Rolling out sensitivity labels in Microsoft Purview: policies, defaults and auto-labeling

Sensitivity labels only help if people use them and your important content actually ends up labeled. In this post I'll walk through a rollout that holds up: a small label taxonomy, a pilot publishing policy with sensible defaults, SharePoint and OneDrive support switched on, and then automatic labeling, first as recommendations in Office apps and then as service-side policies you test in simulation before they touch a single file.

Prerequisites#

• Licensing. Labels and manual labeling are included with E3-level plans and Business Premium. Automatic labeling, both in Office apps and through auto-labeling policies, needs an E5-tier licence such as Microsoft 365 E5, E5 Compliance, E5 Information Protection & Governance or Azure Information Protection Premium P2. Microsoft's licensing guidance for security and compliance has the per-plan detail.
• Roles. Turning an auto-labeling policy on needs Compliance Administrator or Compliance Data Administrator. Previewing matched content during simulation also needs the Data Classification Content Viewer role, which Global Administrators don't have by default.
• Auditing must be on, because simulation depends on it.
• Apps. Microsoft 365 Apps with built-in labeling. Not every app supports automatic labeling, so check Microsoft's minimum versions.

Step-by-step#

1. Design a small taxonomy#

Four or five parent labels, ordered from least to most sensitive (Public, General, Confidential, Highly Confidential), cover most needs. The order matters: the first label in the list has the lowest priority and the last the highest, and Purview uses that order to decide what counts as a downgrade and which label wins when several match. Use sublabels for variations such as Confidential / Partners. A parent label that has sublabels can't be applied to content, so never pick one for auto-labeling. Some newer tenants already have Microsoft's default labels, so check what exists before you build.

2. Create the labels#

Go to Microsoft Purview portal › Solutions › Information Protection › Sensitivity labels and create each label.

• Scope: Files & other data assets for documents and Emails for mail. Add Meetings or Groups & sites only when you need them.
• Protection: headers, footers and watermarks are low-risk. Encrypt only where you need to, because encryption changes how people share. If an auto-labeling policy will apply an encrypting label in SharePoint or OneDrive, the label must use Assign permissions now with User access to content expires set to Never.

3. Enable labels for Office files in SharePoint and OneDrive#

Until you do this, SharePoint and OneDrive can't process the contents of files with encrypting labels, and auto-labeling policies can't label files there. The shortcut that turns a label's settings into a policy doesn't check it, and a policy missing it typically runs without labeling anything or showing an error.

Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOTenant -EnableAIPIntegration $true
Get-SPOTenant | Select-Object EnableAIPIntegration

4. Publish to a pilot group#

Under Information Protection › Policies › Label publishing policies, publish the labels to a pilot group first and configure the following:

• Users must provide a justification to remove a label or lower its classification, so downgrades are deliberate and recorded.
• A default label for documents and emails, typically General, so new content starts out labeled.
• A link to your own labeling guidance as the custom help page.
• Require users to apply a label to their email and documents only later. Microsoft notes a timing issue where mandatory labeling can stop auto-labeling in Office apps from triggering.

Allow up to 24 hours for a new policy to reach users' apps.

5. Recommend labels in Office apps#

Edit a label such as Confidential and open Auto-labeling for files and emails. Pick sensitive info types (the same list DLP uses) or trainable classifiers, tune instance counts and accuracy, and start with the option to recommend the label, using prompt text your users will recognize. In the desktop versions of Word, users can step through the content that triggered the recommendation. Move to automatic application once the recommendations look right. Either way, users can accept or reject the label, and it's never applied over a manual label or a higher-priority one.

6. Build a service-side policy and simulate#

Go to Information Protection › Policies › Auto-labeling policies › Create auto-labeling policy, choose to apply a label, and start from a template (for example Financial) or a custom policy. Choose locations narrowly at first, such as a single SharePoint site. For Exchange, keep All included and narrow the scope with the advanced rules: choosing specific users exempts mail from outside senders. Then run the policy in simulation.

• A simulation can take 12 hours and sends a notification email when it finishes. Review the matches, refine the rules, rerun, and widen the scope gradually.
• Custom and newly added sensitive info types only evaluate content created or modified after the info type was created or changed. Run on-demand classification for older, unchanged files.
• Exchange simulation only sees mail sent and received during the run, and simulation still triggers any alert policies you've configured.
• For about 24 hours after you create a policy, turning it on, editing or deleting it is unavailable. That's expected.

7. Turn the policy on#

Keep the limits in mind: 500,000 automatically labeled files per tenant per day, 100 auto-labeling policies, and 1,000 explicitly selected SharePoint sites per policy (up to 50,000 with an adaptive scope configured through PowerShell). Files that are open or checked out are skipped, Modified and Modified By don't change, and policies don't add visual markings to documents.

Verify#

Connect-IPPSSession
Get-Label | Format-Table DisplayName,Priority
Get-AutoSensitivityLabelPolicy | Format-Table Name,Mode

Good looks like this:

• Priorities rise from your least to your most sensitive label, and live policies show Mode as Enable.
• For a pilot user, new documents and emails carry the default label, downgrading asks for a justification, and a test document with dummy data for your chosen sensitive info types triggers the recommendation.
• Activity explorer shows labeling events from both users and policies.
• For any file that wasn't labeled, the policy's details panel (Labeling failures in the newer view) helps you find out why.

Tips and gotchas#

• A policy that applies labels never strips one to leave content unlabeled. Only a label-removal policy for SharePoint and OneDrive does that.
• Exchange policies label the email, not the attachment, even when the match was found inside an attached file.
• Groups & sites greyed out? Enable label support for Microsoft 365 groups in Microsoft Entra ID, then synchronize labels with Execute-AzureAdLabelSync in Security & Compliance PowerShell.
• One sensitivity label plus one retention label per item. They do different jobs; see retention policies, labels and holds.
• Put labels to work. DLP policies can use labels as conditions; see DLP from simulation to enforcement.

References#

• Automatically apply a sensitivity label to Microsoft 365 data (Microsoft Learn)