Using the Loop App to Protect Pages with Sensitivity Labels

Message center notification MC923176 (1 November 2024, Microsoft 365 roadmap item 111225) announces that workspace owners can apply container management sensitivity labels to workspaces in the Loop app “to prevent oversharing and manage access effectively.” The Loop app entered preview in March 2023 and achieved general availability in November 2023. Microsoft initially anticipated rolling out sensitivity label support in the first half of 2024 as part of a plan to enable external sharing. As described in MC923419, that plan should come to fruition soon with support for guest account access to Loop workspaces.

Microsoft is deploying the MC923176 and MC923419 updates now and expects the deployment to be complete worldwide by early December for both the Loop browser and mobile apps. The updates haven’t yet reached my tenant so I can’t comment on how they work. To set the scene, I investigated how the Loop app supports the use of sensitivity labels to protect pages in Loop workspaces.

Loop Workspaces and Pages

A loop workspace is a container managed by SharePoint embedded. The storage occupied by a workspace is charged against the tenant’s SharePoint storage quota. Workspaces are composed of pages and components. The big thing about Loop is the speed in which it synchronizes changes made to components so that the same data appears anywhere the component is referenced, such as in Teams or Outlook messages.

Applying a sensitivity label to a Loop page is easy. A small shield icon appears at the top of each page. Click the shield to reveal the set of sensitivity labels configured for files that are published to the signed-in account (Figure 1). If a sensitivity label is already applied to the page, you’ll see a tick mark alongside the label in the list.

Oddly, all of my Loop pages had the Public label. This was strange because the label publishing policies used in my tenant don’t specify a default label for documents. However, the policies do specify a default label for email, and I assume that Loop misread the policy and selected the default email label.

The other thing I noticed is that Loop doesn’t support the color coding for sensitivity labels in the same way as the Office apps do. It’s probably because Loop doesn’t support the sensitivity bar used by the Office apps to allow users to update the name, assign a sensitivity label, and view the version history for a file. If you’ve spent time to give sensitivity labels a splash of color, such as using the traffic light system to indicate the relatative sensitivity of a file, the carefully selected colors don’t appear.

Check Label Rights

Sensitivity labels use rights management to control access to documents. If a workspace was previously shared with someone, they won’t be able to access pages in that workspace if the assigned sensitivity labels don’t grant the right to allow them to open and work with the content (Figure 2).

Some Odd Implementation Details

The Loop developers seem to have left some gaps in their implementation of sensitivity labels. For instance, a user with the sharing right to open the workspace who is blocked from accessing pages and components can still add new pages, duplicate pages, add a page to another workspace (where they can’t open the page because of the label), or even create a new subpage and edit that component because the subpage doesn’t appear to inherit the label assigned to the workspace (Figure 3).

In addition, sometimes a blocked user was able to view the content of a blocked page even while the Loop app informed them that it couldn’t open the page (Figure 4). This situation persisted until the user exited and restarted Loop.

Overall, it seems like the Loop app should do a better job of restricting access to page options when a sensitivity label blocks access to a page.

Finally, if a user who shares a workspace can access a page, they can change the sensitivity label assigned to the page (Figure 5). I don’t think this is a good idea. Only the workspace owner should be allowed to change the assigned label for a page.

It’s good that the Loop app is moving ahead to embrace sensitivity labels. The issues described above are the kind often found in first-round implementations. Hopefully, they’ll be resolved soon.

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.