# PDF labeling is enabled in SharePoint
When PDF labeling is disabled (the default) in SharePoint, PDF files can't be labeled or display existing labels, which creates a protection gap.
Source: https://maester.dev/docs/tests/ZTA.35006
## Overview
When PDF labeling is disabled (the default) in SharePoint, PDF files can't be labeled or display existing labels, which creates a protection gap. Unlike Office files, PDFs can circulate externally without visible classification markers, making it impossible for recipients to determine the handling requirements or for data loss prevention (DLP) policies to detect sensitive content.
Enabling PDF labeling for SharePoint and OneDrive extends sensitivity label support to PDFs, allowing users to apply labels by using Office for the web and SharePoint, and supports other labeling methods such as auto-labeling policies to classify PDF content automatically.
## Remediation
- [Enable sensitivity labels for PDF files in SharePoint and OneDrive](https://learn.microsoft.com/purview/sensitivity-labels-sharepoint-onedrive-files?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#adding-support-for-pdf)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Data, AI |
| Category | SharePoint Online |
| Product | [Purview](/docs/tests/products/purview) |
| Feature | Information protection |
| Area | Data protection |
| Licence | RMS_S_PREMIUM, MIP_P1 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.