Data Protection Issues

How to Control SharePoint Folder Access with Microsoft Purview Labels

WPS Content Manager Oct 9, 2026 869 views

Question details

The user needs to configure Microsoft Purview sensitivity labels to enforce access and download restrictions for specific user groups on SharePoint files.

How to Control SharePoint Folder Access with Microsoft Purview Labels

Product: Microsoft SharePoint and Purview
Device & OS: not provided
Scenario: Setting up sensitivity labels to grant required access and download permissions to one group while restricting another group, and clarifying the licensing requirements for this enforcement.
Observed behavior: The required protection policies must correctly target distinct groups, as having a license to apply a label does not automatically determine how protection is enforced on end users.

Before you start

Ensure you have compliance administrator permissions in your Microsoft 365 tenant and access to the Microsoft Purview compliance portal before adjusting sensitivity labels.

Solution 1Recommended

Configure Sensitivity Labels and Protection Policies in Microsoft Purview

Apply specific encryption and permission settings to a sensitivity label to control which groups can view, edit, or download SharePoint content.

Sensitivity labels in Microsoft Purview allow you to classify and protect your organization's data across SharePoint and Microsoft 365. The enforcement of access and download restrictions is determined by the encryption settings within the label and the published policy, rather than solely by the user's license.

Access the Microsoft Purview portal

Log in to the Microsoft Purview compliance portal using your administrator credentials and navigate to the 'Information protection' section under 'Solutions'.

Create or edit a sensitivity label

Click on 'Labels' and either select 'Create a label' or edit an existing one. Ensure the scope includes 'Files and emails'.

Configure encryption settings

In the encryption settings, choose 'Assign permissions now'. Add 'Group A' and assign them Co-Author or custom permissions that include downloading. Add 'Group B' and assign them 'Viewer' permissions, ensuring the 'Download' right is unchecked.

Publish the label policy

Go to 'Label policies' and publish your configured label to the relevant SharePoint sites, Microsoft 365 groups, or specific users.

Verify licensing requirements

Consult the official Microsoft Purview licensing documentation or contact Microsoft Support to confirm that your organization holds the correct licenses (such as Microsoft 365 E5 or E5 Compliance) required for automatic labeling and policy enforcement.

Configure Sensitivity Labels and Protection Policies in Microsoft Purview

Licensing Context: The license required to apply a sensitivity label is distinct from the enforcement of the policy. Users restricted by the policy will have those restrictions enforced regardless of their individual licensing status.

Free Microsoft Office alternative

Try WPS Office for Lightweight and Secure Document Management

While Microsoft Purview handles complex enterprise data compliance on SharePoint, you may need a fast, secure, and free suite for individual document creation and local protection. WPS Office is a highly compatible alternative that offers built-in file encryption without the heavy enterprise overhead.

1. Download WPS Office: Install WPS Office Free on your Windows, Mac, or mobile device.
2. Open your document: Launch the application and open your existing Microsoft Office files.
3. Apply local encryption: Go to the 'Menu' or 'Protect' tab, select 'Encrypt', and set a secure password for opening or editing the file.
4. Save and share securely: Save the encrypted document and share it with authorized users knowing your data is protected.

Free and lightweight Office suite for everyday tasksFully compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Built-in document encryption and password protection to restrict unauthorized accessFamiliar user interface for a seamless transition from Microsoft Office

Frequently Asked Questions

Do users need a specific Microsoft license to have Purview protection policies enforced on them?

Not necessarily. While the administrator or user applying the label may require a specific license (like Microsoft 365 E5), the enforcement of access and download policies on the end-users reading the content is dictated by the label's configuration, regardless of the reading user's license.

Can I prevent a specific group from downloading files in SharePoint using Purview?

Yes. When configuring the encryption settings of a sensitivity label in Microsoft Purview, you can assign custom permissions to specific groups. By granting a group 'Viewer' rights and omitting the 'Export' or 'Download' right, you restrict their ability to download the protected files.

Why are my SharePoint sensitivity labels not applying correctly to new files?

Ensure that your label policy has been properly published and that enough time has passed for the policy to sync (which can take up to 24 hours). Also, verify that the 'Files and emails' scope is enabled in the label configuration.

Microsoft Office Security Issues