We’re excited to announce that support for applying sensitivity labels with user-defined permissions is now rolling out in Word, Excel, and PowerPoint for the web.

In the past, users were limited to opening and editing files with existing custom permissions in the web apps; applying new sensitivity labels configured for user-defined permissions or modifying permissions always required switching to the desktop versions. Now, all these actions – applying labels and managing permissions for specific users or domains – can be completed entirely within Word, Excel, or PowerPoint on the web. 

How the Permissions dialog works in Office for the web 

When a user applies a sensitivity label that is configured for user-defined permissions in Word, Excel, or PowerPoint on the web, the Permissions dialog opens to let them choose who can access the file and what each person or domain is allowed to do. This is the same modernized experience that previously shipped in the Windows apps, now available in the browser. 

1. Apply a label configured for user-defined permissions. From the Sensitivity menu in the toolbar, the file name flyout, or other entry points your organization uses, the user selects a label that their tenant admin has configured in the Purview portal with the option to let users assign permissions.
2. Specify users and domains. In the Permissions dialog, the user adds individual people (for example, someone@example.com) or whole domains (for example, example.com) who should have access to the file. 
   
3. Choose permission levels. For each person or domain, the user chooses from clear permission levels such as Viewer, Editor, or Owner, which correspond to underlying Rights Management usage rights. 
4. Use advanced options when needed. The user can expand additional settings to configure options such as a contact email for access requests. Note that web apps do not currently support setting a custom expiration date for permissions. 
5. Apply and update permissions. After saving, the selected sensitivity label is applied to the file with the specified permissions. Users with appropriate rights can reopen the Permissions dialog later from the web apps to add or remove people or domains, or adjust permission levels, without switching to the desktop client.

The Permissions dialog in Office for the web is designed to be consistent with the experience in the Windows apps, so users see the same permission levels and terminology wherever they work. All enforcement continues to respect your organization’s existing sensitivity label policies, encryption configurations, and Rights Management Service (RMS) settings.

What this means for admins 

This feature enables organizations using sensitivity labels configured in the Microsoft Purview portal with encryption and user-defined permissions to apply these labels and manage permissions directly in the web versions of Word, Excel, and PowerPoint. Users can now stay within the browser to classify and protect content, eliminating the need to switch to desktop apps for applying or updating labels and permissions. 

As support for applying these labels becomes available in Office for the web, consider reviewing your existing sensitivity labels that are configured for user-defined permissions. You may want to update internal guidance and training materials to reflect that users can now complete these workflows entirely in the browser and ensure that security operations and compliance teams are prepared to monitor usage through existing Purview auditing and reporting capabilities. 

Admin considerations and scenarios 

Many organizations use user-defined permissions for scenarios where central policies cannot realistically predefine every individual who should have access to a file. For example, you might publish labels that require users to specify recipients for documents that contain deal-specific financials, M&A data, or sensitive HR information. In these cases, granting permissions at the time of labeling helps reduce oversharing and keeps access tightly scoped to the people who genuinely need it. 

Licensing and configuration requirements 

To use sensitivity labels with user-defined permissions in Office for the web, your organization must have licensing that supports configuring Purview sensitivity labels, have sensitivity labeling enabled for files stored in SharePoint and OneDrive, and have configured at least one sensitivity label for user-defined permissions. 

The licensing requirements for applying sensitivity labels with user-defined permissions in the Office web apps is that same as for using sensitivity labels that apply encryption in the Office desktop apps. For more information on licensing requirements, see Microsoft 365 licensing guidance for security & compliance. 

See Enable sensitivity labels for files in SharePoint and OneDrive for more information about enabling application of sensitivity labels to files stored in the cloud.