There are two common situations in Microsoft 365 that can cause this issue:

1. Applying a sensitivity label while offline

If you apply a High Risk or Moderate Risk sensitivity label while your device does not have network connectivity, the label may not function correctly. Sensitivity labels require an internet connection when they are first applied so the appropriate permissions and protections can be added to the file. To avoid issues, apply or update sensitivity labels while connected to the network.

2. No network connectivity for more than 14 days

Sensitivity labels periodically refresh their protection tokens. If you have not connected to the network within 14 days of last opening the document, the token may expire. When this happens, the document may attempt to reapply protection but fail to grant access permissions properly, which can prevent users from opening the file. To prevent this issue, connect to the network at least once every 14 days so the sensitivity label token can refresh successfully.