Sensitivity labels not showing in Office apps: policies, built-in labeling and sync delays

Symptoms to confirm

Microsoft's troubleshooting article sums it up as Sensitivity labels are missing, or the Sensitivity button isn't available.

• No Sensitivity button or sensitivity bar in Word, Excel or PowerPoint, or it's unavailable for some files only.
• Labels appear in Word but not in Outlook (or the reverse), or in the desktop apps but not on the web.
• Some users see the full list, colleagues see none or only some.

Likely causes

• The label isn't published to the user. Labels appear only for users and groups targeted by a label policy. Supported groups are mail-enabled security groups, distribution groups and Microsoft 365 groups. An exclusion, a policy restricted to administrative units, or missing group membership all look the same.
• Replication hasn't finished. Allow 24 hours for label and policy changes, and 24–48 hours when a new group or membership change is involved. Office for the web can update within the hour, so web and desktop may disagree for a while.
• Label scope. A label scoped only to Emails never appears in Word, Excel or PowerPoint; one scoped only to Files & other data assets never appears in Outlook.
• A sublabel without its parent in tenants still on the classic label scheme.
• Edition or account. Built-in labeling needs a subscription edition of Office; standalone ("perpetual") editions aren't supported. Office must be signed in with a licensed account from your tenant; guests see their own organization's labels.

+4 more causes in the full article.

Checklist

1. 1

   Run the built-in diagnostic

   The troubleshooting article in References links to a Run Tests: Sensitivity labels diagnostic in the Microsoft 365 admin center. Enter the label name and the user's UPN.

2. 2

   Check the label and the policy in PowerShell

   Connect to Security & Compliance PowerShell (connection problems are covered in fixing Connect-IPPSSession errors):

   powershell

   Connect-IPPSSession
   Get-Label | Format-Table -Property DisplayName, Name, Guid, ContentType
   Get-Label -Identity "Confidential" | Format-List DisplayName, ContentType, Disabled
   Get-LabelPolicy -Identity "Global label policy" |
       Format-List Name, Mode, Workload, DistributionStatus, ExchangeLocation,
           ExchangeLocationException, ModernGroupLocation, ModernGroupLocationException

3. 3

   Fix the publishing

   In the Microsoft Purview portal, open Solutions › Information Protection › Publishing policies, edit the policy and confirm its labels and users or groups. Finishing the edit republishes it; there's no separate publish button.

4. 4

   Check the Office client

   Under File › Account, confirm the work account and a Microsoft 365 subscription edition. Save old .doc or .xls files in the Open XML format. Then check the values that switch built-in labeling off:

   powershell

   $keys = 'HKCU:\Software\Microsoft\Office\16.0\Common\Security\Labels',
           'HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security\Labels'
   foreach ($k in $keys) {
       if (Test-Path $k) { Get-ItemProperty -Path $k | Select-Object PSPath, UseOfficeForLabelling }
   }

5. 5

   Reset the local label cache

   Close Outlook and all other Office apps, then rename the cache folder:

   powershell

   Rename-Item -Path "$env:LOCALAPPDATA\Microsoft\Office\CLP" -NewName 'CLP_old'

6. 6

   Outlook and the web

   Confirm the mailboxes are in Exchange Online; hybrid limits are covered in Purview DLP and sensitivity labels with Exchange Server. For Office for the web, enable sensitivity labels for Office files in SharePoint and OneDrive (see sensitivity labels in SharePoint and OneDrive).

Verify

• After a restart, the Sensitivity button lists the labels from the user's policies whose scope matches the app.
• The CLP folder is back with a fresh <domain.com>.policy.xml, the file that holds the user's labels.
• A label applied to a test .docx shows on the status bar or sensitivity bar, and the admin center diagnostic reports no problem.

Prevent it next time

For the bigger picture, see rolling out sensitivity labels; for messages users see once labels apply encryption, see the sensitivity label and encryption errors quick reference.

• Publish to groups, and keep label policies few; Microsoft notes a single policy for the whole organization isn't uncommon.
• Remove AIP add-in settings from Group Policy and Cloud Policy baselines. The add-in is retired; the Microsoft Purview Information Protection client covers labeling outside Office apps.
• Wait 24 hours after a change before troubleshooting it, and create a new email-only label instead of removing the files scope from a label in use.