Data Protection Issues

How to Stop Azure Information Protection from Encrypting PDF Files

Amos Gikunda Sep 28, 2026 870 views

Question details

Users need to stop Azure Information Protection (AIP) or Microsoft Purview from automatically encrypting PDF files, which creates accessibility issues for external recipients.

How to Stop Azure Information Protection from Encrypting PDF Files

Product: Azure Information Protection / Microsoft Purview
Device & OS: not provided
Scenario: Sharing PDF files with external recipients who are unable to easily open or read the encrypted documents.
Observed behavior: Sensitivity labels automatically apply encryption to PDF files, sometimes even triggering when only an email-level label is applied.

Before you start

Ensure you have the necessary administrative privileges in the Microsoft Purview compliance portal to modify sensitivity labels, policies, and encryption settings.

Solution 1Recommended

Adjust Microsoft Purview Sensitivity Label Settings

Modify your existing sensitivity labels to prevent them from applying automatic encryption to PDF files.

If sensitivity labels are configured to encrypt files automatically, they will apply to PDFs generated or labeled within the environment. Modifying the encryption scope is the primary method to resolve this.

Access the Compliance Portal

Navigate to Labels

Go to 'Information protection' in the left sidebar and select the 'Labels' tab to view your current sensitivity labels.

Edit Label Settings

Select the label that is causing the encryption, click 'Edit label', and navigate through the wizard to the 'Encryption' section.

Disable File Encryption

Adjust the settings to ensure encryption is not automatically applied to 'Files', or configure it to only apply to emails, then save and publish the updated label.

Propagation Time: Changes to sensitivity labels can take up to 24 hours to fully propagate to all users and applications within your organization.

Solution 2

Consult Microsoft Q&A and Support Specialists

Reach out to Microsoft support or community forums for complex labeling policies or API-related encryption issues.

Free Microsoft Office alternative

Switch to WPS Office for Seamless PDF Management

While Azure Information Protection configurations must be managed directly through Microsoft Purview, you can use WPS Office to easily read, edit, and manage standard PDF files and Office documents. WPS Office is a lightweight, free alternative offering high format compatibility and a familiar interface.

1. Download WPS Office: Visit the official WPS website to download and install WPS Office Free on your device.
2. Open PDF Toolkit: Launch WPS Office and click on the 'PDF' tab from the home screen.
3. Manage PDFs Seamlessly: Drag and drop your unencrypted PDF files to easily view, edit, or convert them.

Free and lightweight alternative to Microsoft OfficeSeamlessly open, edit, and convert standard PDF documentsHigh compatibility with Microsoft Word, Excel, and PowerPoint formatsFamiliar user interface requiring no learning curve

microsoft office alternative - wps office

Frequently Asked Questions

Why are my PDFs being encrypted when I only applied an email sensitivity label?

In some Microsoft Purview configurations, applying a restrictive sensitivity label to an email can automatically inherit and apply encryption to any attached PDF files to maintain the defined security boundaries of the message.

Can I remove Azure Information Protection encryption from an individual PDF?

If you have the appropriate permissions and own the file, you can remove the encryption by opening the file in an AIP-supported viewer, modifying or removing the applied sensitivity label, and saving the document.

How long does it take for new sensitivity label settings to apply to my PDFs?

After publishing changes to a sensitivity label in the Microsoft Purview compliance portal, it can take up to 24 hours for the new policies to sync and apply across your organization's devices and applications.

Microsoft Office Security Issues