Sensitivity labels not showing in Office apps: policies, built-in labeling and sync delays

A user opens Word or Outlook and the Sensitivity button is missing, grayed out, or offers fewer labels than colleagues get. Labels reach Office apps through a chain: the label and its scope, a label policy, the user's account, the Office edition and its settings, and a local policy cache. In this post I'll walk that chain in order, with the checks and the client reset that resolve most cases.

Symptoms#

Microsoft's troubleshooting article sums it up as Sensitivity labels are missing, or the Sensitivity button isn't available. Typically:

• No Sensitivity button or sensitivity bar in Word, Excel or PowerPoint, or it's unavailable for some files only.
• Labels appear in Word but not in Outlook (or the reverse), or in the desktop apps but not on the web.
• Some users see the full list, colleagues see none or only some.

While you investigate, you may find one of these values:

Why it happens#

• The label isn't published to the user. Labels appear only for users and groups targeted by a label policy. Supported groups are mail-enabled security groups, distribution groups and Microsoft 365 groups. An exclusion, a policy restricted to administrative units, or missing group membership all look the same.
• Replication hasn't finished. Allow 24 hours for label and policy changes, and 24–48 hours when a new group or membership change is involved. Office for the web can update within the hour, so web and desktop may disagree for a while.
• Label scope. A label scoped only to Emails never appears in Word, Excel or PowerPoint; one scoped only to Files & other data assets never appears in Outlook.
• A sublabel without its parent in tenants still on the classic label scheme.
• Edition or account. Built-in labeling needs a subscription edition of Office; standalone ("perpetual") editions aren't supported. Office must be signed in with a licensed account from your tenant; guests see their own organization's labels.
• Built-in labeling turned off by the values in the table above.
• Unsupported file type. Open XML files (.docx, .xlsx, .pptx) are supported; Office 97-2003 and OpenDocument files aren't.
• An on-premises mailbox. Outlook labeling needs the mailbox, including any shared mailbox, in Exchange Online.
• A stale local cache of the downloaded policy.

How to fix it#

1. Run the built-in diagnostic#

The troubleshooting article in References links to a Run Tests: Sensitivity labels diagnostic in the Microsoft 365 admin center. Enter the label name and the user's UPN. It needs a Global Administrator and catches most configuration mistakes in one pass.

2. Check the label and the policy in PowerShell#

Connect to Security & Compliance PowerShell (connection problems are covered in fixing Connect-IPPSSession errors):

Connect-IPPSSession
Get-Label | Format-Table -Property DisplayName, Name, Guid, ContentType
Get-Label -Identity "Confidential" | Format-List DisplayName, ContentType, Disabled
Get-LabelPolicy -Identity "Global label policy" |
    Format-List Name, Mode, Workload, DistributionStatus, ExchangeLocation,
        ExchangeLocationException, ModernGroupLocation, ModernGroupLocationException

Good looks like this: ContentType includes File (Word, Excel, PowerPoint) and Email (Outlook), Disabled is False, Mode is Enforce, Workload includes Exchange, DistributionStatus is Success, and the user or one of their groups is in the locations and not in an exception. If several label policies can apply, review their order, because it decides conflicting settings.

3. Fix the publishing#

In the Microsoft Purview portal, open Solutions › Information Protection › Publishing policies, edit the policy and confirm its labels and users or groups. Finishing the edit republishes it; there's no separate publish button. Then wait before testing again.

4. Check the Office client#

Under File › Account, confirm the work account and a Microsoft 365 subscription edition. Save old .doc or .xls files in the Open XML format. Then check the values that switch built-in labeling off:

$keys = 'HKCU:\Software\Microsoft\Office\16.0\Common\Security\Labels',
        'HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security\Labels'
foreach ($k in $keys) {
    if (Test-Path $k) { Get-ItemProperty -Path $k | Select-Object PSPath, UseOfficeForLabelling }
}

If UseOfficeForLabelling is 0, fix the source rather than the value. In Group Policy (User Configuration › Administrative Templates › Microsoft Office 2016 › Security Settings, with current Microsoft 365 Apps templates) or the Cloud Policy service, set Use the Sensitivity feature in Office to apply and view sensitivity labels to Enabled and Use the Azure Information Protection add-in for sensitivity labeling to Not configured or Disabled. Changes apply when the apps restart.

5. Reset the local label cache#

Close Outlook and all other Office apps, then rename the cache folder:

Rename-Item -Path "$env:LOCALAPPDATA\Microsoft\Office\CLP" -NewName 'CLP_old'

When the app starts again, it authenticates to the Microsoft Purview Information Protection service and downloads labels and policy from scratch.

6. Outlook and the web#

Confirm the mailboxes are in Exchange Online; hybrid limits are covered in Purview DLP and sensitivity labels with Exchange Server. For Office for the web, enable sensitivity labels for Office files in SharePoint and OneDrive (see sensitivity labels in SharePoint and OneDrive). Missing only in Outlook on the web? Recheck ContentType, Workload and group membership from step 2.

Verify the fix#

• After a restart, the Sensitivity button lists the labels from the user's policies whose scope matches the app.
• The CLP folder is back with a fresh <domain.com>.policy.xml, the file that holds the user's labels.
• A label applied to a test .docx shows on the status bar or sensitivity bar, and the admin center diagnostic reports no problem.

Prevent it next time#

• Publish to groups, and keep label policies few; Microsoft notes a single policy for the whole organization isn't uncommon.
• Remove AIP add-in settings from Group Policy and Cloud Policy baselines. The add-in is retired; the Microsoft Purview Information Protection client covers labeling outside Office apps.
• Wait 24 hours after a change before troubleshooting it, and create a new email-only label instead of removing the files scope from a label in use.

For the bigger picture, see rolling out sensitivity labels; for messages users see once labels apply encryption, see the sensitivity label and encryption errors quick reference.

References#

• Sensitivity labels are missing in Outlook, Outlook on the web, and other Office apps (Microsoft Learn)
• Manage sensitivity labels in Office apps (Microsoft Learn)
• Create and publish sensitivity labels (Microsoft Learn)