> ## Documentation Index
> Fetch the complete documentation index at: https://help.draftable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cleaning files protected by Microsoft Purview

> How Draftable Clean opens and cleans files protected by Microsoft Purview sensitivity labels: turning support on, the rights users need, saving unprotected copies, the Outlook add-in and the messages users may see.

Draftable Clean can open and clean Word, Excel, PowerPoint and PDF files that are protected (encrypted) by a Microsoft Purview sensitivity label or Azure Rights Management. This article is for administrators deciding whether to turn the feature on, and for users who see a protected file in Draftable Clean.

**Key points:**

* The feature is **off by default**. An administrator turns it on with Group Policy, Intune or the registry.
* Draftable Clean acts only as the **signed-in user**. It can open only files that user already has rights to, and Microsoft checks those rights for every file.
* The user needs the **Copy** usage right (`EXTRACT`) on the file. The **View** right alone is not enough.
* **Cleaned copies are not protected.** The sensitivity label and its encryption do not carry over to the cleaned file. Decide whether that is acceptable for your organization before you turn the feature on.
* Decryption happens **on the user's computer**. The file is not sent to Draftable.

> [!NOTE]
>
> Cleaning protected files requires **Draftable Clean 26.11.0 or later** on Windows. Cleaning protected attachments in the Outlook add-in also requires **Outlook add-in 1.13.0.0 or later**.

## How it works

When you add a protected file, Draftable Clean recognizes the protection from the file's contents, not its file name. If support is turned on, Draftable Clean signs you in to Microsoft 365 and asks Microsoft's protection service to unlock the file for you. Microsoft checks the file's protection and your rights. If you have the Copy right, Draftable Clean decrypts the file on your computer and then scans and cleans it like any other file.

Draftable Clean does not read or apply sensitivity labels. It removes the encryption from your own working copy so that it can process the file. **The original protected file is never changed.**

## What you need

| Requirement | Details |
| - | - |
| **Version** | Draftable Clean 26.11.0 or later, on Windows |
| **Support turned on** | **Enable Microsoft Purview protected file support** set to **Enabled**. See [Turning on protected file support](#turning-on-protected-file-support) |
| **A work or school account** | You sign in with your Microsoft 365 work or school account. Personal Microsoft accounts (such as outlook.com, hotmail.com or live.com) are not accepted |
| **Your organization's approval** | The Draftable desktop app, shown in Microsoft Entra ID as **Draftable Legal**, needs one Microsoft permission: **Create and access protected content for users** (Azure Rights Management Services). See [Microsoft 365 sign-in and approval](#microsoft-365-sign-in-and-approval) |
| **The Copy usage right** | You need the Copy right (`EXTRACT`) on the file, shown in label settings as **Copy and extract content**. Rights come from the sensitivity label, the protection template, or the person who protected the file. The **Editor** (formerly Co-Author) and **Owner** (formerly Co-Owner) permission levels include it; **Viewer** and **Restricted Editor** (formerly Reviewer) do not |
| **Network access** | Your computer must reach Microsoft's sign-in and protection services when the file is opened. See [Network requirements](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Network-Requirements.md#microsoft-purview-protected-files) |

## Turning on protected file support

Two policies control the feature. Both are in the Draftable Clean administrative templates, at the top level of the **Draftable Clean** folder, and both work under **Computer Configuration** (`HKLM`) and **User Configuration** (`HKCU`).

| Group Policy setting | Registry value (under `Software\Policies\Draftable\Clean\Feature`) | Values |
| - | - | - |
| **Enable Microsoft Purview protected file support** | `MipEnabled` (`REG_DWORD`) | `1` on, `0` off. Not configured means off |
| **Configure saving of files whose Purview protection was removed** | `MipSaveBehavior` (`REG_SZ`) | `Warn` or `Block`. Not configured means `Warn` |

**1. Decide how cleaned copies may be saved**

Read [Saving cleaned copies of protected files](#saving-cleaned-copies-of-protected-files) and choose **Warn before each export** or **Block export** for **Configure saving of files whose Purview protection was removed**. If you leave it Not configured, Warn applies.

**2. Turn on support**

Set **Enable Microsoft Purview protected file support** to **Enabled**. If you deploy settings directly rather than through the templates, write the registry value:

```bash theme={null}
Key: HKLM\Software\Policies\Draftable\Clean\Feature
Value name: MipEnabled
Value type: REG_DWORD
Value data: 1
```

Use `HKCU\Software\Policies\Draftable\Clean\Feature` instead to apply it per user. In Microsoft Intune, import the Draftable Clean administrative templates and configure the same settings. See [Configure Draftable Clean with Group Policy](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Configuring-preferences-with-Group-Policy-Draftable-Clean.md#available-policy-settings) and [Configuring preferences with Microsoft Intune](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Configuring-preferences-with-Microsoft-Intune-Draftable-Clean.md).

**3. Restart Draftable Clean**

Restart Draftable Clean on each computer after the policy is applied.

**4. Check it works**

As a user with the Copy right, add a file protected by one of your encrypting sensitivity labels. After you sign in, the file scans as normal and its shield icon reads **Protected with Microsoft Purview. Decrypted for cleaning as** followed by the user's account. Then try a user who has only the View right: Draftable Clean should refuse the file with a message about sufficient rights.

In Microsoft Entra ID, **Monitoring & health > Sign-in logs**, filter on the **Draftable Legal** application. The sign-in's resource is Microsoft Rights Management Services.

When support is **off**, Draftable Clean still recognizes protected files but does not decrypt them. They show the message **"Protected by Microsoft Purview. Protected files are not supported, so this file was not cleaned."** and the original file is left untouched.

## Saving cleaned copies of protected files

> [!WARNING]
>
> A cleaned copy of a protected file is an ordinary, **unprotected** file. The original sensitivity label and its encryption do not carry over, so anyone who can reach the place the copy is saved can open it. Draftable Clean checks only the Copy right; it does not check the Save As, Export right (`EXPORT`). Decide whether this is acceptable before you turn the feature on.

After a protected file is decrypted, its row shows **"This file was protected by Microsoft Purview. Saving or exporting will produce an unprotected copy."** What happens when you save, email or export it depends on **Configure saving of files whose Purview protection was removed**:

| Option | What users see |
| - | - |
| **Warn before each export** (default) | Before every save or export of a cleaned copy of a protected file, Draftable Clean asks **Remove Microsoft Purview protection?** The message names the destination (your computer, an email, SharePoint, iManage, NetDocuments or Epona 365), warns that anyone who can reach it will be able to open the copy, lists the files, and confirms that the original files are unchanged. Select **Save unprotected copy** (or **Save unprotected copies** for several files) to continue, or **Cancel** |
| **Block export** | Draftable Clean refuses to save or export cleaned copies of protected files, with the message **"Protected by Microsoft Purview. Your organisation does not allow saving unprotected copies."** Other files in the same selection are still saved. If you are creating an email, the whole email is refused |

Under either option, files are still decrypted, scanned and cleaned inside Draftable Clean. The policy only controls whether the unprotected result can leave the application.

### Bundles

A cleaned copy of a protected file cannot go into a PDF or ZIP bundle, under either option. If one is selected, no bundle is created and the file shows **"Protected by Microsoft Purview. A bundle cannot contain an unprotected copy."** Save that file on its own, or deselect it and create the bundle again.

## Supported protected files

| File | Supported? |
| - | - |
| Word, Excel and PowerPoint files (`.docx`, `.xlsx`, `.pptx`) protected by a sensitivity label or Azure Rights Management | Yes |
| PDF files protected by a sensitivity label or Azure Rights Management | Yes |
| Protected files in older Office formats (`.doc`, `.xls`, `.ppt`) | No |
| Files in a generic protected wrapper (`.pfile`, for example `report.pdf.pfile`) | No |
| Protected emails (`.msg`, `.rpmsg`) | No |
| Word and PDF files protected with a password (not Purview) | Not part of this feature. Draftable Clean asks for the password, as described in [Supported file types](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Supported-file-types.md#password-protected-files) |

Files opened from SharePoint, OneDrive, iManage or NetDocuments are handled in the same way as local files, as long as they arrive protected. If Microsoft's protection service declines a file, for example because it uses a protection type Draftable Clean does not support, the file shows **"This file is protected by Microsoft Purview in a way Draftable Clean can't process."**

## Cleaning a protected file in the desktop application

1. Add the file as usual, with **Browse**, drag and drop, or from a document management system.
2. The first time you add a protected file, the row shows **"Protected file (Microsoft Purview). Signing in to Microsoft 365…"** and a Microsoft sign-in window opens. Sign in with your work or school account. If you have already signed in to SharePoint in Draftable Clean, that account may be used without a prompt.
3. If your organization lets users approve apps, Microsoft may ask you to allow **Draftable Legal** to **Create and access protected content as you**. Select **Accept**.
4. The file is decrypted and scanned. Clean, review and save it as normal.

Later protected files open without signing in again. If a file needs you to sign in again, its row shows a **Sign in and retry** button. If the file belongs to another organization, the button reads **Sign in with a different account**.

## Protected attachments in the Outlook add-in

With **Draftable Clean 26.11.0 or later**, **Outlook add-in 1.13.0.0 or later**, and protected file support turned on, the add-in handles protected attachments in the same way as the desktop application:

* **Recipients that get cleaning, under Warn:** protected attachments are cleaned and the cleaned, unprotected copy is attached. There is no per-file confirmation in Outlook.
* **Under Block:** protected attachments are left uncleaned and stay protected.
* **Recipients covered by Skip Cleaning:** protected attachments are sent as they are, still protected. If the recipients change to ones that need cleaning, the add-in cleans them.
* **Support turned off:** protected attachments show **Protected** with the message **"Protected by Microsoft Purview: not supported. The attachment will be sent as it is, still protected."**

The add-in cannot show a Microsoft sign-in window. Sign in once in the Draftable Clean desktop application, by adding any protected file there, and the add-in can then use that sign-in.

When a protected attachment cannot be cleaned (support is off, Block applies, you have not signed in, or you lack the Copy right), it shows the **not supported** message above and is sent still protected. Your **Send Protection** setting for unsupported file types decides whether you are prompted or blocked before sending. See [Using the Outlook add-in](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Using-the-Outlook-Add-in.md#files-protected-by-microsoft-purview).

## Microsoft 365 sign-in and approval

Opening a protected file asks Microsoft for one permission on the Draftable desktop app:

| Detail | Value |
| - | - |
| App name shown in Microsoft Entra ID | **Draftable Legal** (publisher Draftable, verified). The same app is used for SharePoint and OneDrive |
| Application (client) ID | `6c0ba8ea-12a2-4cae-82e7-857cda5862e9` |
| Permission | Azure Rights Management Services `user_impersonation`: **Create and access protected content for users** |

Under Microsoft's default consent settings, users can usually approve this permission themselves the first time they open a protected file. If your organization does not allow that, users see **"The organisation that protected this file hasn't approved Draftable Clean for protected files yet."** and an administrator approves the app once for everyone.

If you approved **Draftable Legal** earlier, for SharePoint, approve it once more so that the new permission is included. The steps are in [Approving Draftable Clean in Microsoft Entra](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Draftable-Clean-and-Microsoft-Entra.md#protected-files-microsoft-purview).

## Messages you may see

| Message | What it means |
| - | - |
| Protected by Microsoft Purview. Protected files are not supported, so this file was not cleaned. | Protected file support is turned off. Ask your administrator |
| Protected file (Microsoft Purview). Signing in to Microsoft 365… | Draftable Clean is signing you in so that it can open the file |
| This file is protected by Microsoft Purview. Sign in with your Microsoft 365 account to clean it. | You are not signed in, cancelled the sign-in, or signed in with a personal account. Select **Sign in and retry** |
| The organisation that protected this file hasn't approved Draftable Clean for protected files yet. Ask that organisation's Microsoft 365 administrator to grant access, then try again. | The approval for **Draftable Legal** is missing. Signing in again will not help; an administrator needs to approve it |
| You don't have sufficient rights to clean this protected file. (Sometimes followed by **Its owner is** and a name.) | You do not have the Copy right on the file. Ask the file's owner or your administrator for a permission level that includes it |
| This file is protected by another organisation. Sign in with an account that has access, or ask the organisation that shared it to add your account. | You are signed in with an account from a different organization than the one that protected the file. Select **Sign in with a different account** |
| Couldn't reach the Microsoft protection service. Check your connection and try again. | Draftable Clean could not reach Microsoft's protection service. This also appears if Rights Management is turned off for your tenant, or if your organization's own encryption key is unavailable |
| This file is protected by Microsoft Purview in a way Draftable Clean can't process. | Microsoft's protection service declined the file, for example because it uses an unsupported protection type |
| This file was protected by Microsoft Purview. Saving or exporting will produce an unprotected copy. | The file was decrypted. Its cleaned copy will be unprotected |
| Protected by Microsoft Purview. Your organisation does not allow saving unprotected copies. | **Configure saving of files whose Purview protection was removed** is set to **Block export**. This is by design |
| Protected by Microsoft Purview. A bundle cannot contain an unprotected copy. | Cleaned protected files cannot go into a PDF or ZIP bundle. Save the file on its own |

For more help, see [Troubleshooting: Cleaning issues](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Troubleshooting-Cleaning-Issues.md#files-protected-by-microsoft-purview).

## Temporary decrypted copies

The decrypted working copy is written to a folder under `%TEMP%\Draftable` in the user's profile. Draftable Clean deletes it when you remove the file from Draftable Clean, or when the application closes. If the application does not close normally, for example because the computer loses power, a decrypted copy can be left behind. To remove leftovers, delete the folders under `%TEMP%\Draftable` while Draftable Clean is not running.

Rights are checked when the file is opened. If the file's rights change while it is open in Draftable Clean, the change applies the next time you open it.

Draftable Clean's usage data records only how many unprotected copies were saved and to what kind of destination. File names and labels are not included.

## Related articles

* [Configure Draftable Clean with Group Policy](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Configuring-preferences-with-Group-Policy-Draftable-Clean.md)
* [Approving Draftable Clean in Microsoft Entra](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Draftable-Clean-and-Microsoft-Entra.md)
* [Supported file types](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Supported-file-types.md)
* [Using the Outlook add-in](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Using-the-Outlook-Add-in.md)
* [Troubleshooting: Cleaning issues](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Troubleshooting-Cleaning-Issues.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.