M365 PlaybooksPurview· Maintain
Keep labels accurate and in use
Purpose
Keep labels meaning what they are supposed to mean. Labels are only useful while people apply them correctly and the taxonomy still matches how the organization works. Without a rhythm of review, labels quietly drift: people lower them to get past a prompt, unused labels pile up, and the controls built on top of them (DLP, encryption, Copilot protections) end up resting on data nobody trusts.
Overview
A monthly review of downgrades and label use, a quarterly taxonomy review, and a safe way to change or retire labels.
- Effort
- About 2 to 4 person-days a month
- Duration
- Ongoing; first cycle in 4 to 6 weeks
- Complexity
- Low
- Who's in the room
- Taxonomy owner, security analyst, Purview admin, communications lead, service desk lead
- Licensing
- Applying labels manually is included in Microsoft 365 E3, E5 and Business Premium, and Office 365 E3 and E5. Automatic labelling, default labels for SharePoint libraries, labels for scheduled meetings and the activity and data explorer reports need Microsoft 365 E5, Microsoft Purview Suite, or Microsoft 365 E5 Information Protection and Governance.
Risk of not doing it
Labels drift until they mean nothing, and a careless change or deletion can lock people out of encrypted content or strip its protection.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Give reviewers the right access
With an E5-level licence, activity explorer shows label activity (applied, changed, lowered, removed) and data explorer shows where labelled content sits. Access comes from the Information Protection role groups; seeing item names and contents in data explorer needs separate viewer roles that don't include each other. Grant the least access each reviewer needs, and review those role assignments at the quarterly review, since the people who can read item names and contents can see sensitive material. Without E5, label activity is still recorded in the audit log under sensitivity label activities.
Capture a baseline
At handover from the Deploy stage, record how many new documents and emails carry a label, how labels are distributed, and how many labels are lowered or removed each month. Activity explorer reports on up to 30 days of data, so export a snapshot every month; otherwise trends disappear before anyone looks at them.
Decisions
Decision: How often do you review?
Downgrades and service desk themes change month to month; the taxonomy itself changes slowly. Splitting the two keeps the monthly review short and gives the taxonomy owner a regular, predictable moment to decide on changes instead of reacting to individual requests. It also gives everyone a simple answer to "can we add a label for this?": bring it to the next quarterly review, with an example of what people can't do today. Ad hoc reviews only happen after something has gone wrong, and annual reviews let a year of drift build up before anyone looks.
Options
- Only when something goes wrong
- Once a year
- Monthly activity review and quarterly taxonomy review
Recommended default: Monthly activity review and quarterly taxonomy review
Decision: Which downgrades do you follow up?
People are asked for a reason when they remove a label or choose a lower one, and admins can read that reason with the label change in activity explorer (except for files in SharePoint and OneDrive, where the reason isn't captured). Microsoft points to one pattern worth investigating: a large number of items labelled Highly Confidential being lowered to General. Most individual downgrades are honest corrections, so look for patterns, not people.
Options
- Every downgrade
- Patterns: many items lowered from the top tier, or one person or team repeatedly
- None
Recommended default: Patterns: many items lowered from the top tier, or one person or team repeatedly
Decision: How are labels changed or retired?
Label changes take up to 24 hours to reach apps, and encryption changes reach existing files unevenly: files in SharePoint and OneDrive update when next opened, while other copies keep their old protection unless they are relabelled. Removing a label from its policy stops people choosing it but leaves it on existing content, which Microsoft describes as less risky than deleting. Deleting a label archives its encryption template so protected files can still be opened, but in SharePoint and OneDrive the encryption can be removed. Make every change through the taxonomy owner, and always remove a label from policy before considering deletion.
Options
- Admins edit or delete labels as needed
- Changes through the taxonomy owner; remove from policy before any deletion
Recommended default: Changes through the taxonomy owner; remove from policy before any deletion
Pilot configuration
Run the first monthly review
Bring together the downgrade patterns from activity explorer, the label distribution from data explorer, and the service desk's label tickets. Expect data explorer counts to lag: they can take up to seven days to update, and up to fourteen for files in SharePoint. Keep the meeting to 30 minutes and leave with actions, not observations.
Fix causes, not people
When a team keeps lowering labels, the usual cause is a tooltip that doesn't fit their work or a label that blocks something they need to do. Talk to them, then fix the tooltip, the guide or the label. Send a short, friendly note to the team rather than a warning; people who are punished for honest downgrades stop labelling honestly.
Production configuration
Run the quarterly taxonomy review
Look at which labels are rarely used (candidates to merge or retire), which are often confused, and whether new obligations, partners or projects need something the labels don't cover. Microsoft describes information protection as iterative and often circular rather than a one-time deployment. Keep the taxonomy within five main labels; adding a label is the last resort.
Watch for files more sensitive than their site
When a file is uploaded to a site whose label has a lower priority than the file's own label, SharePoint records a document sensitivity mismatch in the audit log. A steady trickle is normal; a cluster on one site usually means the site is holding more sensitive work than it was set up for. Raise those with the site owner: either the content belongs somewhere else, or the site needs a higher label.
Keep the guide and onboarding current
Update the labelling guide and its help link whenever a label changes, and make labels part of onboarding so new staff learn them in their first week rather than from a prompt. Keep the examples in the guide fresh: swap in examples from the questions the service desk actually receives, because people recognize their own situations far faster than generic ones. When a label is retired, say so in the guide for a few months, along with what to use instead, so people who see the old label on existing files know what it meant.
Report to leadership twice a year
Show the trend in labelled content, notable downgrade patterns and what was done about them, and any taxonomy changes. Keep it to one page; the point is to keep a sponsor engaged, not to report every number. Close with one decision you need from leadership, even a small one, such as endorsing a label retirement or a reminder campaign. A report that asks for nothing is easy to stop reading.
Make it enforceable
Only the Information Protection role groups can change labels, and the change and retirement procedure routes every change through the taxonomy owner, with labels removed from policy before any deletion. The procedure itself depends on people following it, so the monthly review also checks the audit log for label changes made outside it.
Partly enforced. The gaps are a risk until a mechanism covers them.
Operating rhythm
Monthly: review downgrades and removals
Check activity explorer or the audit log against the agreed downgrade patterns, note any label changes made outside the procedure, and export the month's data before it ages out of the 30-day window.
Move on when: Every pattern found has an owner and a follow-up date
Monthly: review service desk themesChange: Explain
Group label tickets by cause: wrong label, can't open, can't share, can't remove. A cause that appears three months in a row is a design problem, not a training problem.
Move on when: Recurring causes have a fix scheduled
Quarterly: review the taxonomy
Bring three months of exports, mismatch clusters and change requests. Decide on merges, retirements, renames and tooltip changes, and schedule any change through the procedure.
Move on when: Decisions are recorded and changes scheduled through the procedure
Quarterly: refresh guidance and remindersChange: Sustain
Update the guide and send one short, useful reminder to the teams that need it.
Move on when: The guide matches the labels people see
Twice a year: report to leadershipChange: Inform
Share the one-page label health report.
Move on when: The sponsor has seen the trend and any decisions they need to make
Common challenges
If youTreat every downgrade as a violation
What tends to happenPeople stop lowering labels honestly, or avoid labelling anything above General.
A better approachTreat downgrades as signals about the taxonomy and the guide, and follow up patterns, not individuals.
If youDelete a label to tidy up
What tends to happenProtection on existing files changes unexpectedly, and the label can show up as an unreadable identifier in reports.
A better approachRemove it from policy first, find where it's used, decide what those files need, and only then consider deletion.
If youChange a label's encryption in place without telling anyone
What tends to happenSome copies of a file pick up the new protection and others don't, and people can't tell why access changed.
A better approachPlan encryption changes like a small deployment: test, communicate, and relabel content that needs it.
If youLook at reports only when there's a problem
What tends to happenActivity data older than 30 days is gone, and slow drift is never noticed.
A better approachExport a monthly snapshot and compare it with the baseline.
If youAdd a label for every new request
What tends to happenThe taxonomy grows past what people can choose from, and accuracy falls for every label.
A better approachFix most requests with tooltips and guidance; add a label only when protection genuinely differs.
Checkpoints
Pilot
- Do reviewers have the access they need, and no more?
- Is there a baseline to compare against?
- Did the first monthly review end with owned actions?
Production
- Are monthly reviews happening and exported?
- Is the change and retirement procedure written and followed?
- Is the taxonomy still within five main labels?
- Has leadership seen a label health report in the last six months?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| New documents and emails with a label | Activity explorer or the audit log | Up |
| Items lowered from Highly Confidential to General | Activity explorer | Down |
| Labels with very little use | Data explorer | Down |
| Label-related service desk tickets | Service desk | Down |
| Label changes made outside the procedure | Audit log | Down |
| Sites with repeated sensitivity mismatches | Audit log | Down |
Ready-to-use text
Monthly review agenda (30 minutes)
1. Trend against baseline (5 min). 2. Downgrade patterns and follow-ups (10 min). 3. Service desk themes (5 min). 4. Changes to raise at the quarterly review (5 min). 5. Actions, owners, dates (5 min).
Label change request
Requested change: [new label / rename / tooltip / retire / protection change]. Why: [what people can't do today, with an example]. Who is affected: [teams, partners]. Existing content: [what should happen to files that already carry the label]. Requested by: [name]. Decision by the taxonomy owner: [approved / declined / alternative], on [date].
Note to a team with frequent downgrades
We noticed your team often changes documents from [label] to [lower label]. That usually means the label doesn't fit your work, not that anyone did something wrong. Could we take 20 minutes to look at a few examples together? We'd like to fix the label or the guidance so it works for you.
Additional reading
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-15. |