# Extend labels to sites, Teams and automatic labelling - URL: https://m365playbooks.com/playbooks/extend-labels-to-sites-teams-and-automatic-labelling/ - Topic: Sensitivity labels (Program) - Product: Purview - Stage: Refine - Last reviewed: October 15, 2026 - Version: 1 - Written by: Sev Derghazarian ## 1. Purpose Close the gaps that manual labelling leaves: files stored before labels existed, content people forget to label, and sites and Teams whose sharing settings don't match what they hold. Extending labels to containers, to stored content and to DLP turns labels from a marking people choose into protection the organization can rely on, including for what Copilot can surface and create. ## 2. Overview Container labels for sites and Teams, automatic labelling run in simulation first, default labels for sensitive libraries, and labels used in DLP. - Effort: About 20 to 30 person-days - Duration: 8 to 12 weeks - Complexity: High - Who's in the room: Purview admin, SharePoint and Teams admin, Entra admin, security analyst, taxonomy owner, owners of pilot sites and Teams - Licensing: Applying labels manually is included in Microsoft 365 E3, E5 and Business Premium, and Office 365 E3 and E5. Automatic labelling, default labels for SharePoint libraries, labels for scheduled meetings and the activity and data explorer reports need Microsoft 365 E5, Microsoft Purview Suite, or Microsoft 365 E5 Information Protection and Governance. Labels for sites, groups and Teams also need Microsoft Entra ID P1. - Risk of not doing it: Without it, older and unlabelled content stays invisible to label-based protection, and sensitive sites keep sharing settings that don't match what they hold. ## 3. Key activities ### Prerequisites 1. **Confirm manual labelling is stable** Automatic labelling amplifies whatever your labels already do, good or bad. Before extending them, check with the Maintain stage that labels are widely used, downgrade patterns are understood, and the taxonomy hasn't changed in the last quarter. If people still confuse two labels, fix that first; automation will only confuse them at a larger scale. Who: Taxonomy owner. Produces: A go-ahead from the latest Maintain review. 2. **Check licences and platform settings** Automatic labelling and default labels for document libraries need an E5-level licence. Labels for sites, groups and Teams must be turned on in Microsoft Entra ID (which needs at least one Entra ID P1 licence) and then synchronized to Purview. Labelling PDF files in SharePoint and OneDrive is a separate setting that must be turned on, and signed PDFs can't be labelled. Microsoft Learn has the steps for each. Who: Purview admin with the Entra admin. Produces: Licences confirmed and container and PDF labelling enabled. ### Decisions 3. **Decision: Same labels for sites and files, or separate ones?** A label applied to a site, group or team controls the container: privacy, guest access, external sharing, and access from unmanaged devices (with Conditional Access). It does not label the files inside; those keep their own labels. Container settings and file protection are different things, so many organizations scope a short set of labels to groups and sites only, which keeps both pickers short and clear. Options: Reuse every file label for containers; A short set of labels scoped to groups and sites only. Recommended default: A short set of labels scoped to groups and sites only. Who: Taxonomy owner. Produces: A container label set with settings for each label. 4. **Decision: Recommend or apply labels automatically in Office apps?** Client-side automatic labelling works while people write: when content matches a condition, such as a sensitive information type, the app can recommend a label or apply it. A label someone applied by hand is never replaced by automatic labelling. Recommending teaches people what the label is for; applying automatically is better kept for high-confidence matches where a missed label would cause real harm. Options: Apply automatically for every match; Recommend first; apply automatically only for high-confidence matches; No client-side automatic labelling. Recommended default: Recommend first; apply automatically only for high-confidence matches. Who: Taxonomy owner with the security analyst. Produces: Conditions and behaviour for each label that uses automatic labelling. 5. **Decision: Which stored content do service-side policies label first?** Service-side auto-labelling policies label content already stored in SharePoint, OneDrive and Exchange, without anyone opening it. They must run in simulation at least once before they can label anything, and a simulation takes about 12 hours. A tenant can label up to 500,000 files a day across up to 100 policies. Start where the risk is highest, using data explorer to find sites with the most sensitive content, and widen from there. Options: Everything at once; Highest-risk sites and mailboxes first, widened in waves; No service-side labelling. Recommended default: Highest-risk sites and mailboxes first, widened in waves. Who: Security analyst. Produces: A prioritized list of locations and policies. 6. **Decision: Default labels for sensitive libraries?** A document library can have a default sensitivity label. New files, and existing files when they are edited, get it if they have no label or a lower-priority one. It never replaces a label applied by hand, and it doesn't reach files at rest that nobody edits; a separate auto-labelling policy can apply the library default to existing files in a limited number of sites. It suits libraries where almost everything belongs at one level, such as HR case files or board papers. Options: No library defaults; Default labels on libraries where almost everything belongs at one level. Recommended default: Default labels on libraries where almost everything belongs at one level. Who: Taxonomy owner with site owners. Produces: A list of libraries and their default labels. ### Pilot configuration 7. **Label pilot sites and Teams** Apply container labels to a handful of sites and Teams whose owners have agreed to take part, covering at least one that works with guests. Confirm that sharing, guest access and access from personal devices behave as the label intends, and ask each owner whether anything their members do every week stopped working. Microsoft advises against changing a label's site and group settings once it has been applied, so settle them in the pilot. Who: SharePoint and Teams admin with site owners. Produces: Pilot containers labelled and behaviour confirmed. 8. **Run automatic labelling in simulation** Create the service-side policies in simulation and review the matched items with the owners of that content. Tune the conditions until the matches are ones the owners agree with, then turn on client-side recommendations for the pilot group and collect their feedback on wrong suggestions. Who: Security analyst with content owners. Produces: Tuned policies and a record of false positives. ### Production configuration 9. **Turn on and extend by workload** Turn on the service-side policies for pilot locations, then extend by workload: container labels to new and existing sites and Teams, library defaults where agreed, and auto-labelling policies to the next tier of locations. Hold each step until owners confirm nothing was labelled wrongly, and keep an eye on the daily labelling limit when a large wave of sites goes live at once. Who: Purview admin. Produces: Labels extended across the planned workloads. 10. **Use labels in DLP and prepare for Copilot** Sensitivity labels can be conditions in DLP policies, for example to stop Highly Confidential files being shared outside the organization. With Copilot, the highest-priority label from source files is inherited by content Copilot generates, and an inherited label can replace a lower-priority label someone applied by hand. Tell people why a summary can arrive more sensitive than they expected. Who: Purview admin with the security analyst. Produces: DLP policies that use labels, and guidance on Copilot and labels. 11. **Feed what you learned back into Plan** Simulation results, false positives and container decisions all say something about the taxonomy. A condition that matches far more content than expected may mean a label is too broad; a label nobody's content ever matches may not be needed. Bring these findings to the taxonomy owner with examples, so the next Plan cycle starts from evidence rather than opinion. Refine feeds Plan. Who: Taxonomy owner. Produces: Taxonomy changes proposed for the next review. 12. **Make it enforceable** Service-side auto-labelling policies label stored content in SharePoint, OneDrive and Exchange without waiting for people, library defaults cover new and edited files in sensitive libraries, container labels enforce sharing and access settings on sites and Teams, and DLP policies use labels to stop the riskiest sharing. _Enforced by a mechanism._ ## 4. Trial to adoption **Rollout approach:** By workload (Pilot size: 5 to 10 sites and Teams, and one or two auto-labelling policies in simulation). Containers, client-side labelling, service-side policies and DLP each behave differently and fail differently. Extending one workload at a time keeps cause and effect clear when something goes wrong. 1. **Recruit pilot site and Team owners** (Change: Inform) Explain what will change on their sites and how to report a problem. Move on when: Owners agree and know where to report. 2. **Simulate automatic labelling** (Change: Explain) Run service-side policies in simulation and review a sample of the matches with the people who own that content. Tune the conditions and run the simulation again until owners agree with what it finds. Move on when: Matches are reviewed and false positives tuned. 3. **Label pilot containers** (Change: Explain) Apply container labels and confirm sharing, guest and device access. Move on when: Owners confirm their sites work as intended. 4. **Turn on for pilot locations** (Change: Explain) Switch pilot auto-labelling policies on and turn on client-side recommendations for the pilot group. Move on when: Two weeks with no unresolved wrong labels. 5. **Extend by workload** Extend container labels, then library defaults, then the next tier of auto-labelling locations, one workload at a time. Check the service desk and content owners before each step. Move on when: Each workload settles before the next starts. 6. **Bring DLP and Copilot guidance online** (Change: Sustain) Add label conditions to DLP and publish guidance on Copilot and labels. Move on when: DLP rules using labels are enforced and the guidance is published. ## 5. Common challenges - **If you** Expect a site label to label the files inside. What tends to happen: Leadership believes the HR site is protected, but its files carry whatever label, or none, people gave them.. A better approach: Use container labels for the site's settings, and library defaults or auto-labelling for the files. - **If you** Turn auto-labelling on straight after simulation finishes. What tends to happen: Thousands of files get the wrong label in a day, and content owners lose trust in labels.. A better approach: Review simulation matches with the content owners and tune before turning anything on. - **If you** Auto-apply an encrypting label broadly. What tends to happen: People and partners suddenly can't open files they used yesterday.. A better approach: Start automatic labelling with labels that mark but don't encrypt, and widen encryption only where owners agree. - **If you** Change a container label's settings after it's in use. What tends to happen: Sites labelled earlier and later behave differently, and nobody can explain why.. A better approach: Settle container settings in the pilot; if they must change, create a new label and move sites deliberately. - **If you** Forget that Copilot inherits labels. What tends to happen: People are surprised when a summary arrives labelled Highly Confidential, and remove the label.. A better approach: Explain inheritance in the labelling guide before Copilot reaches the wider organization. ## 6. Checkpoints **Pilot:** - [ ] Are container labels and PDF labelling enabled where needed? - [ ] Did every auto-labelling policy run in simulation, with matches reviewed by content owners? - [ ] Do pilot sites and Teams share and allow access as their labels intend? **Production:** - [ ] Are planned workloads extended, one at a time? - [ ] Do sensitive libraries have agreed default labels? - [ ] Do DLP policies use labels for the riskiest sharing? - [ ] Is guidance on Copilot and labels published? - [ ] Have findings gone back to the taxonomy owner? - [ ] Do owners of labelled sites know what their label controls and whom to ask about it? ## 7. Success measures Capture a baseline before you start, or you won't be able to show the change. - Stored files with a sensitivity label (Where you see it: Data explorer; Good direction: Up) - Sites and Teams with a container label (Where you see it: Audit log (site label events); Good direction: Up) - Wrong automatic labels reported (Where you see it: Service desk and content owners; Good direction: Down) - Highly Confidential files shared outside the organization (Where you see it: DLP reports in activity explorer; Good direction: Down) **Ready-to-use text: Invitation to pilot site owners** > We'd like your site to be part of a small pilot for site labels. A label on your site will set who can be invited and how it can be shared, based on how sensitive its content is. Your files and permissions stay as they are. We'll check with you before and after, and you can report anything odd at [channel]. **Ready-to-use text: Guidance: Copilot and labels** > Copilot works with the same labels you do. It only uses content you're allowed to open, and when it creates something from labelled files, the new content takes the most sensitive of their labels. So a summary of a Highly Confidential report is Highly Confidential too. If the label on something Copilot made looks too high, check where the content came from before you lower it. **Ready-to-use text: Explaining automatic labels** > You may notice that some files now have a label you didn't apply. Microsoft 365 adds labels automatically when a file contains information such as [examples]. If a label looks wrong, change it and give a short reason; we review these reasons to improve the rules. ## 8. Additional reading **Plan:** - [Considerations for Microsoft Purview to manage Microsoft 365 Copilot](https://learn.microsoft.com/en-us/purview/ai-m365-copilot-considerations) **Configure:** - [Automatically apply a sensitivity label to Microsoft 365 data](https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically) - [Use sensitivity labels to protect collaborative workspaces (groups and sites)](https://learn.microsoft.com/en-us/purview/sensitivity-labels-teams-groups-sites) - [Assign sensitivity labels to groups in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/users/groups-assign-sensitivity-labels) - [Configure a default sensitivity label for a SharePoint document library](https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-default-label) - [Use sensitivity labels as conditions in DLP policies](https://learn.microsoft.com/en-us/purview/dlp-sensitivity-label-as-condition) **Monitor:** - [Get started with data explorer](https://learn.microsoft.com/en-us/purview/data-classification-data-explorer) - [Microsoft Purview posture reports overview](https://learn.microsoft.com/en-us/purview/purview-reports) ## Changelog - Version 1, 2026-10-15, Sev Derghazarian: First version. Facts checked against Microsoft Learn on 2026-10-15.