FAQ: Migrating Microsoft Purview Protected Content to Nextcloud
Section titled “FAQ: Migrating Microsoft Purview Protected Content to Nextcloud”How to prepare, migrate and document SharePoint files protected by Microsoft Purview Sensitivity Labels when moving to Nextcloud with SMART Migration.
CLASSIFICATION AND PROTECTION ARE DIFFERENT
Preserving a label name does not preserve its security enforcement. Microsoft encryption, classification metadata and Nextcloud access controls must be addressed separately in the migration plan.
Identify Protected Files
Inventory labels and determine which files are encrypted. A classification name alone does not establish whether encryption is applied.
Prepare Usable Content
Use authorised Microsoft tooling to remove protection where required for native use in Nextcloud.
Configure Target Controls
Agree classification mapping and configure the required access and protection controls in Nextcloud.
Understanding the Challenge
Section titled “Understanding the Challenge”What is Microsoft Purview?
Section titled “What is Microsoft Purview?”Microsoft Purview provides data governance, security and compliance capabilities. Microsoft Purview Information Protection includes sensitivity labels for classifying and protecting documents and other content.
What are Sensitivity Labels?
Section titled “What are Sensitivity Labels?”Sensitivity labels classify content and can apply additional protection according to their configuration.
Apply visual markings such as headers, footers or watermarks.
Apply encryption using Azure Rights Management.
Restrict actions such as opening, editing, printing or copying.
Retain file-level protection when content is downloaded or shared outside SharePoint.
Examples include Public, Internal, Confidential, Restricted and Highly Restricted. These names are organisation-specific; their protection settings must be checked.
Can encrypted files be migrated directly?
Section titled “Can encrypted files be migrated directly?”An encrypted file can be copied as a file, but copying it does not remove Microsoft protection. It may still require an authorised identity and a compatible Microsoft application to open it.
If the objective is to use the content natively in Nextcloud without relying on Microsoft Rights Management, protection must be removed through an approved process.
Access to SharePoint and permission to decrypt a file are separate requirements. Download access does not automatically provide the rights needed to remove protection.
Preparing for Migration
Section titled “Preparing for Migration”What must be done before migrating encrypted content?
Section titled “What must be done before migrating encrypted content?”Agree whether encrypted copies will be retained or whether protection will be removed to support native use in Nextcloud. Record classification information before any operation that may remove the label.
- Authorised bulk processing: Use a suitable identity and Microsoft tooling. Azure Rights Management Super User access may be appropriate for centrally managed processing.
- Owner-led processing: Users with sufficient rights remove protection from the selected files.
- Approved relabelling: Apply an agreed label or protection change using supported tooling. Changing a label’s configuration alone does not automatically decrypt existing files.
How do we configure Super User access?
Section titled “How do we configure Super User access?”For applicable Azure Rights Management protection, the customer’s authorised administrator can configure Super User access. The account or service principal must match the chosen authentication and processing method.
The following example uses the AIPService PowerShell module. Validate the approach against the customer’s tenant and protection configuration before use.
PowerShell: Configure Super User Access
1. Connect using an authorised administrative identity
Section titled “1. Connect using an authorised administrative identity”Connect-AipService
2. Enable the Super User feature
Section titled “2. Enable the Super User feature”Enable-AipServiceSuperUserFeature
3. Add the approved migration service account
Section titled “3. Add the approved migration service account”Add-AipServiceSuperUser -EmailAddress “migration-service@contoso.com”
Alternative to step 3: Add an approved service principal
Section titled “Alternative to step 3: Add an approved service principal”Add-AipServiceSuperUser -ServicePrincipalId “<service-principal-id>”
4. Review the configuration
Section titled “4. Review the configuration”Get-AipServiceSuperUser
CONTROL PRIVILEGED ACCESS
Limit elevated access to the approved project period, record its use and revoke it when the work is complete. Confirm whether the files use standard Azure Rights Management protection or another protection configuration requiring a different approach.
How are files decrypted?
Section titled “How are files decrypted?”Use supported Microsoft tooling, such as the Microsoft Purview Information Protection client or a solution built with the MIP SDK. The identity must have the required rights.
A typical staged approach is to download the selected files, remove protection in a controlled staging environment, verify readability and migrate the approved content.
The example below illustrates the Remove-FileLabel command. Required client installation, authentication, policy settings and permissions must be configured first.
PowerShell: Remove Protection from an Approved Staging File
Remove-FileLabel -Path “C:\Migration\Staging\ApprovedDocument.docx” -RemoveProtection
Microsoft documentation: Remove-FileLabel.
Migration Process
Section titled “Migration Process”What workflow should the project follow?
Section titled “What workflow should the project follow?”- Inventory: Identify labelled files and record available classification and protection information.
- Classify: Separate encrypted content from labelled content that does not use encryption.
- Prepare: Agree the target controls, authorise protection changes and configure the processing tools.
- Decrypt: Where required, prepare readable copies in a secure staging environment.
- Migrate: Use SMART Migration to transfer the selected content and agreed metadata.
- Apply target controls: Configure Nextcloud access and protection before releasing the content to users.
- Verify: Check migration results, classification mapping, readability and access restrictions.
- Clean up: Remove staging copies according to the approved process and revoke temporary privileged access.
What happens to Sensitivity Label metadata?
Section titled “What happens to Sensitivity Label metadata?”Classification information can be retained for reference where it is available from the source and supported by the agreed mapping configuration.
- Label names: Agree mapping to Nextcloud tags or MetaVox properties and validate it with representative files.
- Visual markings: Embedded document markings may remain in the file content. Verify their handling during protection removal.
- Encryption: Microsoft protection is not converted automatically into Nextcloud encryption.
- Access policies: Configure the required permissions and restrictions separately in Nextcloud.
A TAG IS NOT A SECURITY POLICY
A Nextcloud tag or MetaVox property can preserve classification information. It does not, by itself, reproduce Microsoft Purview encryption or usage restrictions.
Can SMART Migration use label information in the migration?
Section titled “Can SMART Migration use label information in the migration?”Available classification data can form part of metadata mapping and content selection. Agree with MigrateDMS which source properties can be read and which target mappings are supported in the selected configuration.
Test label-to-tag mapping, MetaVox properties and classification-based routing before production migration. Access rights and protection enforcement remain separate configuration tasks.
Architecture Considerations
Section titled “Architecture Considerations”Should sensitive content use a separate Nextcloud instance?
Section titled “Should sensitive content use a separate Nextcloud instance?”A separate instance may be appropriate when the customer requires stronger separation between classification levels.
Separate infrastructure and network access.
Dedicated administration and access policies.
Different backup, retention and recovery arrangements.
A clearer boundary for testing and documenting controls.
Separation is effective only when shared identities, administrators, backups and infrastructure are also considered. Agree the target connections and migration configuration for each instance.
Which Nextcloud controls should be considered?
Section titled “Which Nextcloud controls should be considered?”Depending on the installed apps, clients and deployment, the target design may include sharing permissions, group restrictions, file access control rules and encryption options.
Server-side encryption and end-to-end encryption address different requirements and can have operational limitations. Neither should be presented as a direct replacement for every Microsoft RMS capability.
The customer’s Nextcloud administrator or security specialist should validate the required controls, application compatibility and user experience before production use.
Compliance and Governance
Section titled “Compliance and Governance”What should be documented?
Section titled “What should be documented?”- Source files and their available classification and protection information.
- Approval for protection removal and handling of readable copies.
- When and how protection was removed, including processing failures.
- Who received privileged access and for how long.
- Mapping between source classifications and target controls.
- Migration results and verification of destination access.
- Staging cleanup and removal of temporary access.
SMART Migration reporting supports the migration audit trail. Record protection-removal activities separately using the selected tooling and available audit facilities.
Who decides whether protection can be removed?
Section titled “Who decides whether protection can be removed?”CUSTOMER GOVERNANCE DECISION
The customer must approve changes to protection based on applicable obligations, contracts and internal policies. The migration team implements the approved handling process and target configuration.
Practical Considerations
Section titled “Practical Considerations”How many files have encryption-enforcing labels?
Section titled “How many files have encryption-enforcing labels?”There is no reliable universal percentage. Measure the customer’s actual content and label configuration. Do not infer encryption from names such as Confidential or Restricted.
What if some files cannot be decrypted?
Section titled “What if some files cannot be decrypted?”- Investigate the protection owner, tenant, identity and required usage rights.
- Ask an authorised owner or administrator to review the file.
- Record the exception and agree how the customer wants it handled.
- Retain protected copies in an approved restricted location where required.
A retained encrypted copy must not be reported as successfully converted to content usable natively in Nextcloud.
Can users continue working during migration?
Section titled “Can users continue working during migration?”A phased project can allow continued source use, but changes to files and protection must be included in the migration plan.
- Reassess newly created, modified or newly protected files.
- Agree final incremental processing and a cutover window where needed.
- Explain how access and classification handling will work after migration.
SMART Migration and Customer Responsibilities
Section titled “SMART Migration and Customer Responsibilities”SMART Migration
Supports content transfer, configured metadata mapping, migration processing and reporting. Confirm the required classification mappings for the selected project configuration.
Customer and Microsoft Tooling
Provide approval, authorised identities and the supported tooling required to remove protection. Maintain processing and access records.
Nextcloud Administration
Configure destination permissions, sharing restrictions and protection controls. Validate that the environment meets the agreed requirements.
What information is needed from the customer?
Section titled “What information is needed from the customer?”- Sensitivity labels in use and their protection settings.
- The approved migration scope and protection-removal approach.
- Classification mapping requirements for tags, metadata and target locations.
- Access to the approved content and any controlled staging environment.
- Nextcloud target configuration, folder structure and permission model.
- Acceptance criteria, exception handling and cleanup requirements.
Summary
Section titled “Summary”PLAN PROTECTION AS PART OF THE MIGRATION
Identify encrypted content, agree how it will be made usable, preserve the required classification information and configure the destination controls.
SMART Migration supports the migration workflow and documentation. Authorised Microsoft tooling handles protection removal, while Nextcloud controls are configured separately.
See also