Data Protection Issues

How to Allow External User Access to Purview Sensitivity Labels

John Wilson Oct 1, 2026 868 views

Question details

External users are unable to access Microsoft Office files and PDFs that are protected by Microsoft Purview sensitivity labels with user-defined permissions.

How to Grant External Users Access to Microsoft Purview Sensitivity Labels

Product: Microsoft Purview, Microsoft Entra ID
Device & OS: not provided
Scenario: Sharing securely encrypted documents and PDFs with external users or clients outside the organization's directory.
Observed behavior: External recipients are blocked from opening the protected files because their external accounts are not recognized and authenticated by the organization's tenant.

Before you start

Verify that your organization's IT policies allow inviting external users as guests to your Microsoft Entra ID directory before proceeding.

Solution 1Recommended

Add External Recipients as Guest Accounts in Microsoft Entra ID

To allow external users to access content protected by user-defined permissions, they must be invited to your organization's directory as authenticated guests.

Microsoft Purview sensitivity labels that use user-defined permissions require the recipient's identity to be authenticated against the organization's directory. Because there is generally no supported way to bypass this requirement for this specific access model, external users must exist in your tenant as guests.

Sign in to Microsoft Entra admin center

Navigate to the Users directory

In the left-hand navigation menu, go to 'Identity', expand the 'Users' section, and click on 'All users'.

Invite the external user

Click on 'New guest user' at the top of the page. Enter the external recipient's email address, display name, and an optional personal message.

Send the invitation

Click 'Invite' to send the email invitation. Instruct the external recipient to check their inbox and accept the invitation to establish their guest identity in your tenant.

Share the protected document

Once the external user has accepted the guest invitation and authenticated, they will be able to successfully open the Office files and PDFs protected by the sensitivity labels.

Add External Recipients as Guest Accounts in Microsoft Entra ID

Policy Restrictions: If you lack the necessary permissions to add guest users, you must contact your IT administrator to request external directory access for the recipient.

Free Microsoft Office alternative

Try WPS Office for Secure and Lightweight Document Sharing

If you frequently struggle with complex enterprise permissions and need a straightforward way to create, protect, and share documents, WPS Office offers a highly compatible alternative to Microsoft Office. You can easily apply standard password protection to PDFs and Office files without requiring complicated directory configurations.

1. Download and Install WPS Office: Visit the official WPS website, download the free version, and install it on your computer or mobile device.
2. Open Your Document: Launch WPS Office and open your Word, Excel, PowerPoint, or PDF file directly.
3. Apply Standard Password Protection: Navigate to the 'Menu' > 'Document Encryption' > 'Encryption' to easily set an open password and share it safely with external users.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Easily apply document-level password protection without complex enterprise directory setups.Lightweight software with a familiar, user-friendly interface for seamless migration.Free to use for essential document creation, editing, and sharing tasks.

microsoft office alternative - wps office

Frequently Asked Questions

Can external users bypass the Microsoft Entra ID guest account requirement?

No. There is generally no supported method to bypass the guest account requirement when accessing files protected by user-defined sensitivity-label permissions, as the system must authenticate the user's identity.

Which file types are affected by this Purview restriction?

This restriction typically affects Microsoft Office files (such as Word documents, Excel spreadsheets, and PowerPoint presentations) as well as PDF documents that have been protected by Microsoft Purview sensitivity labels.

Why do external users receive an access denied error on protected files?

This happens because the external user's identity cannot be authenticated directly by your organization's directory. They must be added as a guest in Microsoft Entra ID to verify their credentials before document decryption is allowed.

Microsoft Office Security Issues