This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
We have a sensitivity label (with user defined permissions) applied that gives specific external users VIEWER access to an Excel file. When I go to share the file, I also specify the same external users to have EDITOR access. Which permissions win? Does it always take a most restrictive setting? I need to know the scenarios for what to expect for these cases.
A unified data governance solution that helps manage, protect, and discover data across your organization
The sensitivity label has precedence. And will apply even if the document is downloaded from SPO.
Something seems wrong. Is there a discrepancy between the web and desktop apps?
I ran a test with the label on providing me VIEWER permissions, but shared it with EDIT permissions. My experience was different in the web vs desktop.
Web:
Desktop:
AI answer
The external user will remain a Viewer: selecting Can edit in SharePoint does not elevate the Viewer rights embedded in the encrypted workbook.
A labeled and encrypted file has two independent authorization gates:
The requested operation must pass both gates. In practical terms, the effective result is the intersection—the more restrictive permission for that operation—not one permission replacing the other. Microsoft documents that Office for the web enforces the permissions assigned through encryption, and those protections remain with downloaded files.^1^
For the external user shown:
The sharing dialog grants repository-level edit access, but the encrypted workbook does not grant the required encryption rights. For Excel, VIEW permits opening and reading; editing requires applicable edit/save rights such as DOCEDIT and EDIT.^2^
Changing SharePoint access alone will not convert that user into an encryption Editor. To let the user edit, update the user-defined permissions on the workbook so that the same external identity is assigned Editor or Restricted Editor, as appropriate, while retaining Can edit in SharePoint.
| SharePoint/OneDrive access | Label encryption permission | Expected result |
|---|---|---|
| No access | Viewer, Editor, or Owner | Cannot reach the file through SharePoint/OneDrive |
| Can view | Viewer | Can open and view; cannot edit |
| Can view | Editor | Can open, but cannot edit the stored SharePoint file because the repository grants view only |
| Can edit | Viewer | Can open and view; encryption blocks editing |
| Can edit | Restricted Editor | Can edit, subject to the restrictions included in that label permission level |
| Can edit | Editor | Can edit and save; other actions depend on the usage rights included in Editor |
| Can edit | Owner | Full encryption rights, including changing or removing protection |
| Can view or edit | Not authorized by encryption | Cannot decrypt/open the workbook |
The exact capabilities of Viewer, Restricted Editor, Editor, and Owner are groupings of Rights Management usage rights. For example, OWNER grants all rights and permits removing or reapplying encryption.^2^
The person who applied the encryption is the Rights Management issuer and is always granted Full Control, which explains why the workbook owner can have broader rights than other recipients.^3^
Ensure that both permission entries resolve to the same external identity. An external person might authenticate through:
Cross-tenant access settings or Conditional Access can still prevent an otherwise authorized external user from opening the encrypted file.^4^
For a reliable test:
Do not use SharePoint Can edit as the only indication that editing will work; for an encrypted workbook, the sensitivity-label encryption permission must independently allow it.
References