User Guide: Revoke document access with Azure Information Protection


Are you looking for Microsoft Purview Information Protection, formerly Microsoft Information Protection (MIP)?

The Azure Information Protection add-in is retired and replaced with labels that are built in to your Microsoft 365 apps and services. Learn more about the support status of other Azure Information Protection components.

The new Microsoft Information Protection client (without the add-in) is currently in preview and scheduled for general availability.

This article describes how to revoke access for Office documents that you've protected from Microsoft Office. Protected documents are supported for track and revoke, even if they are not labeled.

Revoking access for a protected document prevents other users from accessing the document, even if you've given them access before. For more information, see User Guide: Classify and protect with the Azure Information Protection unified labeling client.


Track and revoke features are supported for Office file types only.

Revoke access from Microsoft Office apps

To revoke access from Word, Excel, or PowerPoint:

  1. Open the protected file whose access you want to revoke. This must be a file where you have applied the protection, using your current user account.


    If you've only just applied a label and protection, you cannot revoke access in the same session. Reopen the document if you need to revoke access.

  2. On the Home tab, click the Sensitivity button and select Revoke Access.

    Screenshot of the Revoke Access option from Microsoft Word.

    If you don't see this option, see a list of possible scenarios.

  3. In the confirmation message that appears, click Yes to continue.

Access is revoked, and other users can no longer access the document. If offline access is allowed, users will continue to be able to access the documents that have been revoked until the offline policy period expires.

Don't see the Revoke Access option?

If you do not see the option to Revoke Access in the Sensitivity menu, you may have one of the following scenarios:

  • You might have just applied the protection in this session. If this is the case, close and re-open the document to try again.

  • You might be viewing an unprotected document. Revoking access is relevant only for protected documents.

  • You may not have the latest AIP unified labeling client version installed, or you may need to restart your Office apps or machine after installation.

    For more information, see User Guide: Download and install the Azure Information Protection client.

  • Your administrator may have turned off tracking features in your organization.

Revoking access where the document protection has been changed on a copy

If another user had changed the label or the protection on a copy of the document, access is not revoked on that copy of the document.

This is because tracking and revoking access is done using a unique ContentID value, which changes each time protection is changed.


If you think that a user may have changed the label or protection level on a document and you need to revoke access, contact a system administrator to help you revoke access on that copy of the document.

Next steps

For more information, see: