PDF annotation for sensitivity-label protected PDFs in the OneDrive apps (iOS and Android)

OneDrive apps for iOS and Android will soon allow users with editing rights to annotate sensitivity-label protected PDFs directly on mobile, maintaining encryption and label protection. The feature rolls out globally from mid to late August 2026, requires no admin action, and enhances mobile productivity without compromising security.

[What and Why:]

We’re enabling PDF annotation for sensitivity-label protected PDFs in the OneDrive apps for iOS and Android. Today, when a PDF carries a sensitivity label that applies encryption, annotation tools are unavailable and users must open the file in a separate desktop application to mark it up. With this update, users who have the appropriate usage rights can annotate these protected PDFs directly on their mobile device. The annotation pipeline decrypts the file locally in the client, applies the markup, and re-encrypts it under the original label—helping maintain security while improving mobile productivity.

This message applies to the Microsoft OneDrive apps for iOS and Android. It does not apply to OneDrive or SharePoint on the web.

This message is associated with Roadmap ID 566697.

[Rollout Schedule:]

• General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out in mid-August 2026 and expect to complete by late August 2026.
• Note: This is a gradual rollout, so not all users will see the feature at the same time.

[Impact on Your Organization:]

Who is affected: Users who open sensitivity-label protected PDFs and whose usage rights permit editing.

Platforms/Services: Microsoft OneDrive apps for iOS and Android (not available in OneDrive or SharePoint on the web).

What will happen:

• Users can annotate encrypted, sensitivity-label protected PDFs directly within the OneDrive mobile apps.
• Annotation tools include ink, highlight, free text, notes, signatures, image/shape/date stamps, bookmarks, and form fields.
• Annotate without stripping protection: Users no longer need to remove the label or open a separate application.
• The sensitivity label, encryption, and usage rights remain intact after saving annotated files.
• Users with view-only permissions will continue to see the file as read-only and cannot annotate.
• The feature is enabled by default for eligible users; no opt-in is required.
• Annotation honors existing Microsoft Purview sensitivity labels and usage rights; no new admin controls are introduced.

[Action Required/Recommendations:]

No admin action is required before rollout. You may want to:

• Inform users—especially those who review labeled or regulated documents—that they can now annotate protected PDFs on mobile devices.
• Confirm your sensitivity label and usage-rights configuration aligns with your organization’s editing and viewing policies.
• Update internal documentation and helpdesk guidance for handling protected PDFs.

Learn more: Features available for PDFs in OneDrive in Web and mobiles/iPads - SharePoint in Microsoft 365 | Microsoft Learn

[Compliance considerations:]

No compliance considerations identified, review as appropriate for your organization.