Forum Discussion
Purview Label Permissions Priority
Hello
If permissions are applied to all users and groups in the organization as 'Viewer' and to a group as 'Co-Author',
What permissions will be granted to group members? The tests revealed that the permissions were applied to all users and groups of the organization
Any Microsoft documentation for this scenario ?
2 Replies
If a user is granted multiple permission entries for the same label, the highest level of rights from any of those entries applies.
So in your example:
- All users and groups → Viewer
- Specific group → Co-Author
Members of that specific group will end up with Co-Author rights, because that’s a superset of Viewer. The broader “Viewer” assignment doesn’t override or reduce the more permissive “Co-Author” assignment.
Microsoft documentation -
"When a user is granted multiple sets of rights, the user gets the union of those rights."
https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels#configure-encryption-settings-for-a-label
Please mark as resolved if this solves your issue.
Thank you pradejain
The results from my testing in two different environments were different.
The user belongs to all users and groups in the organization, and the specific group cannot print, so the rights are linked to
- All users and groups → Viewer
Removing all users and groups in the organization from the Label permissions allows the user to Print
