Microsoft Security | Microsoft Purview
A unified data governance solution that helps manage, protect, and discover data across your organization
The external user will remain a Viewer: selecting Can edit in SharePoint does not elevate the Viewer rights embedded in the encrypted workbook.
A labeled and encrypted file has two independent authorization gates:
- SharePoint/OneDrive sharing permission determines whether the user can reach the file and whether the repository permits viewing or editing.
- Purview encryption permission travels with the file and determines what the authenticated user can do with its contents.
The requested operation must pass both gates. In practical terms, the effective result is the intersection—the more restrictive permission for that operation—not one permission replacing the other. Microsoft documents that Office for the web enforces the permissions assigned through encryption, and those protections remain with downloaded files.^1^
Your specific configuration
For the external user shown:
- Sensitivity-label permission: Viewer
- SharePoint sharing permission: Can edit
- Effective result: The user can open and view the workbook but cannot edit it.
The sharing dialog grants repository-level edit access, but the encrypted workbook does not grant the required encryption rights. For Excel, VIEW permits opening and reading; editing requires applicable edit/save rights such as DOCEDIT and EDIT.^2^
Changing SharePoint access alone will not convert that user into an encryption Editor. To let the user edit, update the user-defined permissions on the workbook so that the same external identity is assigned Editor or Restricted Editor, as appropriate, while retaining Can edit in SharePoint.
Expected outcomes
| SharePoint/OneDrive access | Label encryption permission | Expected result |
|---|---|---|
| No access | Viewer, Editor, or Owner | Cannot reach the file through SharePoint/OneDrive |
| Can view | Viewer | Can open and view; cannot edit |
| Can view | Editor | Can open, but cannot edit the stored SharePoint file because the repository grants view only |
| Can edit | Viewer | Can open and view; encryption blocks editing |
| Can edit | Restricted Editor | Can edit, subject to the restrictions included in that label permission level |
| Can edit | Editor | Can edit and save; other actions depend on the usage rights included in Editor |
| Can edit | Owner | Full encryption rights, including changing or removing protection |
| Can view or edit | Not authorized by encryption | Cannot decrypt/open the workbook |
The exact capabilities of Viewer, Restricted Editor, Editor, and Owner are groupings of Rights Management usage rights. For example, OWNER grants all rights and permits removing or reapplying encryption.^2^
The person who applied the encryption is the Rights Management issuer and is always granted Full Control, which explains why the workbook owner can have broader rights than other recipients.^3^
External-user considerations
Ensure that both permission entries resolve to the same external identity. An external person might authenticate through:
- Their Microsoft Entra ID account, or
- A guest account in your tenant.
Cross-tenant access settings or Conditional Access can still prevent an otherwise authorized external user from opening the encrypted file.^4^
For a reliable test:
- In Excel, change the external user from Viewer to the required label permission.
- Keep the user at Can edit in SharePoint.
- Have the user sign out of other Microsoft 365 identities and open the link using the exact address represented by the permission entry.
- Test in Excel for the web first.
- Verify separately whether the user can open, edit, save, copy, print, and download, because these actions map to different usage rights.
Do not use SharePoint Can edit as the only indication that editing will work; for an encrypted workbook, the sensitivity-label encryption permission must independently allow it.
References
