Downgrading of encrypted label (User defined permission) in SPO to Desktop app

Question

Downgrading of encrypted label (User defined permission) in SPO to Desktop app

Mansha Irfan 185

Hi

I have a file stored in SharePoint that was originally labeled as Restricted (with encryption-End user defined). When I open the file from SharePoint into a desktop Office app and downgrade the label to Internal, the encryption and permissions from the original Restricted label still remain. This behavior occurs only when the file is opened from SharePoint to the desktop app, so the previous protection permission still persists even though the label is downgraded, it reflects on as "Internal" Label

User's image

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Anonymous

Hi Mansha Irfan ,
Welcome to the Microsoft Q&A and thank you for posting your questions here.
Open the file in the desktop app, go to Sensitivity, and select a label that does not apply encryption or use Remove Protection before applying the new label. Save and reopen the file to confirm rights are updated.

When you downgrade a sensitivity label in Office desktop apps (e.g., from Restricted with encryption to Internal) after opening the file from SharePoint, the label text changes but the original encryption and permissions remain.
This is expected because:

Encryption is applied through an IRM license embedded in the file, independent of the label name.
Changing the label does not automatically remove existing protection unless the new label is configured without encryption.
Downgrading the label only changes classification text; encryption persists until explicitly removed or replaced by a non-encrypted label.

Ask to admin

Provide a non-encrypted label option for downgrades.
Ensure SharePoint/OneDrive sensitivity label integration is enabled.
Review label policies to allow removing protection when changing labels.

If the problem persists, feel free to mention it in the comment section.

Mansha Irfan 185 Reputation points

2025-11-25T03:15:02.1933333+00:00

Thank you for your reply. I'm trying to reapply label without encryption that is "INTERNAL" and saving it locally too. Also, I have full owner rights on doc but still throwing same error.
Anonymous

2025-11-26T01:06:35.9633333+00:00
This behavior is expected when a file was originally labeled with encryption (for example, “Restricted” with user‑defined permissions) and later downgraded to a non‑encrypted label in Word desktop.

When the encrypted label was applied, Word embedded an IRM/RMS license in the file. Changing the label to “Internal” updates the label metadata but does not remove the existing encryption. That’s why the Sensitivity bar shows “Internal” while the banner still says “Restricted access” and you see the message about restricted permissions.

To fix this:

If you have rights to remove protection: Open the file in Word → File > Info > Protect Document > Restrict Access → select Unrestricted Access / Remove Restrictions, then save and re‑apply the “Internal” label.

If removal isn’t available: Ask your Purview/AIP admin to decrypt the file using super‑user or AIP tools (for example, Unprotect-RMSFile), then apply the “Internal” label to the clean copy and upload it back to SharePoint.

Currently, Office does not automatically strip encryption when downgrading a label; it must be removed explicitly.

References:

Manage sensitivity labels in Office apps

Apply encryption using sensitivity labels
Mansha Irfan 185 Reputation points

2025-11-26T04:21:18.1633333+00:00

https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-onedrive-files#support-for-labels-configured-for-user-defined-permissions in this article it's written that co-authoring should be enabled to change user defined labels.

If users need to change labels configured for user-defined permissions, make sure you've enabled co-authoring for files encrypted with sensitivity labels.
Anonymous

2025-11-26T16:42:54.02+00:00

I hope your issue has been resolved. Please let us know if you have any other questions.

Answer 2

When you downgrade a label in a desktop Office app, the encryption and permissions from the original label may persist because the desktop app might not fully support removing the encryption settings applied by the original label.

To resolve this, try the following steps:

Remove the label entirely in the desktop app, save the file, and then apply the new label.
Alternatively, use the SharePoint Online interface to change the label, as it might handle the encryption settings more effectively.

If the issue persists, consider checking for updates for your Office apps or consulting Microsoft support for further assistance.