Forum Discussion
External people can't open files with Sensitivity Label encryption.
Well, a label that allows access to all authenticated users should work perfectly well with other Microsoft 365 tenants. I tested this with two different tenants by creating labels in both tenants with this access and sending email and email with protected attachments from one side to the other and vice versa. Everything worked. Here's an example of an email with a protected attachment (label is partner-accessible content) being read with OWA on the target tenant. The email has been protected as expected because of the presence of the protected attachment, and both the message and attachment content are visible using the Viewer right.
Time to ask Microsoft support to help?
That was my original expectation of how it should work too, but all the reading I've done since has suggested that the recipient either needs to be a Guest in your tenant, or a B2B trust relationship needs to be setup between the tenants for it to work. Could you just confirm there are no trust relationships between the two tenants you tested on, and that the recipient isn't a Guest in the host tenant please?
I heard back from the person that I sent a protected email to in a completely disconnected tenant and they were able to read the content.
I tested again with a brand-new account that is absolutely not a guest in my tenant... and the message showed up just fine. I'll try with another account in a tenant that I don't own to see what happens there.
Thanks for your help with this Tony, it's very kind of you. You'll see from others commenting on this thread that their understanding / experience is the same as mine (i.e. that external people need to be a Guest / B2B Direct Connect needs to be setup for them to be able to open encrypted documents attached to emails).
I've spun up an MDX Purview tenant to send myself some labelled documents to see what the experience is there. The confusion continues!!!!