# Design label policies that fit how people work - URL: https://m365playbooks.com/playbooks/design-label-policies-that-fit-how-people-work/ - Topic: Sensitivity labels (Program) - Product: Purview, SharePoint, Teams, Exchange - Stage: Plan - Last reviewed: October 15, 2026 - Version: 1 - Written by: Sev Derghazarian ## 1. Purpose Decide what people actually experience when labels arrive: which labels they see, what is labelled for them, when they are asked to choose, and when they have to explain a change. Labels describe sensitivity; label policies decide whether people use them well. Policies that fit how people work keep content labelled without slowing anyone down, while policies that fight them teach people to click whatever makes the prompt go away. ## 2. Overview Who sees which labels, the default label, mandatory labelling, justification and attachment inheritance, decided with as few policies as possible. - Effort: About 5 to 8 person-days - Duration: 2 to 4 weeks - Complexity: Low - Who's in the room: Taxonomy owner, Purview admin, Microsoft 365 Apps admin, communications lead, representatives of groups with special needs - Licensing: Label policies come with manual labelling, included in Microsoft 365 E3, E5 and Business Premium, and Office 365 E3 and E5. Microsoft's service description doesn't license each policy setting separately; check it for the settings you plan to use. - Risk of not doing it: Without deliberate policy settings, labels either go unused or interrupt people constantly, and the most common response to both is the lowest label that closes the prompt. ## 3. Key activities ### Prerequisites 1. **Start from the approved label taxonomy** Label policies publish labels; they don't define them. Work from the approved label specification: names, protection and priority order. Two policy settings depend directly on it. A parent label with sublabels can't be applied, so it can never be a default, and Microsoft advises against a default label that encrypts documents. Note which labels are safe defaults before you start. Who: Taxonomy owner. Produces: A list of labels that can safely be defaults. 2. **Find the groups with genuinely different needs** Most people need the same labels and the same behaviour. Look for the exceptions: a team that handles information only it should be able to label, such as legal privilege or board papers, or a group that must label every item. Policies can target mail-enabled and non-mail-enabled security groups, distribution groups and Microsoft 365 groups, including groups with dynamic membership, and can be limited to administrative units. Microsoft recommends groups over individual users. Who: Taxonomy owner with department representatives. Produces: A short list of groups that need different labels or settings. 3. **Check which Office versions you run** Several policy settings depend on the app version. For example, applying a default label to existing documents needs Microsoft 365 Apps on Current Channel 2208, Monthly Enterprise Channel 2207 or Semi-Annual Enterprise Channel 2302 or later on Windows, version 16.63 or later on Mac, is an opt-in on the web, and isn't available on iOS or Android. Microsoft keeps a minimum versions table; compare it with your update channels so the policy behaves the same for everyone. Who: Microsoft 365 Apps admin. Produces: Confirmed versions per platform, with gaps listed. ### Decisions 4. **Decision: How many label policies?** Microsoft's advice is to have as few label policies as possible, and notes it isn't unusual to have just one for the whole organization. When someone is in more than one policy they get all the labels from all of them, and where settings conflict the policy with the highest priority wins, setting by setting. That is easy to get wrong and hard to explain to a user, so add a second policy only for a real difference in labels or behaviour. Options: One policy per department; One policy for everyone, plus a policy only where labels or settings genuinely differ; One policy only, with no exceptions. Recommended default: One policy for everyone, plus a policy only where labels or settings genuinely differ. Who: Taxonomy owner. Produces: An agreed number of policies, each with a reason. 5. **Decision: What is labelled by default?** A policy can set separate defaults for documents and Loop components, for emails and meeting invites, for meetings, for new groups and sites, and for Power BI content. Outlook can also have its own default, independent of the one for documents. A non-encrypting default such as General labels new content without anyone choosing and is what Microsoft's own example policy uses. Decide the default for documents and email here; defaults for meetings, containers and Power BI belong with those deployments. Options: No default label; A non-encrypting default such as General for documents and email; An encrypting label as the default. Recommended default: A non-encrypting default such as General for documents and email. Who: Taxonomy owner. Produces: A default label for documents and for email. 6. **Decision: Is labelling mandatory?** Mandatory labelling asks people to choose a label when they open or save an unlabelled document and before they send an email. Existing unlabelled documents can be opened read-only instead. Once a label is applied it can be changed but not removed, and Print to PDF isn't available, because that option removes the label. The default label always takes priority over the mandatory prompt, and Microsoft warns that mandatory labelling without a default frustrates people. Outlook can be left out of mandatory labelling while documents stay in. Options: Mandatory for everyone, with no default; Not mandatory; rely on the default label; Mandatory only for groups that must label everything, with a default. Recommended default: Mandatory only for groups that must label everything, with a default. Who: Taxonomy owner. Produces: A decision per item type, and for which groups. 7. **Decision: Ask for a reason when a label is removed or lowered?** For files, emails and meetings, people must by default give a justification when they remove a label or choose one with a lower priority; groups and sites are not included. Office asks once per app session, so it is a light touch. The reasons are what make downgrades reviewable later, so keep it on unless you have a strong reason not to. Options: Turn justification off; Keep justification on. Recommended default: Keep justification on. Who: Taxonomy owner. Produces: A recorded decision. 8. **Decision: Should email take the label of its attachments?** A policy can make an email inherit the highest-priority label of its attachments, or only recommend it. The attachment has to be an actual file, not a link to one, and a label someone chose for the email by hand is never replaced. Recommending first shows people the connection between file and email labels without surprising them. Options: No inheritance; Recommend the attachment's label; Apply the attachment's label automatically. Recommended default: Recommend the attachment's label. Who: Taxonomy owner. Produces: A recorded decision. ### Pilot configuration 9. **Write the policy matrix and test it** Put every policy in one table: who it targets, which labels it publishes, and each setting with its value. Then walk a few people through real situations: opening an old unlabelled document, saving a new one, replying to an email with a labelled attachment, lowering a label. Watch for prompts that surprise them; those are the settings to reconsider. Include at least one person from each group with its own policy, and one person who belongs to two groups, so you see how overlapping policies combine in practice. Who: Purview admin with the communications lead. Produces: A tested policy matrix. 10. **Point the help link at your guide** A label policy can show a link to your own help page after the list of labels in Office apps. Make sure the one-page labelling guide explains what the default does, why a reason is sometimes requested, and what to do if a label blocks work. Who: Communications lead. Produces: A help page ready to link from the policy. ### Production configuration 11. **Approve the policies and hand them to Deploy** Have the taxonomy owner approve the matrix and hand it to the deployment team with the order of publishing. Remember that policy changes take up to 24 hours to reach apps, and up to 48 hours when group membership is involved, so every later change needs the same planning. Agree, too, who may change a policy later and how: a policy change reaches everyone in its scope at once, so it deserves the same care as a label change, with the taxonomy owner's approval and a note to the service desk before it lands. Who: Taxonomy owner. Produces: An approved policy matrix in the Deploy backlog. 12. **Make it enforceable** Once published, label policies are the enforcement: apps apply the default label, prompt where labelling is mandatory, and ask for a reason before a label is lowered, without anyone having to remember. Devices on Office versions older than the minimums don't get every setting, so they stay a gap until updated. _Partly enforced. The gaps are a risk until a mechanism covers them._ ## 4. Approval and readiness 1. **Draft the policy matrix** One row per policy and setting, built from the decisions above. Move on when: Every setting has a value and a reason. 2. **Walk through real situations with a few people** (Change: Explain) Test the prompts people will see on their own documents and email. Use their own documents and mailboxes rather than test content, and note every prompt that made them pause. Move on when: No prompt surprises the testers. 3. **Confirm app versions** Compare the settings you chose with the minimum versions table and your update channels. Move on when: Gaps are listed with a plan to close them. 4. **Approve with the taxonomy owner** (Change: Inform) Sign off the matrix and the publishing order. Move on when: The matrix is approved and in the Deploy backlog. ## 5. Common challenges - **If you** Create a policy for every department. What tends to happen: People in several groups get settings from whichever policy has the highest priority, and nobody can explain why their prompts differ from a colleague's.. A better approach: Start with one policy and add another only for a real difference in labels or behaviour. - **If you** Turn on mandatory labelling with no default. What tends to happen: Every new document and email interrupts people, and they choose whatever label closes the prompt fastest.. A better approach: Set a non-encrypting default first; keep mandatory labelling for the groups that truly need it. - **If you** Use a parent label or an encrypting label as the default. What tends to happen: A parent label can't be applied at all, and an encrypting default makes everyday documents hard to share and co-edit.. A better approach: Choose a non-encrypting label that can be applied by itself, such as General. - **If you** Forget that Outlook has its own settings. What tends to happen: Documents behave as planned, but email prompts on every send or gets no default at all.. A better approach: Decide Outlook's default and mandatory settings explicitly in the matrix. - **If you** Ignore app versions. What tends to happen: The same policy behaves differently on different devices, and the service desk can't reproduce what people report.. A better approach: Check the minimum versions table against your update channels before publishing. - **If you** Adjust policy settings in response to every complaint. What tends to happen: Settings change every few weeks, the guide falls behind, and people stop trusting what the prompts mean.. A better approach: Collect feedback and change policies at the quarterly review, unless something is blocking work. ## 6. Checkpoints **Pilot:** - [ ] Is every setting in the policy matrix decided, with a reason? - [ ] Did testers meet any prompt they didn't expect? - [ ] Do the app versions in use support the settings you chose? **Production:** - [ ] Is the number of policies as small as the real differences allow? - [ ] Is the default label one that can be applied by itself and doesn't encrypt? - [ ] Does the help link point to a current guide? - [ ] Is the matrix approved and scheduled for Deploy? ## 7. Success measures Capture a baseline before you start, or you won't be able to show the change. - Label policies in use (Where you see it: Purview portal (aim for as few as possible); Good direction: Steady) - Labels applied by default rather than chosen (Where you see it: Activity explorer or the audit log; Good direction: Steady) - Label removals and downgrades with a reason (Where you see it: Activity explorer; Good direction: Steady) - Service desk tickets about label prompts (Where you see it: Service desk; Good direction: Down) **Ready-to-use text: Policy matrix columns** > Policy name | Targets (groups) | Labels published | Default for documents | Default for email | Mandatory: documents / email | Justification to lower | Email inherits from attachments | Help link | Owner | Last reviewed **Ready-to-use text: Help page: why am I being asked?** > Most of what you create is labelled General for you. You'll only be asked to choose a label when [mandatory rule], and you'll be asked for a short reason when you remove a label or choose a lower one, so we can improve the labels. If a label stops you doing your work, tell us at [channel]. ## 8. Additional reading **Plan:** - [Learn about sensitivity labels](https://learn.microsoft.com/en-us/purview/sensitivity-labels) - [Get started with sensitivity labels](https://learn.microsoft.com/en-us/purview/get-started-with-sensitivity-labels) - [Microsoft Purview service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-description) **Configure:** - [Create and publish sensitivity labels](https://learn.microsoft.com/en-us/purview/create-sensitivity-labels) - [Manage sensitivity labels in Office apps](https://learn.microsoft.com/en-us/purview/sensitivity-labels-office-apps) - [Minimum versions for sensitivity labels in Microsoft 365 Apps](https://learn.microsoft.com/en-us/purview/sensitivity-labels-versions) **Monitor:** - [Get started with Activity explorer](https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer) ## Changelog - Version 1, 2026-10-15, Sev Derghazarian: First version. Facts checked against Microsoft Learn on 2026-10-15.