MC1545696 - Microsoft OneDrive and SharePoint: Annotate sensitivity-label protected PDFs on the web

Microsoft 365 Message Center announcement MC1545696.

MS Message Center's Summary

Microsoft OneDrive and SharePoint on the web are introducing the ability for users with editing rights to annotate sensitivity label protected PDFs directly in the browser without stripping encryption. This capability rolls out worldwide beginning in late January 2027. Administrators should review existing usage rights configurations and update internal helpdesk guidance before the rollout takes effect.

Administrator impact
No direct administrator action is required.
End user impact
Users with appropriate editing permissions can now add annotations to protected PDF files on the web while keeping security labels intact.
Importance
3/10: This is a standard feature update that improves collaboration capabilities for protected documents without requiring administrative configuration.

Microsoft Summary

OneDrive and SharePoint on the web will allow users with editing rights to annotate sensitivity-label protected PDFs without removing labels. Annotations and protections are preserved upon saving. This feature rolls out worldwide in late January 2027, requires no admin action, and applies only to OneDrive for Business and SharePoint.

Message Center ID
MC1545696
Category
stay Informed
Severity
normal
Services
SharePoint Online, Microsoft OneDrive
Tags
New feature, User impact, Admin impact
Published
2026-11-09
Last updated
2026-11-09
Expires
2027-03-03

[What and why] Microsoft OneDrive and SharePoint on the web will support annotation for PDFs encrypted with Microsoft Purview sensitivity labels. Users who have the appropriate editing usage rights will be able to annotate protected PDFs in their browser without removing the sensitivity label. The file's sensitivity label, encryption, and usage rights will be preserved when changes are saved. [Rollout schedule] General Availability (Worldwide, GCC, GCC High, DoD): Beginning in late January 2027 and expected to complete in late January 2027 [Impact on your organization] Who is affected OneDrive for Business and SharePoint customers This feature does not apply to OneDrive Consumer. Platforms and services OneDrive for Business and SharePoint on the web All browsers are supported. What will happen Users who have editing usage rights can annotate sensitivity label-protected, encrypted PDFs in the OneDrive or SharePoint web PDF viewer . Available annotation tools include ink, highlight, free text, notes, signatures, image/shape/date stamps, bookmarks, and form fields. Users can save annotations without removing the sensitivity label. The sensitivity label, encryption, and usage rights are preserved when the annotated PDF is saved. Users with view-only rights will continue to see the PDF as read-only and cannot annotate. This change does not grant users additional access or editing rights. No feature-specific admin control or configuration is required. Existing sensitivity label and usage-rights settings determine who can view or edit protected PDFs. [Action required and recommendations] No feature-specific admin action is required to enable this update. We recommend that you: Inform users who routinely review labeled or regulated documents that they can annotate protected PDFs in place. Confirm that your sensitivity label and usage-rights configuration reflects who should be able to edit or view protected PDFs. Update internal documentation and helpdesk guidance as appropriate. [Compliance considerations] Question Answer Does the change alter how existing customer data is accessed or modified? Yes. Users with existing editing usage rights gain a new way to modify protected PDFs by adding annotations in the OneDrive or SharePoint web PDF viewer. Does the change preserve Information Protection label behavior? Yes. Users can annotate PDFs protected by sensitivity labels without removing the label. The sensitivity label, encryption, and usage rights are preserved when the file is saved.