SharePoint finally delivered something many of us have wished existed for years.
Until now, the moment a file was downloaded, all your site controls stopped mattering; people could do whatever they wanted with it. It’s been a long-standing headache for every organization!
ESP closes that gap completely. Site permissions now travel with documents even after they’re downloaded. Yes, the access you set in SharePoint stays in place, even outside the site.
Let me explain it better below:
- If your document library uses a sensitivity label, downloaded files automatically inherit the same access you had in SharePoint.
- If someone didn’t have access to the site, they still can’t open the file, no matter where it goes.
- If permissions change later (user removed, site deleted, access downgraded), the downloaded file stops opening!
- Files can’t be freely copied, moved across sites, or stripped of protection.
- Unlabeled or unencrypted files get labeled automatically, so protection becomes the default, not an afterthought.
There are limits (no offline access, Save As restrictions, encryption rules), but the takeaway is simple: your permissions don’t stop at the edge of SharePoint anymore.
I just hope this doesn’t become another overlooked feature — make sure your teams know about it and actually put it to use.