External Sharing with Sensitivity Labels

Question

Hello,Can someone confirm that the only way to share a document externally that has a sensitivity label applied, is to invite the recipient as a guest into our AD Tenant?&nbsp;&nbsp;Say I have a partner company, and I wish only all of my users, and all of theirs to have access to particular documents.&nbsp; Do I have to add them in as a cross tenant organization, and then create guest accounts for all of their users? This would seem a little unwieldly&nbsp;&nbsp;Additionally if I wish as an end user to apply a confidential label with just the email address of a 3rd party company having access (they that configure at the time).&nbsp; Would that 3rd party user then also have to already have a guest account in our tenant?&nbsp;&nbsp;Seemingly without a guest account, in both scenarios, they just receive an error that no Azure AD account exists for them in our tenant

christianjbergstrom · Answer

No. Only if the external permissions aren’t set in the label.

whiteb02 · Answer

ChristianJBergstrom&nbsp;&nbsp;Hi Christian,Thanks for the reply.This was my understanding. However if I configure either a direct mail account or a domain within the label. Send that document to the external party. They receive the message that there is no account for them in our Azure AD

christianjbergstrom · Answer

I imagine you have some conditional access policies set up. And I think this could be a case of the Microsoft Azure Information Protection app not being allowed/selected for them. Try excluding that app from CA or exclude the externals from the CA. When they are using an AAD tenant you can configure the Cross-tenant access settings under External Identities in Azure AD allowing the MAIP app (but only necessary when allowing&nbsp;some apps) and if not specified just check the box where you trust their MFA claims.
&nbsp;
Been some edits now so I’ll just add this for assitance instead&nbsp;https://microsoft.github.io/ComplianceCxE/resources/files/FAQ%20New%20features%20external%20collab%20using%20MIP.pdf
&nbsp;
*edit&nbsp;Whiteb02&nbsp;Did this get sorted?
&nbsp;
&nbsp;

whiteb02 · Answer

ChristianJBergstrom&nbsp;Having mixed results with this at the moment.Having turned on B2B collaboration with partner organizations, we now have some users that can successfully open the document once they provide the credentials from their own tenant (and without the need for us to create guest accounts).&nbsp;We have other users from the same organization that receive the error&nbsp;&nbsp;“Sorry, another account from your organization is already signed in on this computer”&nbsp;&nbsp;Also a working user, from a personal device, receives&nbsp;the same error above.&nbsp;Is it necessary for all account info in Credential Manager to be cleared out?&nbsp;&nbsp;Finally, on an individual user level.&nbsp; &nbsp;If user A in my organization wants to specify the permissions themselves, before sending a document externally to 1 or more people.&nbsp; Is the only way for the recipient(s) to be able to open the document, to be added as a guest within our tenant? (as we'll likely have no B2B setup for whoever it has been sent to.&nbsp;Without a guest account, we again get the error above, and the recipient receives no notification inviting them to create a guest account (if required), so we'd have to pre-stage an account for them?&nbsp;&nbsp;

christianjbergstrom · Answer

It can be tricky as you’ve noticed. And the business requirement should be the baseline for how the label config is done. I think it’s better if I simply add some links as there’s too much info on the topic.First, did you read the FAQ above?Read this https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide#support-for-external-users-and-labeled-contentAnd this https://learn.microsoft.com/en-us/microsoft-365/compliance/encryption-azure-ad-configuration?view=o365-worldwideHope that helps.

Forum Discussion

External Sharing with Sensitivity Labels

Share

Resources