Getting office document permissions sharing restrictions editing right is the difference between a smoothly collaborative team and a chaotic free-for-all where anyone can overwrite anything. Whether you need to lock a contract with a password, force reviewers into track-changes mode, or share a OneDrive file with view-only access, Microsoft Office gives you a layered permission matrix — once you know where to look. This guide walks through every control, in plain English.
Why Office Document Permissions Matter for Teams
Uncontrolled editing is a genuine risk. A stray keystroke can delete a clause from a legal agreement, and an unrestricted share link can expose confidential salary data to the wrong inbox. Microsoft’s own research consistently shows that most accidental data exposure inside organisations happens through overly permissive sharing links rather than external attacks — which is precisely why the document sharing restrictions built into Office and OneDrive deserve proper attention, not an afterthought.
The permission controls split into two broad layers:
- File-level controls — password encryption, restrict editing, IRM (Information Rights Management), applied inside Word, Excel, or PowerPoint.
- Cloud-level controls — OneDrive and SharePoint sharing link settings, expiry dates, and download blocking, applied from the web interface or within the Office app when a file is stored in the cloud.
Both layers work together. File-level controls travel with the document even when it is downloaded; cloud-level controls govern who can reach the file in the first place.
Password Encryption: Locking the File Itself
Password encryption in Word, Excel, and PowerPoint uses AES-256 bit encryption — the same standard used by financial institutions — making it genuinely robust rather than a cosmetic lock. Without the correct password the file cannot be opened at all, not even in recovery tools.
How to Encrypt a Word or Excel File with a Password
- Open the document and go to File → Info → Protect Document (or Protect Workbook / Protect Presentation).
- Select Encrypt with Password.
- Type a strong password, click OK, re-enter it to confirm, then click OK again.
- Save the file — the encryption is applied on save, not before.
Keep a secure record of the password. Microsoft has no back door; a lost password means a permanently inaccessible file. For shared team files, store the password in a business password manager such as 1Password or Bitwarden rather than an email thread.
Removing Password Encryption
Return to File → Info → Protect Document → Encrypt with Password, clear the password field, click OK, and save. The file reverts to unencrypted immediately.
Restrict Editing: Office Editing Permissions Without Full Encryption
Office editing permissions via Restrict Editing are subtler than full encryption — the file can be opened freely, but certain actions are blocked for users who don’t have the unlock password. This is the right tool for review workflows, form distribution, and template protection.
What Restrict Editing Can Control
- Formatting restrictions — prevents users from changing fonts, styles, or paragraph formatting.
- Editing restrictions — locks the document to one of four modes: No changes (read only), Tracked changes only, Comments only, or Filling in forms.
- Exceptions — you can select specific sections or paragraphs and whitelist individual users or groups who may freely edit those regions, even while the rest of the document stays locked.
How to Apply Restrict Editing in Word
- Go to Review → Restrict Editing (the panel opens on the right).
- Tick Allow only this type of editing in the document and choose your mode from the dropdown.
- Click Yes, Start Enforcing Protection.
- Enter an optional password — without it, any user can simply click Stop Protection and undo your settings.
The password here is separate from the open-file encryption password. A document can have both: one password to open it, and a second password to modify its protection settings.
Track Changes Lock: Enforcing Audit Trails
Track Changes is invaluable for document review, but it is only useful if no one can secretly turn it off. Word’s Lock Tracking feature solves exactly that by requiring a password to disable change tracking — ensuring every edit leaves a visible, attributable mark.
How to Lock Track Changes
- Go to Review → Track Changes → Lock Tracking.
- Enter and confirm a password.
- Click OK — Track Changes is now locked on. Any attempt to turn it off prompts for the password.
This is particularly valuable for legal teams, HR departments, and any workflow where an unbroken audit trail of who changed what is a compliance requirement. Note that Lock Tracking does not prevent editing itself — it only ensures that all edits are recorded. Combine it with Restrict Editing if you also need to limit the type of changes allowed.
Document Sharing Restrictions via OneDrive
When a file lives in OneDrive or SharePoint, cloud-level document sharing restrictions add a gatekeeper layer before the file-level controls even come into play. Microsoft’s official OneDrive sharing and permissions guide covers every option in depth, but here is the practical summary teams actually need.
Sharing Link Types Explained
- Anyone with the link — the broadest option; anyone who receives or forwards the link can access the file. Use sparingly; set an expiry date when you must use it.
- People in your organisation — limited to users signed into your Microsoft 365 tenant. Safe for most internal collaboration.
- People with existing access — creates a link that only works for people already explicitly granted access. No new access is granted by the link itself.
- Specific people — the most controlled option; only the named individuals (internal or external) can open it. This is the right default for anything confidential.
OneDrive Permission Levels
For each sharing link or direct share, you set one of three permission levels:
- Can view — read-only; the recipient cannot make changes.
- Can edit — full editing rights within the browser or Office app.
- Can review (available in Word files via OneDrive) — the recipient can suggest edits using track changes but cannot accept or reject them.
Block Download and Expiry Dates
Two additional toggles in the link settings pane significantly tighten restrict document access in cloud scenarios:
- Block download — the recipient can view and (if permitted) edit in the browser but cannot download a local copy. Useful for sensitive data you need to share but keep off personal devices.
- Set expiration date — the link automatically stops working after a chosen date. Ideal for external contractors, auditors, or anyone with time-limited project involvement.
Information Rights Management (IRM): Enterprise-Grade Restrict Document Access
For organisations on Microsoft 365 Business or Enterprise plans, Information Rights Management (IRM) — also called Azure Information Protection — adds policy-driven restrict document access controls that travel with the file regardless of where it ends up. Unlike standard password protection, IRM policies are enforced by Microsoft’s servers, so rights persist even when a file is forwarded, printed, or screenshotted (screen-capture blocking is an optional policy setting).
IRM policies can specify who may read, edit, print, copy, or forward a document, with expiry dates set at the policy level. Configuration happens in the Microsoft 365 admin centre and is then applied per-document via File → Info → Protect Document → Restrict Permission by People → Restricted Access. This requires an Azure AD-connected account and is not available in standalone (non-subscription) Office licences.
Excel and PowerPoint: Office Editing Permissions Overview
The same permission framework applies across the Office suite, with a few application-specific additions worth knowing.
Excel-Specific Controls
- Protect Sheet — locks individual worksheets against editing, formatting, or structural changes (inserting/deleting rows). Found under Review → Protect Sheet.
- Protect Workbook — prevents adding, deleting, hiding, or renaming sheets. Found under Review → Protect Workbook.
- Allow Edit Ranges — lets you designate specific cell ranges that certain users can edit even when the sheet is protected, mirroring Word’s section exceptions.
PowerPoint-Specific Controls
PowerPoint’s Restrict Editing panel is more limited — it offers read-only protection rather than granular region-based editing. For presentation templates that must stay on-brand, the most effective approach is to protect the Slide Master via View → Slide Master, combined with file-level password encryption to prevent unauthorised master edits.
Choosing the Right Layer for Your Scenario
Not every document needs every control. Here is a quick decision guide based on common team scenarios:
- Sharing a report for reading only → OneDrive link set to Can view + Block download.
- Sending a contract for review → Restrict Editing to Tracked Changes + Lock Tracking password, shared via OneDrive Specific people link.
- Distributing a form for completion → Restrict Editing to Filling in forms, with editable form fields and the rest locked.
- Protecting a confidential salary spreadsheet → AES-256 password encryption + OneDrive Specific people link, with download blocked.
- Enterprise compliance document → IRM policy with expiry + audit logging via Microsoft Purview.
Getting the Most from Office Permissions on a Genuine Licence
All the controls described above are available in Microsoft Office 2021 Professional Plus and Office 2024 Pro Plus — no subscription required for file-level and OneDrive sharing features when your account is connected to a Microsoft account or Microsoft 365. IRM is the one exception, requiring a Microsoft 365 subscription with Azure AD.
If you are still running Office 2016 or Office 2019, the Restrict Editing and password encryption features work identically, but IRM and the newer OneDrive sharing controls (such as Can review mode and Block download) require upgrading to a current release. Microsoft Office 2024 Pro Plus is available from Shop Key Online from €24.50, and Office 2021 Pro Plus is available from €28.95 — both as genuine, instant-delivery licence keys.
FAQ: Office Document Permissions, Sharing & Editing
Can someone remove a Restrict Editing password in Word?
Without the correct password, the Restrict Editing protection cannot be removed through Word’s normal interface. However, Restrict Editing is not encryption — it is a feature-level lock. A determined user with advanced XML editing knowledge could technically bypass it. For genuinely sensitive documents, combine Restrict Editing with full AES-256 password encryption so the file cannot be opened at all without the correct credentials.
Does password encryption work the same in Office 2021 and Office 2024?
Yes. Both Office 2021 and Office 2024 use AES-256 bit encryption for file-open passwords, consistent with the standard introduced in Office 2013. The algorithm and key length are identical across both versions, so an encrypted file created in Office 2021 opens correctly in Office 2024 and vice versa.
What is the difference between “Can view” and “Can review” in OneDrive?
“Can view” is strictly read-only — no changes of any kind can be made. “Can review” (available for Word files) allows the recipient to suggest tracked changes, but they cannot accept, reject, or hide those changes — only the owner or editor can do that. This makes “Can review” ideal for external proofreaders or legal reviewers who need to annotate without being able to alter the document directly.
How do I share a OneDrive file with an external user without giving them a Microsoft account?
When you share using the “Anyone with the link” or “Specific people” option, external users without a Microsoft account can still receive a one-time passcode sent to their email address, allowing them to verify their identity and access the file. This feature is controlled by your organisation’s OneDrive external sharing settings and may need to be enabled by an admin if it is not available to you by default.
Can I set a document permission to expire automatically?
Yes — via OneDrive’s sharing link settings. When generating or editing a sharing link, click the pencil icon to open link settings and set an expiration date. Once that date passes, the link stops working automatically. Note that this applies to the link only; if the recipient downloaded the file before expiry, any file-level encryption password you set remains the only remaining control.
Does Restrict Editing in Excel work the same as in Word?
Excel’s protection model is slightly different. Rather than a single Restrict Editing panel, Excel offers Protect Sheet (worksheet-level) and Protect Workbook (structure-level) as separate controls, plus Allow Edit Ranges for fine-grained cell-level exceptions. The underlying concept — locking content behind a password while allowing specific actions — is the same, but the controls are more granular and worksheet-specific.
