Published Nov 19, 2024
Microsoft Purview is introducing a feature that extends SharePoint Online library permissions to downloaded files, available for Public Preview from mid-November 2024 and General Availability by late July 2025. This feature allows sensitivity labels to be applied at the library level, protecting files upon download and reflecting permission changes in real-time.
Updated March 10, 2025: We have updated the rollout timeline below. Thank you for your patience.
We are providing this update because your tenant is utilizing sensitivity labels and Microsoft SharePoint Online.
Coming soon: A new capability that ties together SharePoint Online library permissions and Purview sensitivity labeling and protection. We are happy to bring this capability to Public Preview. This is an opt-in feature in Microsoft PowerShell.
This message is associated with Microsoft 365 Roadmap ID 467254.
When this will happen:
Public Preview: We will begin rolling out mid-November 2024 and expect to complete by mid-January 2025.
General Availability (Worldwide, GCC): We will begin rolling out late June 2025 and expect to complete by late July 2025.
General Availability (GCCHigh, DoD): We will begin rolling out early August 2025 and expect to complete by late August 2025.
How this will affect your organization:
After this rollout, SharePoint Online document library owners will be able to apply a sensitivity label at the library level, automatically applying that label to all unprotected and unlabeled files (Microsoft Word, Microsoft Excel, Microsoft PowerPoint, and PDFs) in the target library. This simplifies labeling in bulk across document libraries in an organization. This capability also helps protect files as they egress from the original document library, such as for collaboration purposes or attempted exfiltration. Files downloaded from these libraries are protected at download. Users accessing these files outside of SharePoint Online have their rights evaluated in real time against the document library. Changes to user permissions on the document library are reflected on downloaded files, including full revocation for users removed from the document library. This provides a more streamlined way to revoke access to documents for individual users (instead of revoking access to each document).
Learn more about how to use this feature and its capabilities, limitations, and licensing: Configure SharePoint with a sensitivity label to extend permissions to downloaded documents | Microsoft Learn
What you need to do to prepare:
After this feature is available, we recommend you test this feature first on sites with non-production data to understand its capabilities.
This rollout will happen automatically by the specified date with no admin action required before the rollout. Review the referenced documentation links to learn more about enabling this feature.