Issue Summary:

For customers who have subscribed to DAC (Data Access Control) only and disabled the "Outlook Email Protection" feature, classification labels disappear from Outlook (as shown below) while remaining visible in other Office applications. This creates confusion as labels should be independent of protection functionality.

Additional Concern: When enabling the "Outlook Email Protection" feature from server configurations as a workaround, if the user does not have any policies assigned or policies are not yet published to them for any reason, they will see the "Seclore it" button instead of classification labels.



Symptoms:

  • Classification labels are not visible in Outlook after disabling "Outlook Email Protection"
  • Labels work normally in Word, Excel, PowerPoint, and other Office applications
  • Customer expects labels to function independently since they purchased DAC separately
  • Note: This issue occurs only in Outlook - all other Office applications display labels correctly
  • When protection feature is enabled as workaround, "Seclore it" button may appear if policies are not properly assigned/published as shown in the following image:

Root Cause:

There is an unexpected dependency between the "Outlook Email Protection" feature configuration and classification label visibility in Outlook, even though these should be independent functionalities for DAC-only subscriptions.

Customer Impact:

  • Functional Impact: Loss of classification capability in Outlook only
  • Business Impact: Customers cannot classify emails according to their data governance policies
  • Licensing Concern: Potential exposure to protection features not included in DAC-only subscription
  • Policy Management Risk: Users may see "Seclore it" button (protection feature) when policies are not properly assigned or published, exposing functionality they did not purchase



Workaround: Enable Feature and Disable Protection Plugin

To restore classification label functionality in Outlook for DAC-only customers while preventing exposure to protection features:

Step 1: Enable Outlook Email Protection Feature

  1. Enable "Outlook Email Protection" in the feature configurations on the Policy Server
  2. Reinitiate the policy server container (run the following script):
  3. Ensure policies are properly assigned and published to users to avoid "Seclore it" button appearance
/opt/seclore/policyserver1/policyserver/start.sh

        After these steps, classification labels will appear normally if user has a policy assigned and publihsed to his machine. Otherwise, if the publishing policy and labels are not published to the user for any reason, he will still see "Seclore it" in Outlook.



Step 2: Disable Protection Plugin via Registry

     Navigate to the registry path: 

Computer\HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\Addins\_Seclore.DC.EmailProtector.MSOutlook

  1. Locate the "LoadBehavior" value
  2. Change the "LoadBehavior" value from 3 to 2
  3. Restart Outlook after making registry changes

Result:

  • Classification labels will appear normally in Outlook
  • Protection functionality will be disabled (no "Seclore it" button)
  • DAC-only customers get label functionality without protection features they didn't purchase
  • If the publishing policy is not published to the user for any reason, they will not see "Seclore it" button.

Registry Modification Notes:

  • Value 3: Plugin loads automatically (protection enabled)
  • Value 2: Plugin available but not loaded automatically (protection disabled)
  • Ensure users have appropriate registry access permissions
  • This approach provides the optimal solution for DAC-only subscriptions