Northwind Legal: encryption settings that silently break co-authoring
Northwind Legal has 14,000 staff and 3.2 TB of active matter files in SharePoint Online. Its taxonomy ends in a sublabel, 'Highly Confidential - Matter Team', configured with Assign permissions now using a predefined Co-Owner role mapped to an Entra group per practice. Labels are published in a single policy to All users, with Internal as the default and mandatory labeling off. In a 200-lawyer M&A pilot, Word for the web shows 'This document is protected' and co-authoring breaks: the second editor gets a read-only copy and autosave stops. Matter teams routinely edit the same clause for hours. The security team's first instinct is to strip encryption from the sublabel, which the CISO has rejected on confidentiality grounds.
1. Diagnose why co-authoring fails and specify the minimum label configuration change that restores simultaneous editing while keeping the file encrypted.
Read the worked answer
Diagnosis
- The sublabel uses predefined permissions: a fixed Co-Owner role bound to an Entra group. Rights are baked in when the label is applied, so the second editor cannot be granted a live editing license; Office falls back to read-only and autosave halts.
- Protected co-authoring requires the label to use user-defined permissions (rights issued per user at open time) plus the file being in SharePoint Online or OneDrive with autosave on.
Change
- Keep Assign permissions now, switch to user-defined permissions, and pre-populate the practice's matter group as the default so most users never have to add anyone. Scoping is preserved because the default is still the matter group.
- While editing the label, check the neighbouring settings for secondary blockers: offline access days set very low will strand remote editors, and content expiry can revoke access mid-review.
Verify
- Retest with five pilot pairs in Word for the web and desktop; confirm both editors get an edit session and that Activity explorer shows the same label ID on the file before and after.
Why not the obvious alternatives
- Raising label priority or republishing the policy changes nothing here; label order and replication do not influence encryption mode. Removing encryption is the one change that would work but breaks the CISO's requirement.
2. The CISO refuses unencrypted matter files. Propose an alternative architecture that keeps matter-level access control, stays auditable, and does not break simultaneous editing. State the trade-offs.
Read the worked answer
Option A - container label, file label without encryption
- Put a container label on each matter site (external sharing restricted, privacy set) and rely on site permissions plus DLP for the boundary. The file label alone carries classification and drives DLP and retention.
- Pros: co-authoring just works; permissions are inherited and visible in SharePoint. Cons: nothing protects a file once it leaves the site by email or download, which is exactly the CISO's fear.
Option B - user-defined encryption with a scoped default
- File label encrypts with user-defined permissions defaulted to the matter group. Add a DLP rule that blocks sharing items with this label to external recipients, and justify-required additions of new users.
- Pros: protection travels with the file, co-authoring works. Cons: editors can widen the audience; you must monitor additions via Activity explorer and audit.
Option C - keep fixed permissions, change the workflow
- Enforce check-out or single-author drafting in the affected libraries.
- Pros: strongest deterministic scoping. Cons: a measurable productivity hit on 200+ lawyers; likely rejected.
Recommendation: A for internal collaboration sites and B for anything shared beyond the matter team. Container labels cannot apply encryption - any claim that a site label protects files at rest inside the site is wrong - so the two layers must be combined deliberately rather than substituted for each other.
3. Should Northwind turn on mandatory labeling and downgrade justification now? The service desk logged 300 label-related tickets last month. Give a decision plus the evidence you would collect first.
Read the worked answer
Decision: not now, and not for all labels.
Reasoning
- Mandatory labeling interrupts save/open flows until a label is chosen. With a default label already set, most documents are labeled implicitly, so the marginal benefit is small while the interruption cost falls on exactly the users generating the 300 tickets.
- Downgrade justification is cheap to adopt and produces the audit trail the CISO actually wants (who lowered a classification, and why), so split the two controls rather than treating them as one switch.
Evidence to collect first
- Ticket breakdown by app and platform (web vs desktop) and by label: if most tickets are web-based attempts to change a label, the root cause is training and label naming, not policy.
- Label distribution from Content explorer before the change, so you can prove movement afterwards instead of guessing.
- Sample of justification text from the DLP overrides to see whether users write anything useful.
Staged plan
- Enable require justification for downgrade and label removal on the Highly Confidential branch only, and publish a help link URL in the policy.
- Add recommended labels and run a 60-day awareness push with the matter-team pilot group.
- Extend mandatory labeling to one business unit at a time, gated on tickets trending down; measure label coverage in Content explorer between waves.