Microsoft OneDrive and SharePoint: Annotate sensitivity-label protected PDFs on the web

What and why Microsoft OneDrive and SharePoint on the web will support annotation for PDFs encrypted with Microsoft Purview sensitivity labels. Users who have the appropriate editing usage rights will be able to annotate protected PDFs in their browser without removing the sensitivity label. The file's sensitivity label, encryption, and usage rights will be preserved when changes are saved. Rollout schedule General Availability (Worldwide, GCC, GCC High, DoD): Beginning in late January 2027 and expected to complete in late January 2027 Impact on your organization Who is affected OneDrive for Business and SharePoint customers This feature does not apply to OneDrive Consumer. Platforms and services OneDrive for Business and SharePoint on the web All browsers are supported. What will happen Users who have editing usage rights can annotate sensitivity label-protected, encrypted PDFs in the OneDrive or SharePoint web PDF viewer. Available annotation tools include ink, highlight, free text, notes, signatures, image/shape/date stamps, bookmarks, and form fields. Users can save annotations without removing the sensitivity label. The sensitivity label, encryption, and usage rights are preserved when the annotated PDF is saved. Users with view-only rights will continue to see the PDF as read-only and cannot annotate. This change does not grant users additional access or editing rights. No feature-specific admin control or configuration is required. Existing sensitivity label and usage-rights settings determine who can view or edit protected PDFs. Action required and recommendations No feature-specific admin action is required to enable this update. We recommend that you: Inform users who routinely review labeled or regulated documents that they can annotate protected PDFs in place. Confirm that your sensitivity label and usage-rights configuration reflects who should be able to edit or view protected PDFs. Update internal documentation and helpdesk guidance as appropriate. Compliance considerations Question Answer Does the change alter how existing customer data is accessed or modified? Yes. Users with existing editing usage rights gain a new way to modify protected PDFs by adding annotations in the OneDrive or SharePoint web PDF viewer. Does the change preserve Information Protection label behavior? Yes. Users can annotate PDFs protected by sensitivity labels without removing the label. The sensitivity label, encryption, and usage rights are preserved when the file is saved.