Microsoft Purview compliance portal: Information Protection - SharePoint Online extends library permissions to downloaded files.

This new capability ties together SharePoint Online library permissions with Purview sensitivity labeling and protection. SharePoint Online document library owners can set a label on the library, automatically applying that label to all unprotected and unlabeled Word, Excel, PowerPoint, and PDF files at rest in the target library. This simplifies labeling in bulk across document libraries in an organization. This capability also helps protect files as they egress from the original document library, such as for collaboration purposes or attempted exfiltration. Files downloaded from these libraries are protected at download. Users accessing these files outside of SharePoint Online have their rights evaluated in real time against the online copy of the document. Changes to user permissions on the online copy of the document are reflected on downloaded copy, including full access removal. This provides a more streamlined way to revoke access to documents for individual users, versus revoking access on a per-document basis.