Apply Access Restrictions to a Document

For heavy-duty protection, you can apply Information Rights Management (IRM) to your documents.

Understand What IRM Is and When to Use It

IRM is typically used in corporate, government, and military situations rather than in small businesses or homes-but you can use it anywhere you have an Internet connection. IRM requires authentication to determine whether a particular user is allowed to access a particular document or take another action with it. Authentication is normally provided by a corporate server, but Microsoft also provides a free trial service that uses a Windows Live ID (the credential formerly known as Microsoft Passport).

To set up IRM with this free trial service, choose Review | Protect | Protect Document | Restricted Access, and then follow through the Service Sign-Up Wizard that Word launches. The main steps involve you providing your Windows Live ID (or signing up for a Windows Live ID if you don't already have one), creating a rights-management certificate for that Windows Live ID, and downloading the certificate to your computer.

Always remember that IRM is no panacea: Even if you turn off printing and copying, anyone determined to copy a document can do so by using traditional means: Capture it screen by screen on the computer by using PRINT SCREEN or ALT-PRINT SCREEN, or a more sophisticated screen-capture utility; photograph it on screen; type it into another document or program; dictate it into their iPod or other digital-audio player; or simply write down valuable information on paper. Even if you were to guard against all of the above, someone could simply memorize key information and reproduce it later.

Implement IRM on a Document

To apply access restrictions to the active document, follow these steps:

1. Choose Review | Protect | Protect Document | Restricted Access. Word displays the Permission dialog box.
2. Select the Restrict Permission To This Document check box. Word enables the other controls in the dialog box.
3. Add to the Read box the name of anyone who may read the document but not change, copy, or print it. Add to the Change box the name of anyone who may read, edit, and save changes to the document, but again not print it. Use these techniques:
   • To add users by name, type their e-mail addresses in the box. Separate each address with a semicolon.
   • To add users from the Address book, click the Read button or the Change button, as appropriate, and then use the Select Names dialog box to select the names. When you click the OK button, Word closes the Select Names dialog box and adds the names to the box.
4. To implement further restrictions, click the More Options button. Word displays the larger version of the Permission dialog box.
5. Make sure the Restrict Permission To This Document check box is selected. (Word selects this check box if it was selected in the smaller version of the Permissions dialog box.)
6. In the The Following Users Have Permission To This Document list box, set up the list of users:
   • To add a user, click the Add button, use the Add Users dialog box to specify the names using the techniques described in step 3, and then click the OK button.
   • To remove a user, click their name in the list box, and then click the Remove button.
7. In the Additional Permissions For Users area, decide whether to allow other permissions:
   • This Document Expires On: To give the document an expiration date, select this check box, and then click the drop-down arrow on the date box and choose the date from the panel.
   • Print Content: Select this check box if you want the users to be able to print the document.
   • Allow Users With Read Access To Copy Content: Select this check box if you want users who can read the document but not edit it to be able to copy content from the document and paste it elsewhere. Normally, this is not a good idea-but there are exceptions.
   • Access Content Programmatically: Select this check box if you want users to be able to access the document's content via programming tools such as Visual Basic for Applications, Visual Basic, or Visual C#. For example, your company's IT department might need such access.
8. If you want users to be able to request additional permissions for the document, select the Users Can Request Additional Permissions From check box, and then enter a hyperlink to the appropriate URL.
   • For example, you might enter a mailto: hyperlink to your e-mail address.
   • You can type a hyperlink manually or click the Insert Hyperlink button at the right end of the text box, and then use the Edit Hyperlink dialog box to set up the link.
9. If you want Word to authenticate the user each time they open the document, select the Require A Connection To Verify A User's Permission check box. Depending on the implementation of IRM, this check box may not be available.
10. If you want to use the permission settings you've chosen here as your default settings for all Office documents to which you apply permissions, click the Set Defaults button. Word displays the confirmation dialog box shown next. Click the OK button.
11. Click the OK button. Word closes the Permission dialog box, applies the permissions, and displays a Restricted Access bar below the Ribbon. You can click the Close button (the x button) to close this bar.
12. Click the Save button on the Quick Access Toolbar to save the document.

Open a Document That Has Permissions Applied

If you've applied permissions to a document yourself, you'll know that the document requires user authentication. But if someone else has applied permissions to a document, you may not know-or you may know that the document has permissions applied (for example, because it's in a protected folder) but not whether you have permission to read or change the document.

If you try to open a protected document on a user account that doesn't have IRM installed, Word prompts you to get credentials for the IRM service. Click the Yes button.

Word may display the following Microsoft Office dialog box warning you that the document has restricted permissions.

If you don't have permission for the document, and the document is configured so that you can request permissions, Word offers you the opportunity to do so. If you want to request the permission, click the Yes button. Word launches the appropriate program. For example, if the permissionholder has provided a mailto hyperlink, Word launches Outlook or your default mail program and starts an e-mail message in it.

Instead of requesting permission, you can click the Change User button, which displays the Select User dialog box so that you can supply other credentials for opening the document.