Sharing sensitive documents externally is a common business need, but when encryption and sensitivity labels are involved, things can get complicated.
If you are using Microsoft Purview to secure email attachments, it’s important to understand how Conditional Access (CA) policies and Guest account settings influence the experience for external recipients.
Scenario 1: Guest Accounts Enabled
✅ Smooth Experience
Each recipient is provisioned with a guest account, allowing them to access the file seamlessly.
📝 Note
This can result in a significant increase in guest users, potentially in hundreds or thousands, which may create additional administrative workload and management challenges.
Scenario 2: No Guest Accounts
🚫 Limited Access
External users can only view attachments via the web interface. Attempts to download then open the files in Office apps typically fail due to repeated credential prompts.
🔍 Why?
Conditional Access policies may block access to Microsoft Rights Management Services because it is included under All resources. This typically occurs when access controls such as Multi-Factor Authentication (MFA) or device compliance are enforced, as these require users or guests to authenticate.
To have a better experience without enabling guest accounts, consider adjusting your CA policy with one of the below approaches:
Recommended Approach
Exclude Microsoft Rights Management Services from CA policies targeting All resources.
Alternative Approach
Exclude Guest or External Users → Other external users from CA policies targeting All users.
Things to consider
- These access blocks won’t appear in sign-in logs— as this type of external users leave no trace. Manual CA policy review is essential.
- Using What if feature with the following conditions can help to identify which policies need to be modified.
- These approaches only apply to email attachments. For SharePoint Online hosted files, guest accounts remain the only viable option.
- Always consult your Identity/Security team before making changes to ensure no unintended impact on other workloads.
References
For detailed guidance on how guest accounts interact with encrypted documents, refer to Microsoft’s official documentation:
Microsoft
