> ## Documentation Index
> Fetch the complete documentation index at: https://help.draftable.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Comparing Microsoft Purview protected files

> Enable sensitivity-label support in Draftable Legal and Business, check Microsoft 365 permissions, and understand how protection changes in comparison output.

Draftable Legal and Draftable Business can compare Word, Excel, PowerPoint and PDF files encrypted by Microsoft Purview sensitivity labels or Azure Rights Management. Protected-file support is off by default; ask your administrator to enable it before you use it.

> [!WARNING]
>
> Comparison output is **unprotected**. The original file's sensitivity label and encryption do not carry over to a redline or export. Decide whether this is acceptable for your organization before enabling the feature, and protect the output appropriately before sharing it.

## What you need

* **Draftable Legal or Business 26.10.2 or later** on Windows.
* **Enable Microsoft Purview protected file support** turned on by your administrator. It is off by default.
* A Microsoft 365 **work or school account** with the **Copy / Extract** usage right (`EXTRACT`) on the file. Being able to view the file is not enough. Personal Microsoft accounts are not supported for this feature.
* Approval for Draftable to access protected content in Microsoft 365, and network access to Microsoft's sign-in and protection services. See [Microsoft 365 sign-in and approval](#microsoft-365-sign-in-and-approval).

Your existing product's comparison types and output options still apply. Turning on protected-file support does not unlock Legal-only outputs in Draftable Business.

## How it works

When you select a protected file, Draftable identifies the protection from the file's contents. It signs you in to Microsoft 365 when needed, checks your rights through Microsoft's protection service, and decrypts a temporary working copy on your computer. That copy passes through the normal comparison process.

The original protected file is unchanged. Draftable does not upload the document to Draftable's servers, and it does not grant access beyond the signed-in user's rights.

Draftable checks the **Extract** right before decrypting. It does not require the separate **Export** right for this check. It does not apply the original label or encryption to the comparison result: saved redlines and exported comparison outputs are ordinary, unprotected files.

## Turn on protected file support

Use the [Draftable Legal Group Policy templates](https://help.draftable.com/hc/en-us/articles/18763487262105-Configuring-settings-with-Group-Policy-Draftable-Legal.md) or deploy the registry setting directly.

| Setting | Value |
| - | - |
| Group Policy display name | **Enable Microsoft Purview protected file support** |
| Policy identifier | `Desktop_MipEnabled` |
| Registry namespace | `Software\Policies\Draftable\Feature` |
| Registry value | `MipEnabled` (`REG_DWORD`) |
| Enabled | `1` |
| Disabled | `0`; support is off |
| Not configured | Off by default |

The policy is in the **Draftable Legal** administrative templates and supports both **Computer Configuration** and **User Configuration**. The same registry setting is read by Draftable Business.

**1. Review the output behavior**

Confirm that your organization permits creating unprotected comparison outputs from protected documents. Ensure users know where those outputs may be saved and shared.

**2. Enable the policy**

Set **Enable Microsoft Purview protected file support** to **Enabled**. For direct registry deployment, use:

```bash theme={null}
Key: HKLM:\Software\Policies\Draftable\Feature
Value name: MipEnabled
Value type: REG_DWORD
Value data: 1
```

Use `HKCU:\Software\Policies\Draftable\Feature` for a per-user policy. User policy takes precedence over computer policy. For Intune deployment, see [Enterprise configuration with Group Policy and Microsoft Intune](https://help.draftable.com/hc/en-us/articles/27925463968793-Draftable-Legal-Enterprise-Configuration-with-Group-Policy-and-MS-Intune.md).

**3. Test with an authorized user**

Open Draftable and select a protected document as an input. Sign in with a work or school account that has the Extract right, then compare it. Check that the result opens and that the user understands it is unprotected.

To make sure protected-file support stays off for everyone in your organization, set the policy to **Disabled** rather than leaving it not configured.

When support is off, Draftable does not decrypt the protected content. A comparison may fail with **An error occurred while processing the file** rather than a specific Purview message. Ask your administrator to check the policy before retrying.

## Supported protected files

| File format | Protected-file support |
| - | - |
| Word (`.docx`), Excel (`.xlsx`) and PowerPoint (`.pptx`) | Supported |
| PDF (`.pdf`) | Supported |
| Generic protected wrappers (`.pfile`) | Not supported by this feature |

Password-protected files use the normal password workflow; Microsoft 365 sign-in does not replace the password. A sensitivity label that does not encrypt a document does not require this decryption feature.

## Microsoft 365 sign-in and approval

The default desktop application registration is shared with Draftable's SharePoint integration:

| Detail | Value |
| - | - |
| Application name in Microsoft Entra ID | **Draftable Legal** |
| Application (client) ID | `6c0ba8ea-12a2-4cae-82e7-857cda5862e9` |
| Permission for protected files | Azure Rights Management Services **Create and access protected content for users** (`user_impersonation`) |

The protected-file sign-in requests this Rights Management permission. It does not request SharePoint file access or permission to read your label policies as part of opening a protected file.

If your organization's consent settings prevent users approving access, a Microsoft 365 administrator must approve the application. Earlier approval for SharePoint may not include the Rights Management permission. The [protected-file approval instructions](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Draftable-Clean-and-Microsoft-Entra.md#protected-files-microsoft-purview) use this same **Draftable Legal** desktop application registration, even though that guide is in the Clean section.

## Compare a protected file

**1. Select the documents**

Add the older and newer files as you normally would. You can compare a protected file with another protected file or with an unprotected file.

**2. Sign in if prompted**

Use your Microsoft 365 work or school account. Draftable may use an existing sign-in without another prompt. If the file belongs to another organization, use an account that has access to that organization's file.

**3. Run and review the comparison**

Choose your comparison type and run the comparison as usual. The protected input is decrypted for processing; the original remains protected.

**4. Save with care**

Save or export the result using the normal output options. The comparison output does not retain the original sensitivity label or encryption.

## Messages you may see

| Message | What to do |
| - | - |
| **An error occurred while processing the file** | For a protected file, first ask your administrator whether protected-file support is enabled. This general error can also have other causes |
| **This file is protected by Microsoft Purview. Sign in with your Microsoft 365 account to compare it.** | Sign in with a work or school account that has access |
| **You don't have sufficient rights to compare this protected file.** | Ask the file owner or administrator for the Extract right; View alone is insufficient |
| **The organisation that protected this file hasn't approved Draftable for protected files yet.** | Ask that organization's Microsoft 365 administrator to grant access. Signing in again does not supply the missing approval |
| **This file is protected by another organisation.** | Use **Sign in with a different account**, or ask the organization that shared the file to grant your account access |
| **Couldn't reach the Microsoft protection service. Check your connection and try again.** | Check connectivity to Microsoft's services and retry |
| **This protected file can't be opened by Draftable.** | The file may use an unsupported protection type. Contact [support@draftable.com](mailto:support@draftable.com) for help |

## Related articles

* [Configure settings with Group Policy](https://help.draftable.com/hc/en-us/articles/18763487262105-Configuring-settings-with-Group-Policy-Draftable-Legal.md)
* [Common registry configurations](https://help.draftable.com/hc/en-us/articles/24732245077401-Most-common-Draftable-Legal-registry-configurations.md)
* [Cleaning files protected by Microsoft Purview](https://help.draftable.com/hc/en-us/Draftable-Clean-articles/Cleaning-files-protected-by-Microsoft-Purview.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.