Sensitivity label rollout checklist

Before you start

• Licensing. Labels and manual labeling are included with E3-level plans and Business Premium. Automatic labeling, both in Office apps and through auto-labeling policies, needs an E5-tier licence such as Microsoft 365 E5, E5 Compliance, E5 Information Protection & Governance or Azure Information Protection Premium P2. Microsoft's licensing guidance for security and compliance has the per-plan detail.
• Roles. Turning an auto-labeling policy on needs Compliance Administrator or Compliance Data Administrator. Previewing matched content during simulation also needs the Data Classification Content Viewer role, which Global Administrators don't have by default.
• Auditing must be on, because simulation depends on it.
• Apps. Microsoft 365 Apps with built-in labeling. Not every app supports automatic labeling, so check Microsoft's minimum versions.

Checklist

1. 1

   Design a small taxonomy

   Four or five parent labels, ordered from least to most sensitive (Public, General, Confidential, Highly Confidential), cover most needs. The order matters: the first label in the list has the lowest priority and the last the highest, and Purview uses that order to decide what counts as a downgrade and which label wins when several match.

2. 2

   Create the labels

   Go to Microsoft Purview portal › Solutions › Information Protection › Sensitivity labels and create each label.

   • Scope: Files & other data assets for documents and Emails for mail. Add Meetings or Groups & sites only when you need them.
   • Protection: headers, footers and watermarks are low-risk. Encrypt only where you need to, because encryption changes how people share. If an auto-labeling policy will apply an encrypting label in SharePoint or OneDrive, the label must use Assign permissions now with User access to content expires set to Never.
3. 3

   Enable labels for Office files in SharePoint and OneDrive

   Until you do this, SharePoint and OneDrive can't process the contents of files with encrypting labels, and auto-labeling policies can't label files there. The shortcut that turns a label's settings into a policy doesn't check it, and a policy missing it typically runs without labeling anything or showing an error.

   powershell

   Connect-SPOService -Url https://contoso-admin.sharepoint.com
   Set-SPOTenant -EnableAIPIntegration $true
   Get-SPOTenant | Select-Object EnableAIPIntegration

4. 4

   Publish to a pilot group

   Under Information Protection › Policies › Label publishing policies, publish the labels to a pilot group first and configure the following:

   • Users must provide a justification to remove a label or lower its classification, so downgrades are deliberate and recorded.
   • A default label for documents and emails, typically General, so new content starts out labeled.
   • A link to your own labeling guidance as the custom help page.
   • Require users to apply a label to their email and documents only later. Microsoft notes a timing issue where mandatory labeling can stop auto-labeling in Office apps from triggering.
5. 5

   Recommend labels in Office apps

   Edit a label such as Confidential and open Auto-labeling for files and emails. Pick sensitive info types (the same list DLP uses) or trainable classifiers, tune instance counts and accuracy, and start with the option to recommend the label, using prompt text your users will recognize.

6. 6

   Build a service-side policy and simulate

   Go to Information Protection › Policies › Auto-labeling policies › Create auto-labeling policy, choose to apply a label, and start from a template (for example Financial) or a custom policy. Choose locations narrowly at first, such as a single SharePoint site.

   • A simulation can take 12 hours and sends a notification email when it finishes. Review the matches, refine the rules, rerun, and widen the scope gradually.
   • Custom and newly added sensitive info types only evaluate content created or modified after the info type was created or changed. Run on-demand classification for older, unchanged files.
   • Exchange simulation only sees mail sent and received during the run, and simulation still triggers any alert policies you've configured.
   • For about 24 hours after you create a policy, turning it on, editing or deleting it is unavailable. That's expected.
7. 7

   Turn the policy on

   Keep the limits in mind: 500,000 automatically labeled files per tenant per day, 100 auto-labeling policies, and 1,000 explicitly selected SharePoint sites per policy (up to 50,000 with an adaptive scope configured through PowerShell).

Verify

Connect-IPPSSession
Get-Label | Format-Table DisplayName,Priority
Get-AutoSensitivityLabelPolicy | Format-Table Name,Mode

Good looks like this:

• Priorities rise from your least to your most sensitive label, and live policies show Mode as Enable.
• For a pilot user, new documents and emails carry the default label, downgrading asks for a justification, and a test document with dummy data for your chosen sensitive info types triggers the recommendation.
• Activity explorer shows labeling events from both users and policies.
• For any file that wasn't labeled, the policy's details panel (Labeling failures in the newer view) helps you find out why.

Tips & gotchas

• A policy that applies labels never strips one to leave content unlabeled. Only a label-removal policy for SharePoint and OneDrive does that.
• Exchange policies label the email, not the attachment, even when the match was found inside an attached file.
• Groups & sites greyed out? Enable label support for Microsoft 365 groups in Microsoft Entra ID, then synchronize labels with Execute-AzureAdLabelSync in Security & Compliance PowerShell.
• One sensitivity label plus one retention label per item. They do different jobs; see retention policies, labels and holds.
• Put labels to work. DLP policies can use labels as conditions; see DLP from simulation to enforcement.