M365 PlaybooksPurview · SharePoint · Teams · Exchange· Plan · Label policies
Design label policies that fit how people work
Purpose
Decide what people actually experience when labels arrive: which labels they see, what is labelled for them, when they are asked to choose, and when they have to explain a change. Labels describe sensitivity; label policies decide whether people use them well. Policies that fit how people work keep content labelled without slowing anyone down, while policies that fight them teach people to click whatever makes the prompt go away.
Overview
Who sees which labels, the default label, mandatory labelling, justification and attachment inheritance, decided with as few policies as possible.
- Effort
- About 5 to 8 person-days
- Duration
- 2 to 4 weeks
- Complexity
- Low
- Who's in the room
- Taxonomy owner, Purview admin, Microsoft 365 Apps admin, communications lead, representatives of groups with special needs
- Licensing
- Label policies come with manual labelling, included in Microsoft 365 E3, E5 and Business Premium, and Office 365 E3 and E5. Microsoft's service description doesn't license each policy setting separately; check it for the settings you plan to use.
Risk of not doing it
Without deliberate policy settings, labels either go unused or interrupt people constantly, and the most common response to both is the lowest label that closes the prompt.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Start from the approved label taxonomy
Label policies publish labels; they don't define them. Work from the approved label specification: names, protection and priority order. Two policy settings depend directly on it. A parent label with sublabels can't be applied, so it can never be a default, and Microsoft advises against a default label that encrypts documents. Note which labels are safe defaults before you start.
Find the groups with genuinely different needs
Most people need the same labels and the same behaviour. Look for the exceptions: a team that handles information only it should be able to label, such as legal privilege or board papers, or a group that must label every item. Policies can target mail-enabled and non-mail-enabled security groups, distribution groups and Microsoft 365 groups, including groups with dynamic membership, and can be limited to administrative units. Microsoft recommends groups over individual users.
Check which Office versions you run
Several policy settings depend on the app version. For example, applying a default label to existing documents needs Microsoft 365 Apps on Current Channel 2208, Monthly Enterprise Channel 2207 or Semi-Annual Enterprise Channel 2302 or later on Windows, version 16.63 or later on Mac, is an opt-in on the web, and isn't available on iOS or Android. Microsoft keeps a minimum versions table; compare it with your update channels so the policy behaves the same for everyone.
Decisions
Decision: How many label policies?
Microsoft's advice is to have as few label policies as possible, and notes it isn't unusual to have just one for the whole organization. When someone is in more than one policy they get all the labels from all of them, and where settings conflict the policy with the highest priority wins, setting by setting. That is easy to get wrong and hard to explain to a user, so add a second policy only for a real difference in labels or behaviour.
Options
- One policy per department
- One policy for everyone, plus a policy only where labels or settings genuinely differ
- One policy only, with no exceptions
Recommended default: One policy for everyone, plus a policy only where labels or settings genuinely differ
Decision: What is labelled by default?
A policy can set separate defaults for documents and Loop components, for emails and meeting invites, for meetings, for new groups and sites, and for Power BI content. Outlook can also have its own default, independent of the one for documents. A non-encrypting default such as General labels new content without anyone choosing and is what Microsoft's own example policy uses. Decide the default for documents and email here; defaults for meetings, containers and Power BI belong with those deployments.
Options
- No default label
- A non-encrypting default such as General for documents and email
- An encrypting label as the default
Recommended default: A non-encrypting default such as General for documents and email
Decision: Is labelling mandatory?
Mandatory labelling asks people to choose a label when they open or save an unlabelled document and before they send an email. Existing unlabelled documents can be opened read-only instead. Once a label is applied it can be changed but not removed, and Print to PDF isn't available, because that option removes the label. The default label always takes priority over the mandatory prompt, and Microsoft warns that mandatory labelling without a default frustrates people. Outlook can be left out of mandatory labelling while documents stay in.
Options
- Mandatory for everyone, with no default
- Not mandatory; rely on the default label
- Mandatory only for groups that must label everything, with a default
Recommended default: Mandatory only for groups that must label everything, with a default
Decision: Ask for a reason when a label is removed or lowered?
For files, emails and meetings, people must by default give a justification when they remove a label or choose one with a lower priority; groups and sites are not included. Office asks once per app session, so it is a light touch. The reasons are what make downgrades reviewable later, so keep it on unless you have a strong reason not to.
Options
- Turn justification off
- Keep justification on
Recommended default: Keep justification on
Decision: Should email take the label of its attachments?
A policy can make an email inherit the highest-priority label of its attachments, or only recommend it. The attachment has to be an actual file, not a link to one, and a label someone chose for the email by hand is never replaced. Recommending first shows people the connection between file and email labels without surprising them.
Options
- No inheritance
- Recommend the attachment's label
- Apply the attachment's label automatically
Recommended default: Recommend the attachment's label
Pilot configuration
Write the policy matrix and test it
Put every policy in one table: who it targets, which labels it publishes, and each setting with its value. Then walk a few people through real situations: opening an old unlabelled document, saving a new one, replying to an email with a labelled attachment, lowering a label. Watch for prompts that surprise them; those are the settings to reconsider. Include at least one person from each group with its own policy, and one person who belongs to two groups, so you see how overlapping policies combine in practice.
Point the help link at your guide
A label policy can show a link to your own help page after the list of labels in Office apps. Make sure the one-page labelling guide explains what the default does, why a reason is sometimes requested, and what to do if a label blocks work.
Production configuration
Approve the policies and hand them to Deploy
Have the taxonomy owner approve the matrix and hand it to the deployment team with the order of publishing. Remember that policy changes take up to 24 hours to reach apps, and up to 48 hours when group membership is involved, so every later change needs the same planning. Agree, too, who may change a policy later and how: a policy change reaches everyone in its scope at once, so it deserves the same care as a label change, with the taxonomy owner's approval and a note to the service desk before it lands.
Make it enforceable
Once published, label policies are the enforcement: apps apply the default label, prompt where labelling is mandatory, and ask for a reason before a label is lowered, without anyone having to remember. Devices on Office versions older than the minimums don't get every setting, so they stay a gap until updated.
Partly enforced. The gaps are a risk until a mechanism covers them.
Approval and readiness
Draft the policy matrix
One row per policy and setting, built from the decisions above.
Move on when: Every setting has a value and a reason
Walk through real situations with a few peopleChange: Explain
Test the prompts people will see on their own documents and email. Use their own documents and mailboxes rather than test content, and note every prompt that made them pause.
Move on when: No prompt surprises the testers
Confirm app versions
Compare the settings you chose with the minimum versions table and your update channels.
Move on when: Gaps are listed with a plan to close them
Approve with the taxonomy ownerChange: Inform
Sign off the matrix and the publishing order.
Move on when: The matrix is approved and in the Deploy backlog
Common challenges
If youCreate a policy for every department
What tends to happenPeople in several groups get settings from whichever policy has the highest priority, and nobody can explain why their prompts differ from a colleague's.
A better approachStart with one policy and add another only for a real difference in labels or behaviour.
If youTurn on mandatory labelling with no default
What tends to happenEvery new document and email interrupts people, and they choose whatever label closes the prompt fastest.
A better approachSet a non-encrypting default first; keep mandatory labelling for the groups that truly need it.
If youUse a parent label or an encrypting label as the default
What tends to happenA parent label can't be applied at all, and an encrypting default makes everyday documents hard to share and co-edit.
A better approachChoose a non-encrypting label that can be applied by itself, such as General.
If youForget that Outlook has its own settings
What tends to happenDocuments behave as planned, but email prompts on every send or gets no default at all.
A better approachDecide Outlook's default and mandatory settings explicitly in the matrix.
If youIgnore app versions
What tends to happenThe same policy behaves differently on different devices, and the service desk can't reproduce what people report.
A better approachCheck the minimum versions table against your update channels before publishing.
If youAdjust policy settings in response to every complaint
What tends to happenSettings change every few weeks, the guide falls behind, and people stop trusting what the prompts mean.
A better approachCollect feedback and change policies at the quarterly review, unless something is blocking work.
Checkpoints
Pilot
- Is every setting in the policy matrix decided, with a reason?
- Did testers meet any prompt they didn't expect?
- Do the app versions in use support the settings you chose?
Production
- Is the number of policies as small as the real differences allow?
- Is the default label one that can be applied by itself and doesn't encrypt?
- Does the help link point to a current guide?
- Is the matrix approved and scheduled for Deploy?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| Label policies in use | Purview portal (aim for as few as possible) | Steady |
| Labels applied by default rather than chosen | Activity explorer or the audit log | Steady |
| Label removals and downgrades with a reason | Activity explorer | Steady |
| Service desk tickets about label prompts | Service desk | Down |
Ready-to-use text
Policy matrix columns
Policy name | Targets (groups) | Labels published | Default for documents | Default for email | Mandatory: documents / email | Justification to lower | Email inherits from attachments | Help link | Owner | Last reviewed
Help page: why am I being asked?
Most of what you create is labelled General for you. You'll only be asked to choose a label when [mandatory rule], and you'll be asked for a short reason when you remove a label or choose a lower one, so we can improve the labels. If a label stops you doing your work, tell us at [channel].
Additional reading
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-15. |