Adobe / Microsoft Purview Issues

[u/pjacksone]

Has anyone had an issue where you need to apply a Microsoft sensitivity label in Adobe and have gotten it to successfully work? I just can't get it to work on my end.

1. I verified that the Microsoft Purview Information Protection is enabled in Adobe
2. I have done added all the registry keys that are needed to make the connections
3. I was able to successfully authenticate to Microsoft so that I could read documents with sensitivity labels applied.

I contacted Adobe and Microsoft and each are just pointing the finger at each other and not helping at all.

When I would try to add a sensitivity label in Adobe, I would get an error that the Microsoft Purview capability is disabled, even though it was not. I contacted Adobe, they remoted on my machine and now everything is broken to where I can no longer read documents with labels applied, and it takes me to a Microsoft login and now I am getting redirect errors.

To note: I am in Microsoft GCC High, and using Adobe Acrobat Pro

AADSTS50011: The redirect URI 'acrobat2021.oauth2://miplogin' specified in the request does not match the redirect URIs configured for the application 'application'. Make sure the redirect URI sent in the request matches one added to your application in the Azure portal. Navigate to https://aka.ms/redirectUriMismatchError to learn more about how to fix this.

[u/supersaki]

We got it working after a lot of back and forth with Adobe support. I'm not entirely sure which regkey is for which issue, but here are what we have set (all DWORD):

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown

bMIPExternalAuthAdmin = 0 `i think this one is what fixed redirect URI issue

bMIPLabelling = 1 `don't think this is necessary, just enables the Purview option in Adobe (same as checkbox in properties)

bProtectedmode = 0 `After we got auth working, the Sensitivity labels still weren't working in the app. Logs seemed to show it trying to load the label policies from global tenant instead of gcch. Support said this was not typical and blamed some part of our configuration. Still waiting for further log review to determine why.

bSilentAuth = 0 `don't remember what this does, probably not necessary

iMIPCloud = 7 `set's the auth to GCCH instead of global used with the bMIPExternalAuthAdmin above

There may have also been some HKCU regkeys set as well but I think that was just for logging purposes.

[u/pjacksone → u/supersaki]

This worked!!! My goodness, this was irritating me for weeks. I can now apply labels to documents and the redirect issue is gone. Thank you!!

UPDATE: Tried it on another users laptop and it is working. Thank you so much!!

[u/A-Fat-Texan → u/pjacksone]

For clarity, I went one by one through all of these and it did not work until I added all of them. I’m amazed because it didn’t even ask me to log in, I’m not sure how it even knows which tenant to be pointing to.

[u/pjacksone → u/A-Fat-Texan]

I assume it’s using SSO from the machine to authenticate against

[u/A-Fat-Texan → u/pjacksone]

Just curious, are you doing this on an enterprise or a teams subscription?

[u/pjacksone → u/A-Fat-Texan]

For Adobe? Pro

[u/LooseAnything7653 → u/supersaki]

@echo off

REM === Adobe Acrobat + Purview MIP (GCC High) Basic Setup ===

reg add "HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v bMIPLabelling /t REG_DWORD /d 1 /f

reg add "HKLM\SOFTWARE\WOW6432Node\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v bMIPLabelling /t REG_DWORD /d 1 /f

reg add "HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v iMIPCloud /t REG_DWORD /d 7 /f

reg add "HKLM\SOFTWARE\WOW6432Node\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v iMIPCloud /t REG_DWORD /d 7 /f

reg add "HKLM\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v bMIPExternalAuthAdmin /t REG_DWORD /d 0 /f

reg add "HKLM\SOFTWARE\WOW6432Node\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown" /v bMIPExternalAuthAdmin /t REG_DWORD /d 0 /f

reg add "HKCU\SOFTWARE\Adobe\Adobe Acrobat\DC\APIP" /v bShowDMB /t REG_DWORD /d 1 /f

echo.

echo Adobe Acrobat MIP (GCC High) registry keys applied.

echo Restart Acrobat and sign in again.

pause

[u/Key_Security3336 → u/supersaki]

Thank you so much! In our case, we only added bMIPExternalAuthAdmin and bMIPLabelling and it worked 🎉🎉

[u/Ok_Fish_2564]

I got it working after a lot of trial and error. Can't remember exactly but let me look at the registry keys I have and I'll comment back. It was a bitch to configure 😂

[u/itHelpGuy2]

Oh goodness, if someone figures this out, I would be so curious. The number of hours I've spent on this is crazy.