eSHARE Collaborate's RMS Secure Download (Rights Management System) keeps sensitive Office files protected even after they leave the platform, so recipients can do real work in the desktop app without your organization losing control of the file. The following topics are covered:
Overview
Trusted Shares let people outside your organization view and co-author sensitive files while the content stays inside your Microsoft 365 environment. Most of the time, that happens right in the browser. But some work — complex Excel formulas, macro-enabled workbooks — needs the full Office desktop app, which means the file has to be downloaded. You could allow download or download with approval considering the risk. RMS Secure Download closes the gap that opens the moment a file leaves the browser. The file is protected the instant it's downloaded, stays protected for as long as it's on the recipient's machine, and returns to normal, unprotected content the moment it's uploaded back to the share.
The Challenge It Solves
Sharing a sensitive file with an external collaborator usually comes down to a hard choice:
Don't allow downloads at all. The safest option, but it stops the work whenever someone genuinely needs to work on the office desktop app.
Allow downloads. The work gets done, but once the file lands on someone else's device, it's out of your control. There's no audit trail to say who opened it or what happens to it next.
RMS Secure Download removes the trade-off. The file can leave the platform, and the protection leaves with it.
How RMS Secure Download Works
The process is entirely automatic — there's nothing for the recipient to install and nothing for either side to configure at share time. To turn on protected downloads for a specific trusted share or while creating a trusted share, go to the Trusted Share's sharing options and check 'Download' > 'Download with Protection'. The protection rights applied to the downloaded file are inherited from the share's own 'View' and 'Edit' settings — a view-only share produces a view-only protected file, and an editable share produces an editable protected file.
Note
This option is only available if your eSHARE administrator has enabled it for your organization.
A recipient downloads a Word, Excel, or PowerPoint file from a protection-enabled Trusted Share.
The file is protected at the moment of download, scoped specifically to that recipient's identity.
The recipient signs in to their Microsoft 365 desktop app using the same email address the file was shared with, and opens the file to do the work.
If the recipient tries to use an email that is not on the recipients list, they may not be able to view/edit the file.
.png?sv=2026-02-06&spr=https&st=2026-10-01T01%3A27%3A10Z&se=2026-10-01T01%3A41%3A10Z&sr=c&sp=r&sig=RNRGrRZ26EeiqC5A2AHy9cvQy1Fi3HpYaMcvvDNZrRU%3D)
When the recipient uploads the edited file back to the same Trusted Share, it's automatically returned to normal, unprotected content.
Permissions carry over : If the Trusted Share only allows viewing, the downloaded file will also be view-only — even when opened offline in the desktop app. If the share allows editing, the downloaded file will be editable too.
Expiry carries over : The downloaded file expires at the same time as the Trusted Share itself. Once that expiry passes, the file can no longer be opened, regardless of where it is.
Previewing and editing a file in the browser is unaffected by any of this — in-browser collaboration always works on the unprotected version that stays inside the share.
Note:
A protected file can't be revoked early — it stays valid for as long as its Trusted Share's expiration allows. If you need to be able to cut off access immediately, keeping the file in the share instead of downloading it is the safer choice.
Key Features
Feature | What It Means for You |
|---|---|
Protected the moment it's downloaded | The file never has a moment of being unprotected outside the share. |
Scoped to one recipient | Only the person the file was shared with can open it — even if it's forwarded to someone else, including other members of the same share. |
Returns to normal automatically | Re-uploading the edited file to the same share restores it to clear content — no manual step required. |
No plugins or installs | Works entirely in the background. Recipients don't need to install anything or set up a guest account. |
Works alongside your existing controls | Combines with other download controls, like approval workflows, rather than replacing them. |
Fully auditable | Every protected download is captured on the audit trail, so it's always answerable who downloaded what, and whether it was protected. |
Things to Keep in Mind
Protection currently covers Word, Excel, and PowerPoint files. Other file types aren’t supported currently.
Protected files open in the Office desktop app, not in Office Online.
A protected file only returns to normal when it's uploaded back to a Trusted Share in the same organization it came from.
Share owners and co-owners always download an unprotected copy of their own content.
Getting Started
TO ENABLE THIS FEATURE:
RMS Secure Download is an additional feature that isn’t included on the eSHARE Collaborate suite. To turn it on for your organization, contact your eSHARE Customer Success Manager or visit eshare.com.
To enable RMS Download with Protection feature, an additional permission, Content. DelagatedWriter (Type:Application) needs to be added to your existing eSHARE Single tenant service principal.
{
"resourceAppId": "00000012-0000-0000-c000-000000000000",
"resourceAccess": [
{
"id": "d13f921c-7f21-4c08-bade-db9d048bd0da",
"type": "Role"
}
]
},