. Verify and order your label priorities

   Navigate to Microsoft Purview compliance portal → Information Protection → Labels. Drag labels so higher-sensitivity labels sit lower in the list (higher priority number). The order here is the order the inheritance engine uses. A mislabelled priority ordering is the most common root cause of unexpected inheritance behaviour in production.

2. Enable AttachmentAction on the Label Policy

   Use Security & Compliance PowerShell. The UI exposes a toggle, but the advanced settings give you full control and are script-repeatable across tenants.

   # Connect to S&C PowerShell
   Connect-IPPSSession -UserPrincipalName admin@contoso.com
   
   # Inspect current advanced settings first
   Get-LabelPolicy -Identity "Corporate-Label-Policy" | Select-Object -ExpandProperty Settings
   
   # Set Automatic inheritance (silent promote)
   Set-LabelPolicy -Identity "Corporate-Label-Policy" `
     -AdvancedSettings @{
       AttachmentAction    = "Automatic"
       AttachmentActionTip = "Label upgraded to match attachment sensitivity."
     }
   
   # OR set Recommended mode (shows a prompt bar)
   Set-LabelPolicy -Identity "Corporate-Label-Policy" `
     -AdvancedSettings @{
       AttachmentAction = "Recommended"
     }
   
   # Confirm the setting landed correctly
   (Get-LabelPolicy -Identity "Corporate-Label-Policy").Settings | `
     Where-Object { $_.Key -match "Attachment" }

3. Configure Intune App Protection Policy for Outlook

   In the Intune admin center → Apps → App protection policies, target com.microsoft.outlook (Android) and com.microsoft.Outlook (iOS). The critical data protection settings that must align with your label boundaries are below. If these are misconfigured, a labelled file can leak outside the policy-managed boundary before inheritance even triggers.

   # Data protection settings — set via UI or Graph
   Send org data to other apps:    Policy managed apps
   Receive data from other apps:   Policy managed apps
   Save copies of org data:        Block
   Restrict cut/copy/paste:        Policy managed apps with paste in

4. Automate APP deployment via Graph API

   If you are managing multiple tenants or want to codify this in a pipeline, use the Graph API to read and patch iOS Managed App Protection policies. The endpoint below retrieves all iOS APP policies for inspection.

   # GET — list all iOS Managed App Protection policies
   GET https://graph.microsoft.com/v1.0/deviceAppManagement/iosManagedAppProtections
   
   # PATCH — update data protection settings on a specific policy
   PATCH https://graph.microsoft.com/v1.0/deviceAppManagement/iosManagedAppProtections/{policyId}
   Content-Type: application/json
   
   {
     "allowedOutboundDataTransferDestinations": "managedApps",
     "allowedInboundDataTransferSources":      "managedApps",
     "appDataEncryptionType":                  "whenDeviceLocked"
   }

   💡 Required Graph ScopeYou need DeviceAppManagement.ReadWrite.All for PATCH operations on APP policies. Use a service principal with a client credential flow in automation pipelines — never delegate interactive credentials in scripts.
5. Validate on a test device

   Label a Word document as Confidential. On an iOS or Android device running the minimum Outlook build, compose a new email, manually set the email label to General, then attach the document. In Automatic mode the label bar should immediately flip to Confidential. In Recommend mode a yellow info bar appears. If neither happens, check app version first, then policy sync lag (allow up to 24 hours for label policy propagation).

6. Monitor via Purview Audit

   Run the audit search below after your validation to confirm label events are flowing. This PowerShell script exports the last 7 days of label activity to CSV for review.

   # Full audit export — label apply and update events
   Search-UnifiedAuditLog `
     -StartDate (Get-Date).AddDays(-7) `
     -EndDate   (Get-Date) `
     -Operations "SensitivityLabelApplied","SensitivityLabelUpdated" `
     -RecordType "AipSensitivityLabelAction" `
     -ResultSize 5000 |
     Select-Object CreationDate, UserIds, Operations, AuditData |
     Export-Csv -Path "./LabelAudit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
   
   # Parse AuditData JSON for mobile-sourced events
   $results = Search-UnifiedAuditLog `
     -StartDate (Get-Date).AddDays(-1) `
     -EndDate   (Get-Date) `
     -Operations "SensitivityLabelUpdated" `
     -ResultSize 1000
   
   $results | ForEach-Object {
     $data = $_.AuditData | ConvertFrom-Json
     [PSCustomObject]@{
       User       = $_.UserIds
       Time       = $_.CreationDate
       OldLabel   = $data.OldSensitivityLabelId
       NewLabel   = $data.SensitivityLabelId
       Source     = $data.ApplicationId  # look for Outlook mobile app ID here
     }
   } | Format-Table -AutoSize

Architecture: Where Inheritance Fits in the Stack

Common Gotchas From Production

Quick Reference: AttachmentAction Modes

The Deployment Decision

Start with Recommended mode for the first 30 days. Harvest the audit logs, quantify how often users are being prompted, and watch how many accept vs. dismiss. If accept rates are above 80%, switch to Automatic — you are just adding friction for no gain. If dismiss rates are high, that is a training gap, not a policy gap. Fix the training first.

For GCC High and DoD environments, the same configuration applies but ensure your Purview compliance portal endpoint is the correct sovereign cloud URL and that your Connect-IPPSSession targets -ConnectionUri https://ps.compliance.protection.office365.us accordingly. All roadmap timelines for those environments typically trail the commercial GA by 4–8 weeks.