Skip to main content
Draftable Clean can open and clean Word, Excel, PowerPoint and PDF files that are protected (encrypted) by a Microsoft Purview sensitivity label or Azure Rights Management. This article is for administrators deciding whether to turn the feature on, and for users who see a protected file in Draftable Clean. Key points:
  • The feature is off by default. An administrator turns it on with Group Policy, Intune or the registry.
  • Draftable Clean acts only as the signed-in user. It can open only files that user already has rights to, and Microsoft checks those rights for every file.
  • The user needs the Copy usage right (EXTRACT) on the file. The View right alone is not enough.
  • Cleaned copies are not protected. The sensitivity label and its encryption do not carry over to the cleaned file. Decide whether that is acceptable for your organization before you turn the feature on.
  • Decryption happens on the user’s computer. The file is not sent to Draftable.
Cleaning protected files requires Draftable Clean 26.11.0 or later on Windows. Cleaning protected attachments in the Outlook add-in also requires Outlook add-in 1.13.0.0 or later.

​
How it works

When you add a protected file, Draftable Clean recognizes the protection from the file’s contents, not its file name. If support is turned on, Draftable Clean signs you in to Microsoft 365 and asks Microsoft’s protection service to unlock the file for you. Microsoft checks the file’s protection and your rights. If you have the Copy right, Draftable Clean decrypts the file on your computer and then scans and cleans it like any other file. Draftable Clean does not read or apply sensitivity labels. It removes the encryption from your own working copy so that it can process the file. The original protected file is never changed.

​
What you need

​
Turning on protected file support

Two policies control the feature. Both are in the Draftable Clean administrative templates, at the top level of the Draftable Clean folder, and both work under Computer Configuration (HKLM) and User Configuration (HKCU).
1

Decide how cleaned copies may be saved

Read Saving cleaned copies of protected files and choose Warn before each export or Block export for Configure saving of files whose Purview protection was removed. If you leave it Not configured, Warn applies.
2

Turn on support

Set Enable Microsoft Purview protected file support to Enabled. If you deploy settings directly rather than through the templates, write the registry value:
Use HKCU\Software\Policies\Draftable\Clean\Feature instead to apply it per user. In Microsoft Intune, import the Draftable Clean administrative templates and configure the same settings. See Configure Draftable Clean with Group Policy and Configuring preferences with Microsoft Intune.
3

Restart Draftable Clean

Restart Draftable Clean on each computer after the policy is applied.
4

Check it works

As a user with the Copy right, add a file protected by one of your encrypting sensitivity labels. After you sign in, the file scans as normal and its shield icon reads Protected with Microsoft Purview. Decrypted for cleaning as followed by the user’s account. Then try a user who has only the View right: Draftable Clean should refuse the file with a message about sufficient rights.In Microsoft Entra ID, Monitoring & health > Sign-in logs, filter on the Draftable Legal application. The sign-in’s resource is Microsoft Rights Management Services.
When support is off, Draftable Clean still recognizes protected files but does not decrypt them. They show the message “Protected by Microsoft Purview. Protected files are not supported, so this file was not cleaned.” and the original file is left untouched.

​
Saving cleaned copies of protected files

A cleaned copy of a protected file is an ordinary, unprotected file. The original sensitivity label and its encryption do not carry over, so anyone who can reach the place the copy is saved can open it. Draftable Clean checks only the Copy right; it does not check the Save As, Export right (EXPORT). Decide whether this is acceptable before you turn the feature on.
After a protected file is decrypted, its row shows “This file was protected by Microsoft Purview. Saving or exporting will produce an unprotected copy.” What happens when you save, email or export it depends on Configure saving of files whose Purview protection was removed: Under either option, files are still decrypted, scanned and cleaned inside Draftable Clean. The policy only controls whether the unprotected result can leave the application.

​
Bundles

A cleaned copy of a protected file cannot go into a PDF or ZIP bundle, under either option. If one is selected, no bundle is created and the file shows “Protected by Microsoft Purview. A bundle cannot contain an unprotected copy.” Save that file on its own, or deselect it and create the bundle again.

​
Supported protected files

Files opened from SharePoint, OneDrive, iManage or NetDocuments are handled in the same way as local files, as long as they arrive protected. If Microsoft’s protection service declines a file, for example because it uses a protection type Draftable Clean does not support, the file shows “This file is protected by Microsoft Purview in a way Draftable Clean can’t process.”

​
Cleaning a protected file in the desktop application

  1. Add the file as usual, with Browse, drag and drop, or from a document management system.
  2. The first time you add a protected file, the row shows “Protected file (Microsoft Purview). Signing in to Microsoft 365…” and a Microsoft sign-in window opens. Sign in with your work or school account. If you have already signed in to SharePoint in Draftable Clean, that account may be used without a prompt.
  3. If your organization lets users approve apps, Microsoft may ask you to allow Draftable Legal to Create and access protected content as you. Select Accept.
  4. The file is decrypted and scanned. Clean, review and save it as normal.
Later protected files open without signing in again. If a file needs you to sign in again, its row shows a Sign in and retry button. If the file belongs to another organization, the button reads Sign in with a different account.

​
Protected attachments in the Outlook add-in

With Draftable Clean 26.11.0 or later, Outlook add-in 1.13.0.0 or later, and protected file support turned on, the add-in handles protected attachments in the same way as the desktop application:
  • Recipients that get cleaning, under Warn: protected attachments are cleaned and the cleaned, unprotected copy is attached. There is no per-file confirmation in Outlook.
  • Under Block: protected attachments are left uncleaned and stay protected.
  • Recipients covered by Skip Cleaning: protected attachments are sent as they are, still protected. If the recipients change to ones that need cleaning, the add-in cleans them.
  • Support turned off: protected attachments show Protected with the message “Protected by Microsoft Purview: not supported. The attachment will be sent as it is, still protected.”
The add-in cannot show a Microsoft sign-in window. Sign in once in the Draftable Clean desktop application, by adding any protected file there, and the add-in can then use that sign-in. When a protected attachment cannot be cleaned (support is off, Block applies, you have not signed in, or you lack the Copy right), it shows the not supported message above and is sent still protected. Your Send Protection setting for unsupported file types decides whether you are prompted or blocked before sending. See Using the Outlook add-in.

​
Microsoft 365 sign-in and approval

Opening a protected file asks Microsoft for one permission on the Draftable desktop app: Under Microsoft’s default consent settings, users can usually approve this permission themselves the first time they open a protected file. If your organization does not allow that, users see “The organisation that protected this file hasn’t approved Draftable Clean for protected files yet.” and an administrator approves the app once for everyone. If you approved Draftable Legal earlier, for SharePoint, approve it once more so that the new permission is included. The steps are in Approving Draftable Clean in Microsoft Entra.

​
Messages you may see

For more help, see Troubleshooting: Cleaning issues.

​
Temporary decrypted copies

The decrypted working copy is written to a folder under %TEMP%\Draftable in the user’s profile. Draftable Clean deletes it when you remove the file from Draftable Clean, or when the application closes. If the application does not close normally, for example because the computer loses power, a decrypted copy can be left behind. To remove leftovers, delete the folders under %TEMP%\Draftable while Draftable Clean is not running. Rights are checked when the file is opened. If the file’s rights change while it is open in Draftable Clean, the change applies the next time you open it. Draftable Clean’s usage data records only how many unprotected copies were saved and to what kind of destination. File names and labels are not included.