M365 PlaybooksPurview· Deploy
Roll out sensitivity labels in stages
Purpose
Put labels into everyday use so information carries its sensitivity with it, and the controls that rely on labels (encryption, data loss prevention, Copilot protections) have something accurate to act on. A staged rollout keeps work moving while people learn, and catches the problems that only real documents, real partners and real devices reveal.
Overview
Labels published to a pilot and then the organization, with SharePoint and OneDrive support, a safe default label and clear help.
- Effort
- About 20 to 30 person-days
- Duration
- 8 to 12 weeks
- Complexity
- Medium
- Who's in the room
- Purview admin, SharePoint admin, Microsoft 365 Apps admin, taxonomy owner, communications lead, service desk lead, pilot group
- Licensing
- Applying labels manually is included in Microsoft 365 E3, E5 and Business Premium, and Office 365 E3 and E5. Automatic labelling, default labels for SharePoint libraries, labels for scheduled meetings and the activity and data explorer reports need Microsoft 365 E5, Microsoft Purview Suite, or Microsoft 365 E5 Information Protection and Governance.
Risk of not doing it
Published to everyone at once, a label problem (encryption that partners can't open, co-editing that stops working) hits the whole organization on the same day, and people learn to lower labels to get work done.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Confirm the approved label specification
Deployment builds on the label specification from the Plan stage: label names, tooltips, protection, priority order, and policy settings. If anything is still open, such as which label encrypts or who can open it, settle it now. Changing a label after people have used it is possible, but encryption changes reach existing files unevenly, so it is far cheaper to get it right before the pilot.
Turn on sensitivity labels for Office files in SharePoint and OneDrive
This one setting lets SharePoint and OneDrive read labelled and encrypted Office files: search, eDiscovery and DLP then work on them, and people get the Sensitivity button in Office for the web. Microsoft lists it as a prerequisite for labelling in Office for the web and for auto-labelling policies later. Turn it on before any label that encrypts is published. Encrypted files that already exist only benefit once they are edited or uploaded again. It can be turned off later, but only with PowerShell.
Move everyone to built-in labelling
Sensitivity labels are built into Microsoft 365 Apps. The Azure Information Protection add-in for Office is retired and no longer supported, and standalone (perpetual) editions of Office don't support labels at all. Make sure every device that will use labels runs a subscription edition, and that the Group Policy setting "Use the Azure Information Protection add-in" is not configured or disabled, so the built-in experience is the one people see.
Brief the service desk
Tell the service desk what labels are, what the pilot group will see, and the three questions they will get most: "which label do I use?", "why can't my partner open this file?" and "how do I remove a label?". Agree how a ticket reaches the Purview admin and the taxonomy owner.
Decisions
Decision: Turn on co-authoring for encrypted files?
Without it, people can't edit an encrypted Office file together and AutoSave is turned off for that file, which feels like the label broke something. Co-authoring for encrypted files fixes both, but it changes how label information is stored in Office files, it can't be turned off in the Purview portal (only with PowerShell, and doing so loses labelling information for unencrypted Word, Excel and PowerPoint files), and it doesn't support labels with access expiry or Double Key Encryption. Decide it deliberately, and before an encrypting label goes live.
Options
- Leave it off
- Turn it on before publishing any label that encrypts
Recommended default: Turn it on before publishing any label that encrypts
Decision: Build from Microsoft's default labels or from scratch?
Microsoft now creates a set of default labels and policies automatically for new tenants with an eligible licence, and existing tenants can turn them on. They follow the Personal, Public, General, Confidential, Highly Confidential pattern. If your approved specification is close, start from them and edit names, tooltips and protection to match. If it differs, create your own and don't publish both.
Options
- Turn on the default labels and use them as they are
- Start from the default labels where they match the specification and edit them
- Create every label from scratch
Recommended default: Start from the default labels where they match the specification and edit them
Decision: Who gets labels first?
Labels reach people through label policies, which can target users and groups, and an organization can have several policies with different labels or settings. Publishing to a pilot group first, then widening the same policy, gives you a controlled way to scale. Allow 24 hours for label and policy changes to reach apps, and up to 48 hours when group membership is involved, so plan each wave with that lag in mind.
Options
- Everyone on day one
- A pilot policy for a cross-section group, widened in waves
Recommended default: A pilot policy for a cross-section group, widened in waves
Pilot configuration
Create the labels and the pilot policy
Create the labels exactly as specified, in priority order with the most restrictive last. In the pilot label policy, set a non-encrypting default label for documents and email (Microsoft advises against an encrypting default for documents), require a justification to remove or lower a label, and add the help link to your labelling guide. Leave automatic labelling for the Refine stage.
Test the hard cases on purpose
Don't wait for the pilot group to find the edges. Before and during the pilot, test: opening an encrypted file as an external recipient, co-editing an encrypted file in desktop and browser, labelling on mobile, an email with a labelled attachment, searching for an encrypted file, and asking Copilot about an encrypted document as someone with and without access. Write down what happens and fix the label or the guidance before the waves.
Production configuration
Widen the policy in waves
Add groups to the label policy wave by wave, starting with groups that look like the pilot. Hold each wave until label changes have reached apps and the service desk has had a quiet week. Send the announcement and labelling guide to each wave a few days before the labels appear.
Hand over to operations
Document each label, policy, scope and setting, and the decisions behind them. Agree who answers label questions, who reviews downgrades, and how often the taxonomy owner reviews the labels. That operating rhythm is the Maintain stage.
Make it enforceable
Label policies apply a non-encrypting default label to new documents and email and require a justification to remove or lower a label, so new content is labelled without relying on each person to remember. Existing files stay unlabelled until someone opens and saves them; automatic labelling in the Refine stage closes that gap.
Partly enforced. The gaps are a risk until a mechanism covers them.
Pilot to production
Rollout approachRepresentative cross-section · Pilot size: 50 to 200 people across departments, or about 5% of users
Labels change how everyone saves and sends. A cross-section that includes people who share with partners, heavy co-editors, mobile users and a sceptical team surfaces the real friction before it reaches everyone.
Make your pilot representative
- Every major role, not only IT and enthusiasts
- More than one location or time zone
- Heavy users of the workload you are changing
- People who handle sensitive information
- At least one team you expect to be sceptical
Brief the pilot groupChange: Inform
Explain why labels are coming, what the default does, and how to report a problem.
Move on when: Pilot members know what to expect and where to report
Run the pilot for three to four weeksChange: Explain
Labels are live for the pilot group on desktop, web and mobile. Run the hard-case test script in the first week, and hold a 20-minute check-in with pilot members at the end of each week.
Move on when: No unresolved issue blocks everyday work
Adjust labels and guidanceChange: Explain
Rewrite tooltips people misread and fix any protection setting that caused trouble.
Move on when: Pilot feedback is closed or scheduled
Announce to the organizationChange: Inform
Leadership explains why labels matter and what people will see, before the first wave.
Move on when: The announcement and guide are out before labels appear
Widen in wavesChange: Explain
Add groups to the label policy one wave at a time, starting with groups that look like the pilot. Remember that changes can take a day or two to reach everyone in a wave.
Move on when: Each wave settles with no rise in escalations
Hand over to operationsChange: Sustain
Ownership moves to operations and the Maintain rhythm starts.
Move on when: Operations owns labels and the review cadence
Common challenges
If youPublish an encrypting label before SharePoint and OneDrive support is on
What tends to happenEncrypted files can't be searched or found in eDiscovery, DLP can't inspect them, and browser users have no Sensitivity button.
A better approachTurn on labels for Office files in SharePoint and OneDrive first, then publish labels.
If youUse an encrypting label as the default
What tends to happenEveryday documents become hard to share with partners and harder to co-edit, and people strip labels to cope.
A better approachUse a non-encrypting default such as General and keep encryption for the top tier.
If youPresent labels as a compliance chore
What tends to happenPeople pick the lowest label that closes the prompt, and the data stops meaning anything.
A better approachExplain why in one sentence, show examples, and teach people how to handle exceptions rather than when to protect. Microsoft notes that this speeds up adoption.
If youAssume everyone runs the same version of Office
What tends to happenPeople on perpetual Office or old builds see no labels at all and fall outside the rollout.
A better approachInventory Office versions during prerequisites and move them to Microsoft 365 Apps before their wave.
If youPilot only with IT
What tends to happenThe labels work for IT, then fail for the finance team that shares with auditors every day.
A better approachBuild the pilot from a cross-section that includes people who share outside the organization.
Checkpoints
Pilot
- Are labels for Office files in SharePoint and OneDrive turned on?
- Is the co-authoring decision recorded and applied?
- Have the hard cases been tested, including external recipients and Copilot?
- Can pilot users explain which label to use for their own work?
Production
- Is the label policy published to every planned group?
- Do all devices run a version of Office that supports built-in labels?
- Is every label and policy documented with an owner?
- Has operations taken over questions, downgrade reviews and the review cadence?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| New documents and emails with a label | Activity explorer or the audit log | Up |
| Labels removed or lowered, with justification | Activity explorer or the audit log | Steady |
| Service desk tickets about labels per wave | Service desk | Down |
| Encrypted files external partners can't open | Service desk and pilot reports | Down |
Ready-to-use text
Pilot invitation email
You're in the pilot for sensitivity labels. From [date], Word, Excel, PowerPoint and Outlook will show a Sensitivity label on what you create. Most things will be labelled General for you; you only need to change it when something is more or less sensitive. The one-page guide is here: [link]. If a label gets in the way of your work, tell us at [channel] so we can fix it before everyone gets labels.
Organization announcement
Starting [date], you'll see sensitivity labels in Microsoft 365. They tell everyone, including Copilot, how carefully a document or email needs to be handled. Most of your work will be labelled General automatically. Choose Confidential or Highly Confidential when the content calls for it; the guide has examples: [link]. Questions? [channel].
Hard-case test script
For each label that encrypts: 1. Send a labelled file to an external test account; can they open it, and on which devices? 2. Two people edit the file at the same time in desktop Word and in the browser. 3. Open it on a phone. 4. Search for a word in the file from SharePoint search. 5. Ask Copilot to summarize it, as someone with access and as someone without. 6. Lower the label and check the justification prompt. Record the result, the fix, and who confirmed it.
Additional reading
Configure
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-15. |