How Non-Microsoft 365 Recipients Decrypt Documents that are Encrypted by Microsoft Purview Sensitivity Labels

Question

Dear Experts,

My organization is using Microsoft Purview Sensitivity Labels to encrypt documents and emails. I assigned a sensitivity label on a Microsoft Word document and assign permission Editor to external user ******@test.com (a non-Microsoft 365 user). This document is converted to PDF (so, the encryption inherits), then send these 2 documents (Word, PDF) to ******@test.com via email. This email is also assigning a sensitivity label same as document. Note: Right Management Service is excluded from Conditional Access

1- How can this user authenticate in order to read email content?

2- How can this user authenticate in order to open the Word document using Non-Microsoft Office Application? and what if they are using Microsoft Office Application?

3- How can this user authenticate in order to open PDF file using Adobe Reader or non-Adobe Reader?

Thank you,

Answer 1

 Hi @Luot Kimheng,

Thank you for sharing the additional information—it really helps us dive deeper into the further investigation.

1.       Sensitivity Labels and External Sharing — Should "Access Control" Be Disabled?

The short answer is not necessarily disabled but configured appropriately.

The suggestion — “Make sure the sensitivity labels applied to the document don’t include restrictions that prevent external users from accessing it” — means that you must configure the Access Control settings to allow authenticated external users, rather than disabling it entirely.

 

·         Enable Access Control (i.e., encryption) but assign permissions to "any authenticated users".

·         This allows external users (e.g., partners or clients) to access the content if they can authenticate with a Microsoft account or federated identity.

·         You can also set permissions like Co-Owner or Viewer depending on the level of access you want to grant.

So, you do not need to disable Access Control, but you must ensure that the label’s encryption settings include external users who can authenticate.

2.       Sensitivity Labels vs. Message Encryption — Which to Use for Outbound Protection?

Both options serve different purposes and can be used together or separately depending on your security goals:

 

v  Purview Sensitivity Labels:

o   Best for persistent protection across platforms and storage locations.

o   Applies encryption, content markings (watermarks, headers, footers), and access restrictions.

o   Ensures that content remains protected at rest and in transit, even if downloaded or renamed.

o   Ideal for automated classification and protection of documents and emails.

v  Purview Message Encryption

o   Specifically designed for email scenarios.

o   Allows you to encrypt emails so that only intended recipients can read them.

o   Useful when you want to send secure messages to external users without requiring them to have Microsoft 365 accounts.

v  Recommendations for Your Scenario:

o   Review your label configuration to ensure that Access Control includes external authenticated users.

o   Use Sensitivity Labels with encryption for persistent protection.

o   Add Message Encryption for email-specific scenarios, especially when sending to external recipients.

o   Test the label behaviour with external users to confirm access works as expected.

Note: - We kindly request you to refer to the official documentation shared in the previous comment.

Answer 2

Hi VRISHABHANATH,

Thank you for your detail answer.

Regarding your note "Make sure the sensitivity labels applied to the document don’t include restrictions that prevent external users from accessing it." - could you please confirm if this means the sensitivity label intended for external sharing should not have the "Access Control" option enabled? (Kindly refer to the attached image for our current label configuration.)

Additionally, from data security perspective we aim to protect emails/documents that leave the organization. Could you advise if we should use Purview Sensitivity Label or Purview Message Encryption?

Thank you,