# Roll out sensitivity labels in stages - URL: https://m365playbooks.com/playbooks/roll-out-sensitivity-labels-in-stages/ - Topic: Sensitivity labels (Program) - Product: Purview - Stage: Deploy - Last reviewed: October 15, 2026 - Version: 1 - Written by: Sev Derghazarian ## 1. Purpose Put labels into everyday use so information carries its sensitivity with it, and the controls that rely on labels (encryption, data loss prevention, Copilot protections) have something accurate to act on. A staged rollout keeps work moving while people learn, and catches the problems that only real documents, real partners and real devices reveal. ## 2. Overview Labels published to a pilot and then the organization, with SharePoint and OneDrive support, a safe default label and clear help. - Effort: About 20 to 30 person-days - Duration: 8 to 12 weeks - Complexity: Medium - Who's in the room: Purview admin, SharePoint admin, Microsoft 365 Apps admin, taxonomy owner, communications lead, service desk lead, pilot group - Licensing: Applying labels manually is included in Microsoft 365 E3, E5 and Business Premium, and Office 365 E3 and E5. Automatic labelling, default labels for SharePoint libraries, labels for scheduled meetings and the activity and data explorer reports need Microsoft 365 E5, Microsoft Purview Suite, or Microsoft 365 E5 Information Protection and Governance. - Risk of not doing it: Published to everyone at once, a label problem (encryption that partners can't open, co-editing that stops working) hits the whole organization on the same day, and people learn to lower labels to get work done. ## 3. Key activities ### Prerequisites 1. **Confirm the approved label specification** Deployment builds on the label specification from the Plan stage: label names, tooltips, protection, priority order, and policy settings. If anything is still open, such as which label encrypts or who can open it, settle it now. Changing a label after people have used it is possible, but encryption changes reach existing files unevenly, so it is far cheaper to get it right before the pilot. Who: Taxonomy owner. Produces: A signed-off specification the admins can build from. 2. **Turn on sensitivity labels for Office files in SharePoint and OneDrive** This one setting lets SharePoint and OneDrive read labelled and encrypted Office files: search, eDiscovery and DLP then work on them, and people get the Sensitivity button in Office for the web. Microsoft lists it as a prerequisite for labelling in Office for the web and for auto-labelling policies later. Turn it on before any label that encrypts is published. Encrypted files that already exist only benefit once they are edited or uploaded again. It can be turned off later, but only with PowerShell. Who: SharePoint admin. Produces: Labelling enabled for SharePoint and OneDrive. 3. **Move everyone to built-in labelling** Sensitivity labels are built into Microsoft 365 Apps. The Azure Information Protection add-in for Office is retired and no longer supported, and standalone (perpetual) editions of Office don't support labels at all. Make sure every device that will use labels runs a subscription edition, and that the Group Policy setting "Use the Azure Information Protection add-in" is not configured or disabled, so the built-in experience is the one people see. Who: Microsoft 365 Apps admin. Produces: Devices ready for built-in labelling, with exceptions listed. 4. **Brief the service desk** Tell the service desk what labels are, what the pilot group will see, and the three questions they will get most: "which label do I use?", "why can't my partner open this file?" and "how do I remove a label?". Agree how a ticket reaches the Purview admin and the taxonomy owner. Who: Service desk lead. Produces: A briefed service desk with an escalation path. ### Decisions 5. **Decision: Turn on co-authoring for encrypted files?** Without it, people can't edit an encrypted Office file together and AutoSave is turned off for that file, which feels like the label broke something. Co-authoring for encrypted files fixes both, but it changes how label information is stored in Office files, it can't be turned off in the Purview portal (only with PowerShell, and doing so loses labelling information for unencrypted Word, Excel and PowerPoint files), and it doesn't support labels with access expiry or Double Key Encryption. Decide it deliberately, and before an encrypting label goes live. Options: Leave it off; Turn it on before publishing any label that encrypts. Recommended default: Turn it on before publishing any label that encrypts. Who: Purview admin with the taxonomy owner. Produces: A recorded decision and, if yes, co-authoring enabled. 6. **Decision: Build from Microsoft's default labels or from scratch?** Microsoft now creates a set of default labels and policies automatically for new tenants with an eligible licence, and existing tenants can turn them on. They follow the Personal, Public, General, Confidential, Highly Confidential pattern. If your approved specification is close, start from them and edit names, tooltips and protection to match. If it differs, create your own and don't publish both. Options: Turn on the default labels and use them as they are; Start from the default labels where they match the specification and edit them; Create every label from scratch. Recommended default: Start from the default labels where they match the specification and edit them. Who: Purview admin. Produces: One set of labels that matches the specification. 7. **Decision: Who gets labels first?** Labels reach people through label policies, which can target users and groups, and an organization can have several policies with different labels or settings. Publishing to a pilot group first, then widening the same policy, gives you a controlled way to scale. Allow 24 hours for label and policy changes to reach apps, and up to 48 hours when group membership is involved, so plan each wave with that lag in mind. Options: Everyone on day one; A pilot policy for a cross-section group, widened in waves. Recommended default: A pilot policy for a cross-section group, widened in waves. Who: Purview admin. Produces: A pilot group and a wave plan. ### Pilot configuration 8. **Create the labels and the pilot policy** Create the labels exactly as specified, in priority order with the most restrictive last. In the pilot label policy, set a non-encrypting default label for documents and email (Microsoft advises against an encrypting default for documents), require a justification to remove or lower a label, and add the help link to your labelling guide. Leave automatic labelling for the Refine stage. Who: Purview admin. Produces: Labels published to the pilot group. 9. **Test the hard cases on purpose** Don't wait for the pilot group to find the edges. Before and during the pilot, test: opening an encrypted file as an external recipient, co-editing an encrypted file in desktop and browser, labelling on mobile, an email with a labelled attachment, searching for an encrypted file, and asking Copilot about an encrypted document as someone with and without access. Write down what happens and fix the label or the guidance before the waves. Who: Purview admin with the pilot group. Produces: A tested-scenarios list with results and fixes. ### Production configuration 10. **Widen the policy in waves** Add groups to the label policy wave by wave, starting with groups that look like the pilot. Hold each wave until label changes have reached apps and the service desk has had a quiet week. Send the announcement and labelling guide to each wave a few days before the labels appear. Who: Purview admin with the communications lead. Produces: Labels published to the whole organization. 11. **Hand over to operations** Document each label, policy, scope and setting, and the decisions behind them. Agree who answers label questions, who reviews downgrades, and how often the taxonomy owner reviews the labels. That operating rhythm is the Maintain stage. Who: Purview admin. Produces: Label documentation and an agreed operating rhythm. 12. **Make it enforceable** Label policies apply a non-encrypting default label to new documents and email and require a justification to remove or lower a label, so new content is labelled without relying on each person to remember. Existing files stay unlabelled until someone opens and saves them; automatic labelling in the Refine stage closes that gap. _Partly enforced. The gaps are a risk until a mechanism covers them._ ## 4. Pilot to production **Rollout approach:** Representative cross-section (Pilot size: 50 to 200 people across departments, or about 5% of users). Labels change how everyone saves and sends. A cross-section that includes people who share with partners, heavy co-editors, mobile users and a sceptical team surfaces the real friction before it reaches everyone. 1. **Brief the pilot group** (Change: Inform) Explain why labels are coming, what the default does, and how to report a problem. Move on when: Pilot members know what to expect and where to report. 2. **Run the pilot for three to four weeks** (Change: Explain) Labels are live for the pilot group on desktop, web and mobile. Run the hard-case test script in the first week, and hold a 20-minute check-in with pilot members at the end of each week. Move on when: No unresolved issue blocks everyday work. 3. **Adjust labels and guidance** (Change: Explain) Rewrite tooltips people misread and fix any protection setting that caused trouble. Move on when: Pilot feedback is closed or scheduled. 4. **Announce to the organization** (Change: Inform) Leadership explains why labels matter and what people will see, before the first wave. Move on when: The announcement and guide are out before labels appear. 5. **Widen in waves** (Change: Explain) Add groups to the label policy one wave at a time, starting with groups that look like the pilot. Remember that changes can take a day or two to reach everyone in a wave. Move on when: Each wave settles with no rise in escalations. 6. **Hand over to operations** (Change: Sustain) Ownership moves to operations and the Maintain rhythm starts. Move on when: Operations owns labels and the review cadence. ## 5. Common challenges - **If you** Publish an encrypting label before SharePoint and OneDrive support is on. What tends to happen: Encrypted files can't be searched or found in eDiscovery, DLP can't inspect them, and browser users have no Sensitivity button.. A better approach: Turn on labels for Office files in SharePoint and OneDrive first, then publish labels. - **If you** Use an encrypting label as the default. What tends to happen: Everyday documents become hard to share with partners and harder to co-edit, and people strip labels to cope.. A better approach: Use a non-encrypting default such as General and keep encryption for the top tier. - **If you** Present labels as a compliance chore. What tends to happen: People pick the lowest label that closes the prompt, and the data stops meaning anything.. A better approach: Explain why in one sentence, show examples, and teach people how to handle exceptions rather than when to protect. Microsoft notes that this speeds up adoption. - **If you** Assume everyone runs the same version of Office. What tends to happen: People on perpetual Office or old builds see no labels at all and fall outside the rollout.. A better approach: Inventory Office versions during prerequisites and move them to Microsoft 365 Apps before their wave. - **If you** Pilot only with IT. What tends to happen: The labels work for IT, then fail for the finance team that shares with auditors every day.. A better approach: Build the pilot from a cross-section that includes people who share outside the organization. ## 6. Checkpoints **Pilot:** - [ ] Are labels for Office files in SharePoint and OneDrive turned on? - [ ] Is the co-authoring decision recorded and applied? - [ ] Have the hard cases been tested, including external recipients and Copilot? - [ ] Can pilot users explain which label to use for their own work? **Production:** - [ ] Is the label policy published to every planned group? - [ ] Do all devices run a version of Office that supports built-in labels? - [ ] Is every label and policy documented with an owner? - [ ] Has operations taken over questions, downgrade reviews and the review cadence? ## 7. Success measures Capture a baseline before you start, or you won't be able to show the change. - New documents and emails with a label (Where you see it: Activity explorer or the audit log; Good direction: Up) - Labels removed or lowered, with justification (Where you see it: Activity explorer or the audit log; Good direction: Steady) - Service desk tickets about labels per wave (Where you see it: Service desk; Good direction: Down) - Encrypted files external partners can't open (Where you see it: Service desk and pilot reports; Good direction: Down) **Ready-to-use text: Pilot invitation email** > You're in the pilot for sensitivity labels. From [date], Word, Excel, PowerPoint and Outlook will show a Sensitivity label on what you create. Most things will be labelled General for you; you only need to change it when something is more or less sensitive. The one-page guide is here: [link]. If a label gets in the way of your work, tell us at [channel] so we can fix it before everyone gets labels. **Ready-to-use text: Organization announcement** > Starting [date], you'll see sensitivity labels in Microsoft 365. They tell everyone, including Copilot, how carefully a document or email needs to be handled. Most of your work will be labelled General automatically. Choose Confidential or Highly Confidential when the content calls for it; the guide has examples: [link]. Questions? [channel]. **Ready-to-use text: Hard-case test script** > For each label that encrypts: 1. Send a labelled file to an external test account; can they open it, and on which devices? 2. Two people edit the file at the same time in desktop Word and in the browser. 3. Open it on a phone. 4. Search for a word in the file from SharePoint search. 5. Ask Copilot to summarize it, as someone with access and as someone without. 6. Lower the label and check the justification prompt. Record the result, the fix, and who confirmed it. ## 8. Additional reading **Plan:** - [Introduction to secure by default with Microsoft Purview](https://learn.microsoft.com/en-us/purview/deploymentmodels/depmod-secure-by-default-intro) - [Microsoft Purview service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-description) **Configure:** - [Create and publish sensitivity labels](https://learn.microsoft.com/en-us/purview/create-sensitivity-labels) - [Enable sensitivity labels for files in SharePoint and OneDrive](https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-onedrive-files) - [Enable co-authoring for encrypted documents](https://learn.microsoft.com/en-us/purview/sensitivity-labels-coauthoring) - [Manage sensitivity labels in Office apps](https://learn.microsoft.com/en-us/purview/sensitivity-labels-office-apps) - [Apply encryption using sensitivity labels](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels) **Monitor:** - [Get started with Activity explorer](https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer) ## Changelog - Version 1, 2026-10-15, Sev Derghazarian: First version. Facts checked against Microsoft Learn on 2026-10-15.