# Keep labels accurate and in use - URL: https://m365playbooks.com/playbooks/keep-labels-accurate-and-in-use/ - Topic: Sensitivity labels (Program) - Product: Purview - Stage: Maintain - Last reviewed: October 15, 2026 - Version: 1 - Written by: Sev Derghazarian ## 1. Purpose Keep labels meaning what they are supposed to mean. Labels are only useful while people apply them correctly and the taxonomy still matches how the organization works. Without a rhythm of review, labels quietly drift: people lower them to get past a prompt, unused labels pile up, and the controls built on top of them (DLP, encryption, Copilot protections) end up resting on data nobody trusts. ## 2. Overview A monthly review of downgrades and label use, a quarterly taxonomy review, and a safe way to change or retire labels. - Effort: About 2 to 4 person-days a month - Duration: Ongoing; first cycle in 4 to 6 weeks - Complexity: Low - Who's in the room: Taxonomy owner, security analyst, Purview admin, communications lead, service desk lead - Licensing: Applying labels manually is included in Microsoft 365 E3, E5 and Business Premium, and Office 365 E3 and E5. Automatic labelling, default labels for SharePoint libraries, labels for scheduled meetings and the activity and data explorer reports need Microsoft 365 E5, Microsoft Purview Suite, or Microsoft 365 E5 Information Protection and Governance. - Risk of not doing it: Labels drift until they mean nothing, and a careless change or deletion can lock people out of encrypted content or strip its protection. ## 3. Key activities ### Prerequisites 1. **Give reviewers the right access** With an E5-level licence, activity explorer shows label activity (applied, changed, lowered, removed) and data explorer shows where labelled content sits. Access comes from the Information Protection role groups; seeing item names and contents in data explorer needs separate viewer roles that don't include each other. Grant the least access each reviewer needs, and review those role assignments at the quarterly review, since the people who can read item names and contents can see sensitive material. Without E5, label activity is still recorded in the audit log under sensitivity label activities. Who: Purview admin. Produces: Named reviewers with least-privilege access. 2. **Capture a baseline** At handover from the Deploy stage, record how many new documents and emails carry a label, how labels are distributed, and how many labels are lowered or removed each month. Activity explorer reports on up to 30 days of data, so export a snapshot every month; otherwise trends disappear before anyone looks at them. Who: Security analyst. Produces: A baseline and a monthly export routine. ### Decisions 3. **Decision: How often do you review?** Downgrades and service desk themes change month to month; the taxonomy itself changes slowly. Splitting the two keeps the monthly review short and gives the taxonomy owner a regular, predictable moment to decide on changes instead of reacting to individual requests. It also gives everyone a simple answer to "can we add a label for this?": bring it to the next quarterly review, with an example of what people can't do today. Ad hoc reviews only happen after something has gone wrong, and annual reviews let a year of drift build up before anyone looks. Options: Only when something goes wrong; Once a year; Monthly activity review and quarterly taxonomy review. Recommended default: Monthly activity review and quarterly taxonomy review. Who: Taxonomy owner. Produces: A review calendar. 4. **Decision: Which downgrades do you follow up?** People are asked for a reason when they remove a label or choose a lower one, and admins can read that reason with the label change in activity explorer (except for files in SharePoint and OneDrive, where the reason isn't captured). Microsoft points to one pattern worth investigating: a large number of items labelled Highly Confidential being lowered to General. Most individual downgrades are honest corrections, so look for patterns, not people. Options: Every downgrade; Patterns: many items lowered from the top tier, or one person or team repeatedly; None. Recommended default: Patterns: many items lowered from the top tier, or one person or team repeatedly. Who: Security analyst. Produces: A short list of downgrade patterns that trigger follow-up. 5. **Decision: How are labels changed or retired?** Label changes take up to 24 hours to reach apps, and encryption changes reach existing files unevenly: files in SharePoint and OneDrive update when next opened, while other copies keep their old protection unless they are relabelled. Removing a label from its policy stops people choosing it but leaves it on existing content, which Microsoft describes as less risky than deleting. Deleting a label archives its encryption template so protected files can still be opened, but in SharePoint and OneDrive the encryption can be removed. Make every change through the taxonomy owner, and always remove a label from policy before considering deletion. Options: Admins edit or delete labels as needed; Changes through the taxonomy owner; remove from policy before any deletion. Recommended default: Changes through the taxonomy owner; remove from policy before any deletion. Who: Taxonomy owner with the Purview admin. Produces: A written change and retirement procedure. ### Pilot configuration 6. **Run the first monthly review** Bring together the downgrade patterns from activity explorer, the label distribution from data explorer, and the service desk's label tickets. Expect data explorer counts to lag: they can take up to seven days to update, and up to fourteen for files in SharePoint. Keep the meeting to 30 minutes and leave with actions, not observations. Who: Security analyst with the taxonomy owner. Produces: Review notes with owners and dates for each action. 7. **Fix causes, not people** When a team keeps lowering labels, the usual cause is a tooltip that doesn't fit their work or a label that blocks something they need to do. Talk to them, then fix the tooltip, the guide or the label. Send a short, friendly note to the team rather than a warning; people who are punished for honest downgrades stop labelling honestly. Who: Communications lead with the taxonomy owner. Produces: Updated guidance and a closed loop with each team. ### Production configuration 8. **Run the quarterly taxonomy review** Look at which labels are rarely used (candidates to merge or retire), which are often confused, and whether new obligations, partners or projects need something the labels don't cover. Microsoft describes information protection as iterative and often circular rather than a one-time deployment. Keep the taxonomy within five main labels; adding a label is the last resort. Who: Taxonomy owner. Produces: Recorded decisions on any label changes. 9. **Watch for files more sensitive than their site** When a file is uploaded to a site whose label has a lower priority than the file's own label, SharePoint records a document sensitivity mismatch in the audit log. A steady trickle is normal; a cluster on one site usually means the site is holding more sensitive work than it was set up for. Raise those with the site owner: either the content belongs somewhere else, or the site needs a higher label. Who: Security analyst with site owners. Produces: Mismatch clusters reviewed with site owners. 10. **Keep the guide and onboarding current** Update the labelling guide and its help link whenever a label changes, and make labels part of onboarding so new staff learn them in their first week rather than from a prompt. Keep the examples in the guide fresh: swap in examples from the questions the service desk actually receives, because people recognize their own situations far faster than generic ones. When a label is retired, say so in the guide for a few months, along with what to use instead, so people who see the old label on existing files know what it meant. Who: Communications lead. Produces: A current guide and onboarding module. 11. **Report to leadership twice a year** Show the trend in labelled content, notable downgrade patterns and what was done about them, and any taxonomy changes. Keep it to one page; the point is to keep a sponsor engaged, not to report every number. Close with one decision you need from leadership, even a small one, such as endorsing a label retirement or a reminder campaign. A report that asks for nothing is easy to stop reading. Who: Taxonomy owner. Produces: A one-page label health report. 12. **Make it enforceable** Only the Information Protection role groups can change labels, and the change and retirement procedure routes every change through the taxonomy owner, with labels removed from policy before any deletion. The procedure itself depends on people following it, so the monthly review also checks the audit log for label changes made outside it. _Partly enforced. The gaps are a risk until a mechanism covers them._ ## 4. Operating rhythm 1. **Monthly: review downgrades and removals** Check activity explorer or the audit log against the agreed downgrade patterns, note any label changes made outside the procedure, and export the month's data before it ages out of the 30-day window. Move on when: Every pattern found has an owner and a follow-up date. 2. **Monthly: review service desk themes** (Change: Explain) Group label tickets by cause: wrong label, can't open, can't share, can't remove. A cause that appears three months in a row is a design problem, not a training problem. Move on when: Recurring causes have a fix scheduled. 3. **Quarterly: review the taxonomy** Bring three months of exports, mismatch clusters and change requests. Decide on merges, retirements, renames and tooltip changes, and schedule any change through the procedure. Move on when: Decisions are recorded and changes scheduled through the procedure. 4. **Quarterly: refresh guidance and reminders** (Change: Sustain) Update the guide and send one short, useful reminder to the teams that need it. Move on when: The guide matches the labels people see. 5. **Twice a year: report to leadership** (Change: Inform) Share the one-page label health report. Move on when: The sponsor has seen the trend and any decisions they need to make. ## 5. Common challenges - **If you** Treat every downgrade as a violation. What tends to happen: People stop lowering labels honestly, or avoid labelling anything above General.. A better approach: Treat downgrades as signals about the taxonomy and the guide, and follow up patterns, not individuals. - **If you** Delete a label to tidy up. What tends to happen: Protection on existing files changes unexpectedly, and the label can show up as an unreadable identifier in reports.. A better approach: Remove it from policy first, find where it's used, decide what those files need, and only then consider deletion. - **If you** Change a label's encryption in place without telling anyone. What tends to happen: Some copies of a file pick up the new protection and others don't, and people can't tell why access changed.. A better approach: Plan encryption changes like a small deployment: test, communicate, and relabel content that needs it. - **If you** Look at reports only when there's a problem. What tends to happen: Activity data older than 30 days is gone, and slow drift is never noticed.. A better approach: Export a monthly snapshot and compare it with the baseline. - **If you** Add a label for every new request. What tends to happen: The taxonomy grows past what people can choose from, and accuracy falls for every label.. A better approach: Fix most requests with tooltips and guidance; add a label only when protection genuinely differs. ## 6. Checkpoints **Pilot:** - [ ] Do reviewers have the access they need, and no more? - [ ] Is there a baseline to compare against? - [ ] Did the first monthly review end with owned actions? **Production:** - [ ] Are monthly reviews happening and exported? - [ ] Is the change and retirement procedure written and followed? - [ ] Is the taxonomy still within five main labels? - [ ] Has leadership seen a label health report in the last six months? ## 7. Success measures Capture a baseline before you start, or you won't be able to show the change. - New documents and emails with a label (Where you see it: Activity explorer or the audit log; Good direction: Up) - Items lowered from Highly Confidential to General (Where you see it: Activity explorer; Good direction: Down) - Labels with very little use (Where you see it: Data explorer; Good direction: Down) - Label-related service desk tickets (Where you see it: Service desk; Good direction: Down) - Label changes made outside the procedure (Where you see it: Audit log; Good direction: Down) - Sites with repeated sensitivity mismatches (Where you see it: Audit log; Good direction: Down) **Ready-to-use text: Monthly review agenda (30 minutes)** > 1. Trend against baseline (5 min). 2. Downgrade patterns and follow-ups (10 min). 3. Service desk themes (5 min). 4. Changes to raise at the quarterly review (5 min). 5. Actions, owners, dates (5 min). **Ready-to-use text: Label change request** > Requested change: [new label / rename / tooltip / retire / protection change]. Why: [what people can't do today, with an example]. Who is affected: [teams, partners]. Existing content: [what should happen to files that already carry the label]. Requested by: [name]. Decision by the taxonomy owner: [approved / declined / alternative], on [date]. **Ready-to-use text: Note to a team with frequent downgrades** > We noticed your team often changes documents from [label] to [lower label]. That usually means the label doesn't fit your work, not that anyone did something wrong. Could we take 20 minutes to look at a few examples together? We'd like to fix the label or the guidance so it works for you. ## 8. Additional reading **Plan:** - [Deploy an information protection solution with Microsoft Purview](https://learn.microsoft.com/en-us/purview/information-protection-solution) **Configure:** - [Create and publish sensitivity labels](https://learn.microsoft.com/en-us/purview/create-sensitivity-labels) - [Apply encryption using sensitivity labels](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels) **Monitor:** - [Get started with Activity explorer](https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer) - [Get started with data explorer](https://learn.microsoft.com/en-us/purview/data-classification-data-explorer) - [Microsoft Purview posture reports overview](https://learn.microsoft.com/en-us/purview/purview-reports) - [Audit log activities](https://learn.microsoft.com/en-us/purview/audit-log-activities) ## Changelog - Version 1, 2026-10-15, Sev Derghazarian: First version. Facts checked against Microsoft Learn on 2026-10-15.