Conditional Access

Question

Conditional Access

PHILIP EZE 0

When emails with file attachments are sent with do not forward option the, receivers within or organization cannot see the content of the files whereas another receiver outside the organization can view the content of the file attachment.

SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-08-27T17:15:07.5933333+00:00

Hi @PHILIP EZE ,

Thank you for reaching out to the Microsoft Q&A forum.

When an email is sent using the "Do Not Forward" option, Microsoft Purview Information Protection applies encryption and usage rights to the email and supported attachments. Access to the protected content depends on the recipient successfully obtaining a usage license and meeting the organization's protection requirements.

Based on the information provided, we cannot yet confirm that Conditional Access is the root cause. If external recipients can open the attachment while internal users cannot, the issue could be related to:

Conditional Access policies

Microsoft Purview Information Protection or Azure Rights Management configuration

User permissions on the protected content

Authentication or licensing issues

Outlook client-specific issues

To investigate further, could you please provide the following details:

What type of file attachment is affected (Word, Excel, PowerPoint, PDF, etc.)?

What exact error message do the internal users receive when opening the attachment?

Are all internal users affected or only specific users?

Can the affected users open other protected emails or attachments?

Are the users accessing the content through Outlook Desktop, Outlook on the Web, or another client?

Have you reviewed the Microsoft Entra ID sign-in logs for the affected users and checked for any Conditional Access policy failures?

If available, please share:

A screenshot of the error message

The affected user's email address (via private message)

Relevant sign-in log details

Whether Microsoft Purview Information Protection/Azure Rights Management is enabled in your tenant

Once these details are available, we can determine whether the issue is related to Conditional Access, Information Protection policies, user permissions, or another authentication-related restriction.

Please share the requested information via private message if it contains sensitive data, and we will be happy to assist further.
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-08-31T10:01:16.3066667+00:00

Hi @PHILIP EZE ,

I hope the information provided has been helpful. If you have any further questions or need additional assistance, please let us know in the comments, and we will be glad to help. If this answer helps, please consider clicking Accept Answer so that other community members with similar questions can benefit as well.
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-09-01T16:02:50.2866667+00:00

Hi @PHILIP EZE ,

I hope the information provided has been helpful. If you have any further questions or need additional assistance, please let us know in the comments, and we will be glad to help. If this answer helps, please consider clicking Accept Answer so that other community members with similar questions can benefit as well.

1 answer

Your answer

SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-08-31T10:01:16.3066667+00:00

Hi @PHILIP EZE ,

I hope the information provided has been helpful. If you have any further questions or need additional assistance, please let us know in the comments, and we will be glad to help. If this answer helps, please consider clicking Accept Answer so that other community members with similar questions can benefit as well.
SIVASANKAR YEDDULA 165 Reputation points Microsoft External Staff Moderator

2026-09-01T16:02:50.2866667+00:00

Hi @PHILIP EZE ,

I hope the information provided has been helpful. If you have any further questions or need additional assistance, please let us know in the comments, and we will be glad to help. If this answer helps, please consider clicking Accept Answer so that other community members with similar questions can benefit as well.

Answer 1

Welcome to Microsoft Q&A!

@PHILIP EZE I hope you are doing well,

When an email is sent with the "Do Not Forward" restriction, Microsoft Purview Information Protection (Azure Rights Management) encrypts both the email body and Office file attachments, binding access permissions strictly to the recipient's authenticated identity.

If external users can open the attachment but internal users cannot, the issue is caused by tenant-level access restrictions or account mismatch affecting internal accounts:

A Conditional Access (CA) policy in your tenant may be enforcing restrictions on internal users trying to acquire the decryption license:

Targeted App: Check policies scoped to Microsoft Azure Information Protection or Office 365 Exchange Online.
Common Blockers: Policies requiring compliant/hybrid-joined devices, trusted IP locations, or specific client apps can block the decryption handshake for internal users while external users bypass your tenant's CA policies.
Check: In Microsoft Entra ID > Sign-in logs, review the internal user's sign-ins under the User sign-ins (non-interactive) tab and check the Conditional Access tab to identify failing policies.

References:

How Conditional Access works with Azure Information Protection

Configure and manage Do Not Forward option for emails

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.