New Outlook vs Classic Outlook Block PDF Printing for Mandatory Labels: Current Workaround

You need to prevent recipients from printing a PDF attachment that contains mandatory classification labels. Both New Outlook and Classic Outlook offer Information Rights Management features, but they work differently and have distinct limitations. This article explains the core difference between the two clients regarding PDF printing restrictions, why the feature behaves inconsistently, and the only reliable workaround available today.

Why PDF Printing Restrictions Depend on the Outlook Client and Viewer

Microsoft 365 uses Azure Information Protection to apply sensitivity labels that enforce usage rights such as “Do Not Forward” or “Do Not Print.” When you attach a PDF to an email in Classic Outlook and apply a label that includes a printing restriction, the restriction is embedded in the file metadata. However, the PDF format itself does not natively support Information Rights Management. The restriction only works if the recipient opens the PDF in a viewer that understands AIP labels, such as the Microsoft 365 PDF viewer in Edge or the protected viewer in the Microsoft Information Protection app.

In Classic Outlook, the AIP client add-in can apply labels to email messages and attachments. When you send a labeled PDF, the add-in encrypts the file and attaches it as a protected .rpmsg container. The recipient’s email client must decrypt the file before the PDF can be opened. If the recipient uses a standard PDF reader like Adobe Acrobat Reader or a web browser that does not support AIP, the file cannot be opened and therefore cannot be printed.

New Outlook does not include the AIP add-in. It relies on built-in sensitivity labels that are applied at the message level, not at the attachment level. When you attach a PDF in New Outlook and set a sensitivity label on the message, the label applies to the email body and its attachments only if the recipient’s email client supports the same label. If the recipient uses a client that does not enforce the label, the PDF can be saved and printed freely.

Steps to Block PDF Printing in Classic Outlook Using AIP Labels

Classic Outlook with the Azure Information Protection add-in installed can block PDF printing when you apply a label that includes the “Do Not Print” usage right. Follow these steps:

1. Verify that the AIP add-in is installed and enabled
   Open Classic Outlook, go to File > Options > Add-ins. Under Active Application Add-ins, confirm that Microsoft Azure Information Protection appears. If it does not, install the add-in from the Microsoft 365 admin center.
2. Create a new email and attach the PDF
   Click New Email, then attach the PDF using the Attach File button. Do not drag and drop the file, as drag-and-drop may bypass the label application.
3. Apply a sensitivity label with printing restrictions
   On the Home tab, click Sensitivity and choose a label that has the “Do Not Print” or “Do Not Forward” usage right configured. The label must be assigned to the message and its attachments.
4. Send the email
   After applying the label, the PDF is encrypted and attached as a protected file. The recipient will see a prompt to open the file in a supported viewer. If the viewer enforces the label, the Print option will be grayed out.

Limitations of the Classic Outlook Method

The recipient must use a viewer that supports Azure Information Protection. The Microsoft 365 PDF viewer in Microsoft Edge or the Microsoft Information Protection viewer on Windows will enforce the restriction. Standard PDF readers will either refuse to open the file or will open it without any printing restriction.

Steps to Block PDF Printing in New Outlook

New Outlook does not have an AIP add-in. The built-in sensitivity labels in New Outlook apply to the email message only. To block PDF printing, you must attach a file that is already protected before sending.

1. Open the PDF in a protected viewer and apply a label
   Right-click the PDF file in File Explorer, select Classify and Protect, and choose a label that includes a printing restriction. This step requires the AIP client to be installed on your computer.
2. Attach the protected PDF to a new email in New Outlook
   In New Outlook, click New Mail, then attach the protected PDF. The file will have the .rpmsg extension or a .pfile extension depending on the label configuration.
3. Send the email
   The recipient must open the protected file in a supported viewer to see the PDF content. The printing restriction is enforced by the viewer, not by New Outlook.

Why New Outlook Cannot Enforce Printing Restrictions Natively

New Outlook uses a different architecture than Classic Outlook. It does not load COM add-ins like the AIP client. Sensitivity labels in New Outlook are applied at the transport level and are enforced by the recipient’s email server, not by the client. Attachments are not encrypted individually. As a result, the PDF can be saved and printed if the recipient’s email client does not enforce the label.

Current Workaround That Works in Both Clients

The only reliable method to block PDF printing in both New Outlook and Classic Outlook is to convert the PDF to a protected Office format before attaching it. Office documents (DOCX, XLSX, PPTX) support Information Rights Management natively. When you apply a sensitivity label to an Office file, the printing restriction is enforced by any Office application, regardless of the Outlook client used.

1. Convert the PDF to DOCX
   Open the PDF in Microsoft Word. Word will convert the PDF to an editable DOCX file. Go to File > Save As and save the file as a Word Document (.docx).
2. Apply a sensitivity label with printing restrictions
   In Word, click Sensitivity on the Home tab and choose a label that has the “Do Not Print” usage right. Save the file. The label is now embedded in the DOCX file.
3. Attach the protected DOCX to your email
   In New Outlook or Classic Outlook, attach the DOCX file. The recipient will open it in Word, and Word will enforce the printing restriction. The Print option will be grayed out.
4. Test the restriction
   Open the attached DOCX in Word on a different computer. Go to File > Print. If the label is enforced, the Print button will be disabled and a message will appear stating that printing is not allowed.

If the Workaround Fails or the Recipient Cannot Open the File

Recipient sees an error that the file cannot be opened

This usually happens when the recipient does not have the Azure Information Protection viewer installed. Ask the recipient to install the Microsoft Information Protection viewer from the Microsoft Store. Alternatively, the recipient can open the file in a web browser that supports AIP, such as Microsoft Edge with the Microsoft 365 PDF viewer.

Recipient can print the PDF despite the label

This occurs when the label does not include the “Do Not Print” usage right, or when the recipient opens the PDF in a viewer that ignores AIP labels. Verify the label configuration in the Microsoft Purview compliance portal. Ensure that the label has the “Print” option set to “Block” under the encryption settings. If the recipient uses a non-Microsoft PDF reader, the restriction will not be enforced. In that case, the DOCX workaround is the only option.

New Outlook does not show the sensitivity label on the attachment

New Outlook applies sensitivity labels only to the message. The attachment itself is not labeled. To verify that the attachment is protected, right-click the attached file and select Properties. If the file is protected, the Properties dialog will show the label name. If not, the file is not protected and can be printed. Use the workaround of attaching a pre-labeled DOCX file instead.

Item	New Outlook	Classic Outlook (with AIP add-in)
Attachment-level label support	No	Yes, via AIP add-in
PDF printing restriction enforcement	Only if file is pre-labeled and opened in AIP viewer	Yes, if recipient uses AIP viewer
Native Office file printing restriction	Yes, if file is labeled before attaching	Yes, if file is labeled before attaching
Requires recipient-side software	Microsoft Information Protection viewer or Office	Microsoft Information Protection viewer or Office
Workaround for PDF	Convert PDF to DOCX and label	Convert PDF to DOCX and label

You can now block PDF printing in both New Outlook and Classic Outlook by converting the PDF to a protected DOCX file and applying a sensitivity label with printing restrictions. This workaround works because Office files enforce the label natively, regardless of the Outlook client. For a permanent solution, consider using the Microsoft Purview Data Loss Prevention policy to block printing of classified attachments at the server level. This policy works independently of the email client and does not require the recipient to have any special viewer installed.