Guest access to protected PDF documents

Documents which have been protected with a sensitity label, can only be accessed by authorised people. As protected documents are encrypted, they can only be accessed via compatible applications under certain conditions. When sharing a protected document with an external collaborator, the following requirements must be met: 

  • Collaborator must be a guest in the UNU MS 365 tenant. 

Supported applications

Depending on the type of account the external collaborator has, they will be able to access protected documents using the following applications: 

 Adobe AcrobatMicrosoft EdgeGoogle ChromeMozilla Firefox
External guest with no associated Microsoft accountNot supportedNot supportedNot supported
External guest with a personal Microsoft accountNot supportedNot supportedNot supported
External guest with a Work or School Microsoft accountNot supportedNot supported

FYI – this table lists applications which C3 support – for a full list of applications compatible with protected documents consult this article from Microsoft.

Accessing a PDF using Adobe Acrobat

When opening a protected document via a SharePoint Online link, a message will be displayed offering to open in a browser or to download. Click on Download and save to the desktop. 

Prompt to download a protected PDF

Download the file to your desktop and navigate to the location it was saved. 

Download the document

Open the file with Adobe Acrobat. If Acrobat is not your default PDF application, right click (Windows) or control click (macOS) and select Open with Adobe Acrobat

Open the protected PDF with Adobe Acrobat

In order to access the document it is necessary to authenticate. When prompted by Acrobat enter the email ID of the account the document was shared with and click Next.

Sign in to Microsoft Purview Information Protection

Follow the prompts to complete your authentication. This process can differ depending on which MFA methods have been configured for the account. 

Authentication process

Once authentication has been completed, steps will differ if the guest account has a Work or School Microsoft Account, or a Personal or no Microsoft account.

The document will the be displayed.

Personal Microsoft account or no Microsoft account 

Once authentication has completed, when prompted to select an account, close the window by clicking the X in the upper right corner (Windows) or the red button in the upper left corner (macOS). 

Cancel the account selection

If you accidentally select your account at the prior step, an error similar to the ones below will be displayed. You can close the dialog by clicking the X in the upper right corner (Windows) or the red button in the upper left (macOS). 

No Adobe app associated with Microsoft Personal account

Work or School Microsoft Account

Depending on the settings in the external tenant, there may be a prompt to authorize the Adobe Acrobat application. Accept any prompts. Once accepted it may also be necessary to re-authenticate with the external tenant. 

Reauthenticate with external tenant.

The protected document will now be displayed. 

Protected PDF in Adobe Acrobat

Accessing a protected PDF using Microsoft Edge

You must be signed into a profile in Microsoft Edge using a Microsoft Work or School account. The profile icon in the upper left of the browser window should say Work or School. 

Work profile in MS Edge

Access the sharing link for the document and follow the onscreen prompts. 

Depending on how the link was shared, click Next or enter the email ID the document was shared with. 

Verify sharing link

When prompted to sign into the UNU tenant, enter the email ID the document was shared with. 

Sign into UNU tenant

Authenticate with your home tenant. Authentication settings will depend on settings in the external home tenant. 

Sign into the external tenant

Complete the UNU MFA requirement. 

UNU MFA requirement

When prompted click on Open in Browser.

Open the PDF in Edge

The document will now be displayed in the browser.