Classic Outlook to New Outlook: Block Printing Based on Label Rights – Test protected mail behavior

When your organization uses Microsoft Purview Information Protection to label emails, you can restrict actions like printing based on a user’s label rights. In the classic version of Outlook, these restrictions worked reliably for protected messages. However, after migrating to the new Outlook for Windows, some users find that printing is no longer blocked even when their label rights explicitly forbid it. This article explains how label rights for printing work in both classic and new Outlook, what causes the behavior difference, and how to test protected mail behavior after switching to new Outlook.

How Label Rights Control Printing in Protected Emails

Microsoft Purview Information Protection allows administrators to create sensitivity labels that include rights management settings. These labels can be applied to emails to protect sensitive data. One of the configurable rights is the ability to print the message. When a label is set to deny printing, the email is encrypted with Azure Rights Management (Azure RMS), and the print right is explicitly revoked in the use license issued to the recipient.

In classic Outlook, the Windows desktop client receives the use license from Azure RMS and enforces it locally. The Print button in the ribbon and the Ctrl+P keyboard shortcut are disabled for any message where the label denies printing. The user sees a grayed-out Print button and cannot print the message through any standard method.

New Outlook for Windows is a web-based client that uses a different rendering engine for protected emails. Instead of the native Windows Rights Management client, new Outlook relies on the Microsoft 365 web platform to decrypt and display protected content. This architectural difference means that print restrictions from labels are not always enforced in the same way. In current versions of new Outlook, the Print button may remain active even for messages with a label that denies printing, allowing the user to print the email despite the policy.

Testing Protected Mail Behavior in Classic Outlook vs New Outlook

To verify how label print restrictions behave after switching to new Outlook, follow these steps to test a protected email in both clients.

Step 1: Create or Obtain a Labeled Protected Email

1. Open Outlook and create a new email
   In classic Outlook, compose a new message. On the Options tab, click Encrypt and select a sensitivity label that has printing disabled. For testing, use a label named “Confidential – No Print” or similar. Send the email to yourself or to a test account.
2. Verify the label restricts printing
   In the Microsoft Purview compliance portal, navigate to Information Protection > Label policies. Select the label you applied and click Edit label. Under Define protection settings, ensure that the Print right is unchecked. Save the label policy and wait for replication.

Step 2: Test Printing in Classic Outlook

1. Open the protected email in classic Outlook
   Double-click the email to open it in a separate window. Look at the ribbon. The Print button should be grayed out and unclickable.
2. Attempt to print using Ctrl+P
   Press Ctrl+P on your keyboard. Classic Outlook should show a message stating that printing is not allowed due to information rights management restrictions. No print dialog appears.

Step 3: Test Printing in New Outlook

1. Open the same email in new Outlook
   Close classic Outlook and open the new Outlook for Windows. Find the same protected email in your inbox and open it.
2. Check the Print button and shortcut
   Look for the Print icon in the toolbar at the top of the message window. If the button is active (not grayed out), click it. Also press Ctrl+P. If a print dialog appears, new Outlook is not enforcing the label’s print restriction.

Step 4: Compare the Behavior

1. Document the results
   Note whether printing was blocked or allowed in each client. If new Outlook allowed printing, this is a known limitation that Microsoft is working to address.
2. Check for updates
   Visit the Microsoft 365 Roadmap or the new Outlook release notes to see if a fix for print enforcement has been deployed. You may need to update new Outlook to the latest version.

If New Outlook Does Not Block Printing

If your test shows that new Outlook allows printing on a message where the label denies it, you have encountered a known behavior gap. Here are the common scenarios and what you can do.

New Outlook Prints Protected Email Despite Label Setting

This occurs because new Outlook uses a web-based rendering engine that does not fully integrate with the Windows Rights Management client. The label’s print restriction is stored in the Azure RMS use license, but new Outlook does not read that restriction when rendering the message. As of the latest stable release, Microsoft has not fully ported all IRM enforcement features to new Outlook. The only workaround is to continue using classic Outlook for viewing and working with protected emails that require print restrictions.

Classic Outlook Blocks Printing but New Outlook Does Not

This confirms that the label is correctly configured. The difference is purely client-side. Users who rely on print restrictions should be informed that new Outlook does not yet enforce this setting. Administrators can use Group Policy or Microsoft 365 admin center to block the use of new Outlook for specific users or security groups until the feature is fully supported.

Print Restriction Works in New Outlook for Some Users but Not Others

This can happen if some users are on a newer build of new Outlook that includes partial enforcement. Check the version by clicking Settings > General > About Outlook. Compare the version number against the latest release notes from Microsoft. If one user has a newer build, the print restriction may be enforced while others still see the gap. Ensure all users are on the same version to maintain consistent behavior.

Classic Outlook vs New Outlook: Print Restriction Enforcement

Item	Classic Outlook (Win32)	New Outlook for Windows
Rendering engine	Native Windows Rights Management client	Web-based Microsoft 365 platform
Print button disabled	Yes, fully grayed out	No, remains active in current builds
Ctrl+P blocked	Yes, shows IRM restriction message	No, opens print dialog
Use license enforcement	Reads Azure RMS use license locally	Does not fully parse print restrictions
Workaround available	Not needed	Switch to classic Outlook for protected mail

Conclusion

You can now test whether print restrictions from sensitivity labels are enforced in classic Outlook and new Outlook for Windows. The test method described here uses a self-addressed protected email with a label that denies printing. Classic Outlook fully blocks printing by disabling the button and shortcut. New Outlook may allow printing due to its web-based rendering engine, which does not enforce all IRM rights. Until Microsoft updates new Outlook to fully support print restrictions, administrators should instruct users to open protected emails in classic Outlook when print blocking is required. As a next step, review your organization’s label policies and consider restricting access to new Outlook for users who handle sensitive protected content.