🔹 Feature: Extended SharePoint Permissions (ESP)
🔹 What It Does: Your SharePoint permissions — extended everywhere. Lose access in SharePoint, and the downloaded file won’t open anymore. Anywhere.
💡 Thesis: The perimeter follows the file, not the other way around.
What is it giving you:
✅ Permissions That Travel: SharePoint site permissions are automatically applied to files when downloaded, copied, or moved off the site — no manual labeling required.
✅ Just-in-Time Protection: If permissions are revoked, the file is deleted, the site goes inactive, or the file is moved — the downloaded copy stops opening. Instantly.
✅ Live Permission Sync: Change a user’s SharePoint access and the change reflects immediately on every downloaded copy of the file.
✅ Move/Copy Lockdown: Files can’t be moved or copied to a different site. Within the same site only if the user has list create/delete rights.
✅ Zero-Effort Rollout: Applies to unlabeled files and files with non-encrypting labels — perfect for organizations early in their labeling journey.
✅ Permission Mapping Built-In: SharePoint Owner/Edit/Read maps directly to RMS usage rights (Owner/Editor/Viewer) — no custom rights policies to design.
⚠️ Worth knowing:
Requires Microsoft 365 Apps 2402+ (Current/Monthly Enterprise/Semi-Annual)
Files won’t open offline — connection to the original site is required
Copilot can reference but not summarize ESP-protected files
Mutually exclusive with default labels that don’t apply encryption
Enabled per-tenant via: Set-SPOTenant -ExtendPermissionsToUnprotectedFiles $true
🌐 https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-extend-permissions
