Data Protection Issues

How to Share Microsoft Information Protection Documents with External Domains

Aamir Naveed Akram Oct 9, 2026 870 views

Question details

The user wants to allow external client domains to access protected documents without encryption and asks if Microsoft Information Protection can automatically decrypt files for specific domains.

How to Share Microsoft Information Protection Documents with External Domains

Product: Microsoft Information Protection
Device & OS: not provided
Scenario: Sharing labeled and protected documents with external organizations for unrestricted use or specific authorized access.
Observed behavior: Currently seeking a way to automatically decrypt files for external domains or securely authorize uploads to a client website without access restrictions.

Before you start

Ensure you have the necessary administrative privileges in your Microsoft Purview compliance portal and Microsoft Entra ID (Azure AD) to manage sensitivity labels and external sharing settings.

Solution 1Recommended

Add External Organizations as Authorized Domains

Add specific external Azure AD tenants to your authorized domains so authenticated users can access protected content according to their assigned permissions.

Microsoft Information Protection does not currently provide automatic decryption for specific domains. Instead, decryption is handled by the client application based on the user's permissions.

To allow external users to open protected documents, you must list the domains of organizations in other Microsoft Entra ID tenants. This enables external authentication and authorization.

Access the Compliance Portal

Edit Sensitivity Labels

Navigate to the Information protection section, select the sensitivity label you want to share, and click Edit.

Assign Permissions

In the encryption settings, choose to assign permissions now. Add the specific external client domains as authorized users so they can authenticate and access the labeled content.

Add External Organizations as Authorized Domains

Authentication Requirement: Microsoft Entra ID (and directory integration for on-premises accounts) is required to successfully authenticate and authorize users from external domains.

Solution 2

Create a Sensitivity Label Without Encryption

Use this approach if external clients need completely unrestricted use of the documents, such as uploading them to public websites.

Free Microsoft Office alternative

Try WPS Office for Seamless Document Management

While enterprise-level server permissions require Microsoft Information Protection, WPS Office provides a free, lightweight, and easy-to-use alternative for creating and locally protecting your documents. Enjoy familiar interfaces, robust format compatibility, and a seamless migration experience.

1. Download and Install: Visit the official WPS Office website to download and install the free suite on your device.
2. Open Your Documents: Launch WPS Office to easily open, edit, and save your existing DOCX, XLSX, and PPTX files.
3. Apply Local Protection: Navigate to the Menu and use the Encrypt feature to secure your document with a password before sending it to external clients.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight application that runs smoothly on most devices without complex setups.Built-in local document encryption and password protection features.Free to use with a highly familiar, user-friendly interface.

microsoft office alternative - wps office

Frequently Asked Questions

Can Microsoft Information Protection automatically decrypt files for specific domains?

No, automatic decryption for specific domains is not currently provided by Microsoft Information Protection. Decryption is handled dynamically by the client application based on the authenticated user's assigned permissions.

How can external clients use protected documents freely?

If clients need unrestricted use of the document (such as uploading to their own websites), you should create a sensitivity label without encryption. Instead of encrypting, you can apply alternative protections such as watermarking or metadata tagging.

What does the 'Do Not Forward' option do?

The 'Do Not Forward' option encrypts the email or document content and strictly restricts recipients from forwarding, printing, or copying the information.

What is required to authorize external organizations?

You need to list the domains of the external organizations in your Azure Active Directory (Microsoft Entra ID) tenants. Microsoft Entra ID is required to handle the authentication and authorization of those external users.

Microsoft Office Security Issues