M365 PlaybooksPurview· Refine
Extend labels to sites, Teams and automatic labelling
Purpose
Close the gaps that manual labelling leaves: files stored before labels existed, content people forget to label, and sites and Teams whose sharing settings don't match what they hold. Extending labels to containers, to stored content and to DLP turns labels from a marking people choose into protection the organization can rely on, including for what Copilot can surface and create.
Overview
Container labels for sites and Teams, automatic labelling run in simulation first, default labels for sensitive libraries, and labels used in DLP.
- Effort
- About 20 to 30 person-days
- Duration
- 8 to 12 weeks
- Complexity
- High
- Who's in the room
- Purview admin, SharePoint and Teams admin, Entra admin, security analyst, taxonomy owner, owners of pilot sites and Teams
- Licensing
- Applying labels manually is included in Microsoft 365 E3, E5 and Business Premium, and Office 365 E3 and E5. Automatic labelling, default labels for SharePoint libraries, labels for scheduled meetings and the activity and data explorer reports need Microsoft 365 E5, Microsoft Purview Suite, or Microsoft 365 E5 Information Protection and Governance. Labels for sites, groups and Teams also need Microsoft Entra ID P1.
Risk of not doing it
Without it, older and unlabelled content stays invisible to label-based protection, and sensitive sites keep sharing settings that don't match what they hold.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Confirm manual labelling is stable
Automatic labelling amplifies whatever your labels already do, good or bad. Before extending them, check with the Maintain stage that labels are widely used, downgrade patterns are understood, and the taxonomy hasn't changed in the last quarter. If people still confuse two labels, fix that first; automation will only confuse them at a larger scale.
Check licences and platform settings
Automatic labelling and default labels for document libraries need an E5-level licence. Labels for sites, groups and Teams must be turned on in Microsoft Entra ID (which needs at least one Entra ID P1 licence) and then synchronized to Purview. Labelling PDF files in SharePoint and OneDrive is a separate setting that must be turned on, and signed PDFs can't be labelled. Microsoft Learn has the steps for each.
Decisions
Decision: Same labels for sites and files, or separate ones?
A label applied to a site, group or team controls the container: privacy, guest access, external sharing, and access from unmanaged devices (with Conditional Access). It does not label the files inside; those keep their own labels. Container settings and file protection are different things, so many organizations scope a short set of labels to groups and sites only, which keeps both pickers short and clear.
Options
- Reuse every file label for containers
- A short set of labels scoped to groups and sites only
Recommended default: A short set of labels scoped to groups and sites only
Decision: Recommend or apply labels automatically in Office apps?
Client-side automatic labelling works while people write: when content matches a condition, such as a sensitive information type, the app can recommend a label or apply it. A label someone applied by hand is never replaced by automatic labelling. Recommending teaches people what the label is for; applying automatically is better kept for high-confidence matches where a missed label would cause real harm.
Options
- Apply automatically for every match
- Recommend first; apply automatically only for high-confidence matches
- No client-side automatic labelling
Recommended default: Recommend first; apply automatically only for high-confidence matches
Decision: Which stored content do service-side policies label first?
Service-side auto-labelling policies label content already stored in SharePoint, OneDrive and Exchange, without anyone opening it. They must run in simulation at least once before they can label anything, and a simulation takes about 12 hours. A tenant can label up to 500,000 files a day across up to 100 policies. Start where the risk is highest, using data explorer to find sites with the most sensitive content, and widen from there.
Options
- Everything at once
- Highest-risk sites and mailboxes first, widened in waves
- No service-side labelling
Recommended default: Highest-risk sites and mailboxes first, widened in waves
Decision: Default labels for sensitive libraries?
A document library can have a default sensitivity label. New files, and existing files when they are edited, get it if they have no label or a lower-priority one. It never replaces a label applied by hand, and it doesn't reach files at rest that nobody edits; a separate auto-labelling policy can apply the library default to existing files in a limited number of sites. It suits libraries where almost everything belongs at one level, such as HR case files or board papers.
Options
- No library defaults
- Default labels on libraries where almost everything belongs at one level
Recommended default: Default labels on libraries where almost everything belongs at one level
Pilot configuration
Label pilot sites and Teams
Apply container labels to a handful of sites and Teams whose owners have agreed to take part, covering at least one that works with guests. Confirm that sharing, guest access and access from personal devices behave as the label intends, and ask each owner whether anything their members do every week stopped working. Microsoft advises against changing a label's site and group settings once it has been applied, so settle them in the pilot.
Run automatic labelling in simulation
Create the service-side policies in simulation and review the matched items with the owners of that content. Tune the conditions until the matches are ones the owners agree with, then turn on client-side recommendations for the pilot group and collect their feedback on wrong suggestions.
Production configuration
Turn on and extend by workload
Turn on the service-side policies for pilot locations, then extend by workload: container labels to new and existing sites and Teams, library defaults where agreed, and auto-labelling policies to the next tier of locations. Hold each step until owners confirm nothing was labelled wrongly, and keep an eye on the daily labelling limit when a large wave of sites goes live at once.
Use labels in DLP and prepare for Copilot
Sensitivity labels can be conditions in DLP policies, for example to stop Highly Confidential files being shared outside the organization. With Copilot, the highest-priority label from source files is inherited by content Copilot generates, and an inherited label can replace a lower-priority label someone applied by hand. Tell people why a summary can arrive more sensitive than they expected.
Feed what you learned back into Plan
Simulation results, false positives and container decisions all say something about the taxonomy. A condition that matches far more content than expected may mean a label is too broad; a label nobody's content ever matches may not be needed. Bring these findings to the taxonomy owner with examples, so the next Plan cycle starts from evidence rather than opinion. Refine feeds Plan.
Make it enforceable
Service-side auto-labelling policies label stored content in SharePoint, OneDrive and Exchange without waiting for people, library defaults cover new and edited files in sensitive libraries, container labels enforce sharing and access settings on sites and Teams, and DLP policies use labels to stop the riskiest sharing.
Enforced by a mechanism.
Trial to adoption
Rollout approachBy workload · Pilot size: 5 to 10 sites and Teams, and one or two auto-labelling policies in simulation
Containers, client-side labelling, service-side policies and DLP each behave differently and fail differently. Extending one workload at a time keeps cause and effect clear when something goes wrong.
Make your pilot representative
- Every major role, not only IT and enthusiasts
- More than one location or time zone
- Heavy users of the workload you are changing
- People who handle sensitive information
- At least one team you expect to be sceptical
Recruit pilot site and Team ownersChange: Inform
Explain what will change on their sites and how to report a problem.
Move on when: Owners agree and know where to report
Simulate automatic labellingChange: Explain
Run service-side policies in simulation and review a sample of the matches with the people who own that content. Tune the conditions and run the simulation again until owners agree with what it finds.
Move on when: Matches are reviewed and false positives tuned
Label pilot containersChange: Explain
Apply container labels and confirm sharing, guest and device access.
Move on when: Owners confirm their sites work as intended
Turn on for pilot locationsChange: Explain
Switch pilot auto-labelling policies on and turn on client-side recommendations for the pilot group.
Move on when: Two weeks with no unresolved wrong labels
Extend by workload
Extend container labels, then library defaults, then the next tier of auto-labelling locations, one workload at a time. Check the service desk and content owners before each step.
Move on when: Each workload settles before the next starts
Bring DLP and Copilot guidance onlineChange: Sustain
Add label conditions to DLP and publish guidance on Copilot and labels.
Move on when: DLP rules using labels are enforced and the guidance is published
Common challenges
If youExpect a site label to label the files inside
What tends to happenLeadership believes the HR site is protected, but its files carry whatever label, or none, people gave them.
A better approachUse container labels for the site's settings, and library defaults or auto-labelling for the files.
If youTurn auto-labelling on straight after simulation finishes
What tends to happenThousands of files get the wrong label in a day, and content owners lose trust in labels.
A better approachReview simulation matches with the content owners and tune before turning anything on.
If youAuto-apply an encrypting label broadly
What tends to happenPeople and partners suddenly can't open files they used yesterday.
A better approachStart automatic labelling with labels that mark but don't encrypt, and widen encryption only where owners agree.
If youChange a container label's settings after it's in use
What tends to happenSites labelled earlier and later behave differently, and nobody can explain why.
A better approachSettle container settings in the pilot; if they must change, create a new label and move sites deliberately.
If youForget that Copilot inherits labels
What tends to happenPeople are surprised when a summary arrives labelled Highly Confidential, and remove the label.
A better approachExplain inheritance in the labelling guide before Copilot reaches the wider organization.
Checkpoints
Pilot
- Are container labels and PDF labelling enabled where needed?
- Did every auto-labelling policy run in simulation, with matches reviewed by content owners?
- Do pilot sites and Teams share and allow access as their labels intend?
Production
- Are planned workloads extended, one at a time?
- Do sensitive libraries have agreed default labels?
- Do DLP policies use labels for the riskiest sharing?
- Is guidance on Copilot and labels published?
- Have findings gone back to the taxonomy owner?
- Do owners of labelled sites know what their label controls and whom to ask about it?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| Stored files with a sensitivity label | Data explorer | Up |
| Sites and Teams with a container label | Audit log (site label events) | Up |
| Wrong automatic labels reported | Service desk and content owners | Down |
| Highly Confidential files shared outside the organization | DLP reports in activity explorer | Down |
Ready-to-use text
Invitation to pilot site owners
We'd like your site to be part of a small pilot for site labels. A label on your site will set who can be invited and how it can be shared, based on how sensitive its content is. Your files and permissions stay as they are. We'll check with you before and after, and you can report anything odd at [channel].
Guidance: Copilot and labels
Copilot works with the same labels you do. It only uses content you're allowed to open, and when it creates something from labelled files, the new content takes the most sensitive of their labels. So a summary of a Highly Confidential report is Highly Confidential too. If the label on something Copilot made looks too high, check where the content came from before you lower it.
Explaining automatic labels
You may notice that some files now have a label you didn't apply. Microsoft 365 adds labels automatically when a file contains information such as [examples]. If a label looks wrong, change it and give a short reason; we review these reasons to improve the rules.
Additional reading
Configure
- Automatically apply a sensitivity label to Microsoft 365 data
- Use sensitivity labels to protect collaborative workspaces (groups and sites)
- Assign sensitivity labels to groups in Microsoft Entra ID
- Configure a default sensitivity label for a SharePoint document library
- Use sensitivity labels as conditions in DLP policies
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-15. |