Can't open a file encrypted by a sensitivity label: permissions, guests and super users

A user opens a labeled document and gets an access error, or a partner can't open the file you just sent. With label encryption, every open is an authorization check against the Azure Rights Management service: who the user is, what the label grants them, and whether Microsoft Entra ID lets them reach the service. In this post I'll show how to find which check failed, fix it, and recover content nobody can open.

Symptoms#

• A colleague or guest can't open a labeled Word, Excel or PowerPoint file, while the person who labeled it can.
• Opening works in the office but fails remotely once an MFA prompt appears.
• A file that opened last week no longer opens or has different rights.
• External users see one of these messages after signing in:

Access is blocked by your organization
Access is blocked by the organization
AADSTS90072: User account {user@contoso.com} from identity provider 'microsoftonline.com' does not exist in...

Or a user can open the file but can't change or remove its label:

You don't have permission to make this change to the sensitivity label. Please contact the content owner.

How label encryption decides who gets in#

A label set to Assign permissions now lists users, groups or domains and the rights each gets, from Viewer up to Full Control. When someone opens the file, the service checks their identity against that list and issues a use license with their usage rights. A few rules explain most surprises:

• Everyone in your organization means tenant members. It excludes guest accounts.
• Groups must be mail-enabled security groups, distribution groups or Microsoft 365 groups. Security groups that aren't mail-enabled and Exchange dynamic distribution groups don't work.
• Entering a domain grants access to every verified domain of the tenant that owns it.
• The use license lets the user reopen the file without a new check, offline too, for 30 days by default or less if Allow offline access is limited. Permission and group changes take effect when it expires.
• The person who applied the label, the Rights Management issuer, always has Full Control, even after expiry or revocation, so "it works for me" proves little.

Why it happens#

• The user isn't in the permissions: not in the listed group, a guest covered only by "Everyone in your organization", or an unsupported group type.
• Microsoft Entra ID blocks the encryption service. Cross-tenant access settings (yours or the partner's) that don't allow Microsoft Rights Management Services cause the "Access is blocked" messages. Conditional Access policies that include that app and require MFA block external users without a guest account or trusted MFA claims.
• The wrong account. Office is signed in with another identity, or an external user's Microsoft account uses a different email address from the one in the permissions.
• Expiry or offline limits. The User access to content expires date has passed, or offline access is limited and the device can't reach the service.
• An app or version that doesn't support the protection, for example labels with dynamic watermarks in older Office versions.
• Missing rights to relabel. Replacing or removing encryption needs the Export or Full Control usage right, the issuer or owner role, or a super user.

How to fix it#

1. Find the label and its permissions#

Ask the issuer which label they applied, or check the file with Get-FileStatus -Path from the Microsoft Purview Information Protection client's PowerShell module. Then, in the Purview portal, open Solutions › Information Protection › Sensitivity labels, edit the label and review its access control settings: users and groups, permissions, expiry and offline access.

2. Grant the missing access#

Add the user, a mail-enabled group or the partner's domain to the label and choose their permissions. People you add can open content already protected with that label. For guests you can't list in advance, combine Add any authenticated users with SharePoint and OneDrive integration with Microsoft Entra B2B, so sharing creates the guest accounts. If the label lets users assign permissions (Do Not Forward, Encrypt-Only, custom permissions), those live in the item, so the issuer must reapply them.

3. Unblock external users in Microsoft Entra ID#

• In the Microsoft Entra admin center, under External Identities › Cross-tenant access settings, allow Microsoft Rights Management Services (app ID 00000012-0000-0000-c000-000000000000) inbound for partners who open your content, and outbound for content your users receive. "Blocked by your organization" points at the user's own tenant; "blocked by the organization" names the other one.
• AADSTS90072 for a user without a guest account means their MFA claims aren't trusted. For Conditional Access policies that include Microsoft Rights Management Services and require MFA, trust the partner's MFA claims in cross-tenant access settings or create guest accounts. Otherwise, exclude external users or remove the app from the policy.
• The sign-in logs show the failures; see guest sign-in errors.
• External users signing in with a Microsoft account must use the email address the permissions name.

4. Expiry, offline access and versions#

After the expiry date, only the issuer or a super user can open and relabel the file. For offline limits, get the device online to reauthenticate. If the label applies dynamic watermarks, update Office or open the file in Office for the web. Encrypted PDFs open in Microsoft Edge.

5. Recover content with the super user feature#

When the issuer has left or nobody can open a file, use a super user. The feature is off by default:

Install-Module -Name AIPService
Connect-AipService
Enable-AipServiceSuperUserFeature
Add-AipServiceSuperUser -EmailAddress "recovery.admin@contoso.com"
Get-AipServiceSuperUser

Add people with Add-AipServiceSuperUser for immediate access, because a group set with Set-AipServiceSuperUserGroup is cached. The super user can open the file, or relabel many files with Set-FileLabel (PurviewInformationProtection module) using a label without encryption. For encrypted mail, eDiscovery can decrypt on export. Afterwards, run Disable-AipServiceSuperUserFeature.

Verify the fix#

• The user opens the file and sees the label name and description in the yellow message bar, and View Permission lists the rights you intended.
• External users' sign-ins to Microsoft Rights Management Services succeed in the sign-in logs.
• Get-AipServiceAdminLog records enabling and disabling the super user feature and adding super users; file decryption appears in usage logging.
• Recovery relabeling shows in activity explorer and the audit log.

Prevent it next time#

• Grant access through mail-enabled groups, and add partners by domain or guest account.
• Agree cross-tenant settings for Microsoft Rights Management Services with partners before sharing encrypted files.
• Keep expiry at Never unless content is time-bound. Microsoft suggests offline access of 7 days for sensitive business data and Never only for the most sensitive labels.
• Document a super user procedure, but keep the feature off until needed.

See also encryption options in Microsoft Purview, the label and encryption errors quick reference and, for email, Message Encryption troubleshooting.

References#

• Restrict access to content by using sensitivity labels to apply encryption (Microsoft Learn)
• Microsoft Entra configuration for encrypted content (Microsoft Learn)
• Configure Azure Rights Management super users for discovery services or data recovery (Microsoft Learn)