When you open an Excel file protected by a Microsoft Purview Information Protection sensitivity label, Copilot may behave differently than it does on unlabeled files. Copilot cannot read, summarize, or generate content from cells that are restricted by a label that applies encryption or permissions. This article explains exactly what happens when you try to use Copilot on a labeled Excel workbook and why the restriction occurs. You will learn how to identify which label is blocking Copilot, what error messages to expect, and how to work around the limitation.
Key Takeaways: Copilot Behavior on Sensitivity-Labeled Excel Files
- Microsoft Purview compliance portal > Sensitivity labels > Encryption settings: Labels configured with “Assign permissions now” or “Let users assign permissions” block Copilot from reading cell data.
- Copilot pane in Excel > Error message “Copilot can’t work with this file”: Indicates the file has an encryption-based sensitivity label that prevents Copilot from accessing content.
- Excel > File > Info > Sensitivity button: Shows the current label applied to the workbook. Clicking the label opens a description of its permissions.
Why Sensitivity Labels Restrict Copilot in Excel
Sensitivity labels in Microsoft 365 can apply encryption, usage rights, and access restrictions to files. When a label is set to “Encrypt file and email” and uses the “Assign permissions now” or “Let users assign permissions” option, the file is protected by Azure Rights Management. Copilot, as a Microsoft 365 service, must respect these permissions. If the label grants only read or limited edit rights but does not explicitly grant the service the right to extract data programmatically, Copilot cannot read the cell contents. The Copilot engine requires at least the “Extract” usage right, which is often not included in labels that restrict printing, copying, or forwarding. Labels that are configured for “Do not forward” or “Encrypt only” also block Copilot. The restriction applies to both the desktop version of Excel and Excel for the web. Copilot can still perform actions that do not require reading cell data, such as formatting suggestions or inserting charts from a selected range, but any prompt that asks it to summarize, analyze, or rewrite content will fail.
How Encryption Rights Map to Copilot Access
Azure Rights Management defines usage rights such as View, Edit, Copy, Extract, and Save. Copilot needs the Extract right to read cell values. If a label grants only View and Edit, Copilot cannot access the data. Labels that use the “Let users assign permissions” option often grant only View and Reply, which again blocks Copilot. Labels configured for “Do not forward” grant View, Edit, Copy, and Save but not Extract. The result is that Copilot sees the file as empty or inaccessible. The Copilot pane displays a clear error message: “Copilot can’t work with this file. The sensitivity label on this file restricts Copilot from accessing its content.”
Steps to Check and Work With Sensitivity Labels Blocking Copilot
- Identify the applied label
Open the labeled workbook in Excel. Go to File > Info. Locate the Sensitivity button in the top section. Click the button to see the label name and a brief description. Note whether the description includes phrases like “Encrypted” or “Permissions are required.” - Check label configuration in the Microsoft Purview compliance portal
Sign in to the Microsoft Purview compliance portal as a compliance administrator or global administrator. Navigate to Information protection > Sensitivity labels. Find the label applied to your file and click it. Under Encryption, look for the setting “Assign permissions now” or “Let users assign permissions.” If either is selected, Copilot is blocked. Labels set to “None” or “Encrypt file and email (Do not forward)” also block Copilot. - Request a label change from the file owner or compliance admin
If you need Copilot to work on the file, ask the label owner to either remove encryption from the label or create a new label that does not restrict data extraction. The label must be set to “Encrypt file and email” with the setting “Let users assign permissions” unchecked, or set to “None” under encryption. Only labels that do not enforce encryption allow Copilot full access. - Use a copy without the label for Copilot work
If you have sufficient rights, save a copy of the file without the sensitivity label. In Excel, go to File > Save As. Choose a new file name. Before saving, click the Sensitivity button and select a label that does not apply encryption, such as “General” or “Internal.” Save the new file and open it. Copilot will now work normally. - Test Copilot on the unlabeled copy
With the new copy open, open the Copilot pane from the Home tab. Type a prompt such as “Summarize this sheet.” Copilot should respond with a summary of the data. If it still fails, confirm that the file is not inheriting a label from a parent container such as a SharePoint site or a Teams team. Check the Sensitivity button again on the unlabeled copy.
What Still Works and What Breaks on Labeled Files
Copilot Returns Generic Output Instead of Tenant-Specific Data
When Copilot cannot read encrypted cells, it may return a generic message like “I can’t access the data in this file.” No data analysis or content generation is possible. The Copilot pane remains open, but all prompts related to the worksheet content fail. Formatting suggestions that do not require reading data, such as “Highlight the header row,” may still work because they apply to the structure rather than the values. However, most business users rely on Copilot for data analysis, so this limitation is significant.
Copilot in Excel for the Web Shows the Same Restriction
The restriction is not limited to the desktop app. Excel for the web also respects sensitivity labels and blocks Copilot on encrypted files. The error message appears in the same way. The web version cannot bypass the label. Users must follow the same workaround of saving an unlabeled copy.
Labels Applied via Auto-Labeling or Default Labeling
If your organization uses auto-labeling policies or default labeling for SharePoint and OneDrive, files may be labeled without user awareness. Copilot will still be blocked even if the user did not manually apply the label. Check the Sensitivity button in the file to see the label. If you believe the label is applied incorrectly, contact your compliance team to adjust the policy.
Copilot Behavior on Labeled vs Unlabeled Excel Files
| Item | Labeled File With Encryption | Unlabeled or Non-Encrypted Label |
|---|---|---|
| Copilot data access | Blocked — cannot read cell values | Full access to read and summarize data |
| Error message | “Copilot can’t work with this file” with explanation about sensitivity label | No error; Copilot responds normally |
| Formatting suggestions | May work if they do not require reading cell content | All suggestions work |
| Workaround available | Save an unlabeled copy or request label change | No workaround needed |
| Applies to desktop and web | Yes, both versions | Both versions work |
If you work in an organization that enforces sensitivity labels on Excel files, you now know exactly how Copilot behaves on restricted content. The key step is to check the label encryption settings in the Microsoft Purview compliance portal. For files you need to analyze with Copilot, request a label that does not include encryption or save a copy without the label. Remember that even if a label appears to allow editing, it may still block the Extract right that Copilot requires. Always test Copilot on a small unlabeled sample before relying on it for critical data analysis.