Sensitivity Labeling - Problem with Sensitivity for User Defined Permissions

Question

Sensitivity Labeling - Problem with Sensitivity for User Defined Permissions

Mitch Silberstein 150

I have a label called "High - External File" that prompts for users to specify the permissions/encryption. The setting is called Let users assign permissions: In Word, PowerPoint and Excel, prompt users to specify permissions. I understand that the permissions do not work with the web apps and you must specify the permissions as a user in the desktop apps.

I get the error I am expecting in a test tenant, but not in another tenant with the same label. Why would I see this error in one tenant and not another? Client versioning? A setting I am missing? Something else?

The end goal is that I need to redirect users to the Desktop app, so I need this pop up to actually work in my production tenant.

User's image

0 comments

Answer accepted by question author

Dora-T 2,075 Independent Advisor

Hi @Mitch Silberstein

Based on my research, Microsoft has introduced support for applying sensitivity labels with user-defined permissions directly in Office for the web (Word, Excel, and PowerPoint). This means users may now be able to specify permissions directly in the web apps instead of being prompted to open the document in the desktop application.

You can find Microsoft's announcement here:

Apply sensitivity labels with custom permissions in Office for the web | Microsoft Community Hub

You may also want to review the AI answer posted in this thread, as it mentions several tenant-level settings that could affect this behavior, including:

Sensitivity label integration with SharePoint and OneDrive.

Co-authoring for files encrypted with sensitivity labels.

For more details, please refer to Microsoft's documentation:

Enable sensitivity labels for files in SharePoint and OneDrive | Microsoft Learn

Enable co-authoring for encrypted documents | Microsoft Learn

I hope these suggestions help narrow down the possible causes of the issue.

Mitch Silberstein 150 Reputation points

2026-11-02T14:23:10.06+00:00

I am still not seeing the user-permissions pop up after ensuring sensitivity labels are turned on for SP/OD and co-authoring is enabled.

I ran the Get-SPOTenant | Select-Object EnableAIPIntegration and can see the result is "True".

I did enabled Co-authoring in the Purview settings a few days ago as well.

It actually doesn't even let me select the label with user-defined permissions, although admin assigned permissions work just fine in the online office apps.

Is there still something I am missing?
Dora-T 2,075 Reputation points Independent Advisor

2026-11-03T02:34:58.43+00:00

Hi @Mitch Silberstein

I tested a similar scenario in my environment by creating a sensitivity label, enabling co-authoring for encrypted files, and enabling sensitivity label support for Office files in SharePoint and OneDrive.

During testing, I observed the following behavior:

-Before enabling sensitivity label support for SharePoint and OneDrive: The Sensitivity option was not available in the Excel for the web toolbar.

-After enabling this feature using the Turn on now option: The Sensitivity option appeared in the toolbar, and I could see the newly created label in the menu. However, selecting the label resulted in the following message: "The label selected is unavailable in Office on the web. To apply this label, open the file in Office desktop." -If I apply the same label in the Excel desktop app: When I open the file in Excel for the web, I receive a message indicating that the document is protected by Information Rights Management (IRM) and needs to be opened in the desktop app.

Based on these results, I was unable to apply the label directly in Excel for the web or access the Permissions dialog described in Microsoft's April 2026 blog post.

I also looked further into the available Microsoft documentation but couldn't find any further information that explains this behavior.

Since you have already enabled sensitivity label support for SharePoint and OneDrive and co-authoring, but are still experiencing the issue, I recommend raising a support ticket through the Microsoft 365 admin center so that Microsoft Support can investigate further.

For instructions on creating a support request, please refer to Get support - Microsoft 365 admin | Microsoft Learn.

Best regards,
Mitch Silberstein 150 Reputation points

2026-11-03T15:40:08.36+00:00

I appreciate you running through the tests. It looks like you are not getting the expected result either after enabling the correct settings. I will get a Microsoft ticket open and see what they say.
Dora-T 2,075 Reputation points Independent Advisor

2026-11-04T02:14:28.75+00:00

Hi @Mitch Silberstein

I hope you get some helpful insights from Microsoft Support and that the issue can be resolved soon.

Have a great day!

1 additional answer

Your answer

Mitch Silberstein 150 Reputation points

2026-11-02T14:23:10.06+00:00

I am still not seeing the user-permissions pop up after ensuring sensitivity labels are turned on for SP/OD and co-authoring is enabled.

I ran the Get-SPOTenant | Select-Object EnableAIPIntegration and can see the result is "True".

I did enabled Co-authoring in the Purview settings a few days ago as well.

It actually doesn't even let me select the label with user-defined permissions, although admin assigned permissions work just fine in the online office apps.

Is there still something I am missing?
Dora-T 2,075 Reputation points Independent Advisor

2026-11-03T02:34:58.43+00:00

Hi @Mitch Silberstein

I tested a similar scenario in my environment by creating a sensitivity label, enabling co-authoring for encrypted files, and enabling sensitivity label support for Office files in SharePoint and OneDrive.

During testing, I observed the following behavior:

-Before enabling sensitivity label support for SharePoint and OneDrive: The Sensitivity option was not available in the Excel for the web toolbar.

-After enabling this feature using the Turn on now option: The Sensitivity option appeared in the toolbar, and I could see the newly created label in the menu. However, selecting the label resulted in the following message: "The label selected is unavailable in Office on the web. To apply this label, open the file in Office desktop." -If I apply the same label in the Excel desktop app: When I open the file in Excel for the web, I receive a message indicating that the document is protected by Information Rights Management (IRM) and needs to be opened in the desktop app.

Based on these results, I was unable to apply the label directly in Excel for the web or access the Permissions dialog described in Microsoft's April 2026 blog post.

I also looked further into the available Microsoft documentation but couldn't find any further information that explains this behavior.

Since you have already enabled sensitivity label support for SharePoint and OneDrive and co-authoring, but are still experiencing the issue, I recommend raising a support ticket through the Microsoft 365 admin center so that Microsoft Support can investigate further.

For instructions on creating a support request, please refer to Get support - Microsoft 365 admin | Microsoft Learn.

Best regards,
Mitch Silberstein 150 Reputation points

2026-11-03T15:40:08.36+00:00

I appreciate you running through the tests. It looks like you are not getting the expected result either after enabling the correct settings. I will get a Microsoft ticket open and see what they say.
Dora-T 2,075 Reputation points Independent Advisor

2026-11-04T02:14:28.75+00:00

Hi @Mitch Silberstein

I hope you get some helpful insights from Microsoft Support and that the issue can be resolved soon.

Have a great day!

Answer 1

The production tenant likely has the Office-for-the-web opt-in enabled, so the user-defined-permissions dialog is expected instead of the “Open in Desktop App” error; that error is not a reliable or configurable desktop-redirection mechanism.

Microsoft currently lists Let users assign permissions as supported in Office for the web on an opt-in basis. When supported, selecting the label opens the custom permissions dialog directly in the browser.^1^ ^2^

Compare the tenant settings

Run this against each tenant from the SharePoint Online Management Shell:

Connect-SPOService -Url https://<tenant>-admin.sharepoint.com

Get-SPOTenant |
    Select-Object EnableAIPIntegration

Interpret the result:

True: Sensitivity-label integration is enabled for SharePoint and OneDrive. Office for the web can display and apply supported labels, including user-defined-permissions labels.
False: The web integration is not enabled. This can produce the desktop-app redirection behavior shown in the screenshot.

EnableAIPIntegration is the documented tenant property for checking whether sensitivity labels are enabled for Office files in SharePoint and OneDrive.^3^

Also compare Microsoft Purview portal → Settings → Information Protection → Co-authoring for files with sensitivity labels. For user-defined-permissions labels to be selected and configured in Office for the web, Microsoft says to enable co-authoring for files encrypted with sensitivity labels.^4^

Enabling co-authoring automatically enables SharePoint/OneDrive sensitivity-label integration if it is not already enabled. Changing this setting requires at least Information Protection Admin or DLP Compliance Management; Security Administrator and Compliance Administrator are alternatives.^5^

What this means for the requested redirect

There is no documented per-label option to force users from Office for the web into the desktop application when the web client supports that label configuration. In a tenant with the required features enabled, the supported behavior is:

User selects High – External File in Word, Excel, or PowerPoint for the web.
The browser displays the permissions dialog.
The user assigns Viewer, Restricted Editor, Editor, or Owner permissions to users, groups, or an organization.^2^

Therefore, disabling tenant-wide SharePoint/OneDrive label integration solely to obtain this popup is not a good substitute for desktop redirection: it also removes broader web labeling and encrypted-file processing capabilities, including integrations with search, DLP, eDiscovery, and collaboration.^4^

If users must use desktop Office for a business or technical requirement, communicate and enforce that requirement separately rather than depending on this compatibility error. The available documentation does not identify a sensitivity-label policy that forces Open in Desktop App while retaining web labeling support.

If the two tenant settings match

Compare these remaining conditions:

Confirm the production test uses the same Word/Excel/PowerPoint web client, file type, published label, and label policy scope.
Confirm the label scope includes Files and other data assets. The custom-permissions prompt cannot be used in Word, Excel, or PowerPoint if the label excludes files.^6^
Test with a newly uploaded or newly edited file. SharePoint/OneDrive processing for user-defined-permissions labels applies to newly uploaded and edited files.^4^
If testing desktop behavior separately, check the minimum client versions. For custom permissions, Windows requires version 2004+ on Current/Monthly Enterprise Channel or 2008+ on Semi-Annual Enterprise Channel; macOS requires 16.35+.^1^

References