Microsoft Word Tracking / Changes no longer active when document is AIP-protected

[Deleted]

Hi there

I recognized that there must be a special right to be able to accept/reject changes in a Word document when it's AIP-protected. 

A normal user isn't allowed but me as a global admin it's still working.

Any hint which and where to set it?

Thanks and best

Udo

[#2 · Accepted solution]

This is something that the Office team is currently looking into, because currently, you need the Full Control right to accept/reject changes in a protected document that has Track Changes on. We've documented this limitation in the usage rights descriptions (https://docs.microsoft.com/en-us/azure/information-protection/deploy-use/configure-usage-rights#usag...) for the "Edit Content, Edit" (DOCEDIT) right. Keep an eye on announcements from Office, and when you no longer need Full Control to use Track Changes, I'll also update this documentation.

[#3]

Hi Carol

Thanks for the fast reply.

The full control right includes the ability to remove protection and reprotect a document - is that also valid when I set  the policy "All documents and emails must have a label", so a "normal user" can remove the protection?

Thanks and best

Udo

[#4]

Tested it myself:

Changed the AIP rights to Full Control -> User is able to remove the protection despite the option "All documents and emails must have a label" is set.

But as the user normally doesn't have the AIP client installed and we're running re-protection every hour it's not that big problem at the moment.