Applying Internal sensiticiy label on a document will still allow anyone to open it

Question

I have defined this sensitivity label to only allow internal users to open the file:-

but currently when i download the document from sharepoint , and i open it on another desktop, the file open even i did not sign in using internal user email or any email? the document will have the correct header, footer and watermark, but not the security

Answer 1

If the file opens after download without any sign-in prompt, the file is likely not actually protected with encryption.

A sensitivity label can do more than one thing. It can:

• apply encryption with Information Rights Management
• add a header, footer, or watermark
• apply dynamic watermarks

If only content markings were applied, the file can still be opened by anyone.

Also, SharePoint library labeling has an important behavior: users can see the selected label displayed, but they won’t experience any changes in permissions as a result of the label unless the label configuration applies encryption. For files in a SharePoint document library configured to extend permissions to downloaded documents, the selected label is applied to unlabeled files and files whose label does not apply encryption, but permissions do not change just because the label name is shown.

Checks to make:

1. Verify the label really uses encryption
   • In Microsoft Purview, open the label and confirm the protection is configured to apply encryption, not just watermark/header/footer.
   • A label that only adds markings will not restrict opening.
2. Confirm the file has protected permissions
   • In Word, Excel, or PowerPoint for Windows, open the file and check the permissions icon in the status bar.
   • If the file has custom permissions, a business bar appears below the ribbon with View Permissions.
   • This shows whether rights management permissions are actually on the file.
3. Test with a supported desktop app
   • Microsoft 365 for the web does not support viewing sensitivity label permissions.
   • For encrypted files, desktop Office is the better validation path.
4. If the file was labeled through SharePoint library configuration, allow for resynchronization
   • When a SharePoint document library is configured for a sensitivity label that extends permissions to downloaded documents, existing synced files are resynchronized.
   • Until that resynchronization completes, the extended protection is not applied.
5. Reapply protection if the file was previously unlabeled or downgraded
   • Encryption can persist independently of label text, and label text alone does not prove protection is active.
   • Open the file in the desktop app, apply a label that is configured with encryption, save, close, and reopen to confirm the rights are updated.

If the goal is “internal users only,” the key requirement is that the label must apply encryption-based permissions to the file. A visible label name or watermark alone does not block access.

---

• Configure SharePoint with a sensitivity label to extend permissions to downloaded documents
• Apply sensitivity labels to your files
• Apply sensitivity labels to your files
• Apply sensitivity labels to your files
• Downgrading of encrypted label (User defined permission) in SPO to Desktop app - Microsoft Q&A