# Set default labels for sensitive libraries - URL: https://m365playbooks.com/playbooks/set-default-labels-for-sensitive-libraries/ - Topic: Sensitivity labels (Program) - Product: Purview, SharePoint, Teams, Exchange - Stage: Deploy - Last reviewed: October 15, 2026 - Version: 1 - Written by: Sev Derghazarian ## 1. Purpose Make sure files in the places that hold the most sensitive work carry the right label without relying on each person to choose it. Some libraries hold almost nothing but sensitive material: HR case files, board papers, legal matters. A default label on those libraries labels new and edited files as they arrive, so protection follows the files even after they leave the site. ## 2. Overview Default sensitivity labels on libraries that hold one kind of sensitive work, so new and edited files are labelled as they arrive. - Effort: About 5 to 10 person-days - Duration: 3 to 6 weeks - Complexity: Low - Who's in the room: Purview admin, SharePoint admin, taxonomy owner, owners of the selected sites - Licensing: Default labels for SharePoint document libraries need Microsoft 365 E5, Microsoft Purview Suite, Microsoft 365 E5 Information Protection and Governance, or Office 365 E5. - Risk of not doing it: Files in the most sensitive libraries stay unlabelled or under-labelled, so encryption, DLP and Copilot protections based on labels don't apply where they matter most. ## 3. Key activities ### Prerequisites 1. **Confirm SharePoint and OneDrive label support** Library defaults need sensitivity labels for Office files in SharePoint and OneDrive to be turned on, which the core Deploy playbook covers. If you want PDFs labelled too, PDF support must be turned on separately. The label must be scoped to files and published to the person configuring the library, and only files with content are labelled. Check also that the label you plan to use is published to whoever will configure the library, because only labels published to that person appear in the library settings. Who: SharePoint admin. Produces: Prerequisites confirmed. 2. **Find the libraries that qualify** A library default suits a library where almost everything belongs at one level. Ask the taxonomy owner and department heads for candidates, and check them with data explorer if you have it. Avoid general team libraries that mix routine and sensitive work; a default there over-labels everyday files and teaches people to lower labels. Good candidates usually share three traits: a clear owner, a single purpose, and content that would cause harm if it reached the wrong person. A library that holds 'everything for the team' rarely qualifies; a library that holds only signed contracts or case files usually does. Write the reason for each candidate down, because it is the first thing the site owner will ask. Keep the first list short, so each default gets a proper conversation with its owner and partners. Who: Taxonomy owner with department heads. Produces: A short list of candidate libraries and their intended labels. ### Decisions 3. **Decision: Which labels can be library defaults?** Not every label can be a default. A library enabled for Information Rights Management can't have a default label, and labels that let users assign their own permissions, labels whose access expires, and Double Key Encryption labels aren't supported as defaults. A label that encrypts with permissions the admin defines is supported, but it changes how people work with those files, so check that with the site owner first. Check each candidate label against these limits before the conversation with the site owner, so you only offer labels that will work. Options: Use the most restrictive label everywhere; Match each library to the label most of its content needs. Recommended default: Match each library to the label most of its content needs. Who: Taxonomy owner. Produces: An approved label for each candidate library. 4. **Decision: What about files already in the library?** The default labels new uploads and existing files when they are edited, if they have no label or a lower-priority one. It doesn't label files at rest that nobody edits. A separate auto-labelling policy can apply each library's default to its existing files, without inspecting content; currently a tenant can have one such policy, covering up to ten sites at a time. Decide whether existing files can wait for edits or need that policy. Options: Label new and edited files only; Also run the existing-files policy, ten sites at a time. Recommended default: Also run the existing-files policy, ten sites at a time. Who: Taxonomy owner with the Purview admin. Produces: A plan for existing files per library. 5. **Decision: Who configures the default?** Setting a library's default needs site admin permissions, so site owners can do it themselves. For the most sensitive libraries, it is safer for the SharePoint admin to set it with the site owner's agreement and record it, so defaults match the approved list. Whoever sets it, record the library, the label and the date in the register. Without it, nobody can tell months later why a library labels everything Highly Confidential, or whether it still should. Options: Site owners set defaults freely; Admins set defaults on approved libraries, with owners' agreement. Recommended default: Admins set defaults on approved libraries, with owners' agreement. Who: SharePoint admin. Produces: An agreed way of setting and recording defaults. ### Pilot configuration 6. **Set defaults on two or three libraries** Configure the default on a few candidate libraries and watch what happens: in Office for the web the label is applied straight away, uploads can take a few minutes, and with desktop apps the label is applied after the app closes. Check that people can still open, share and co-edit the files they need. Ask the site owners to work normally for two weeks and to report anything that changed: a partner who can no longer open a file, a co-editing problem, or a label that looks wrong. If the default label encrypts, test sharing with each external party the library normally works with before going further. Who: SharePoint admin with site owners. Produces: Pilot libraries labelling new and edited files. 7. **Check how defaults interact with manual labels** A library default never replaces a label someone applied by hand, even a lower one, and it replaces a lower-priority label that was applied automatically or by a policy default. Walk the site owner through what that means: someone can still label a file lower by hand, and that change is audited. This matters because a library default isn't a lock: it labels what arrives, and people can still choose differently by hand. If a library must never hold files below a certain label, combine the default with the monthly downgrade review, and consider a DLP rule for the riskiest actions on those files. Who: Purview admin with site owners. Produces: Owners who understand how the default behaves. ### Production configuration 8. **Extend to the approved list** Set defaults on the remaining approved libraries and, if you chose to, run the existing-files policy in batches of up to ten sites, replacing the site list after each batch completes. Keep each batch's site list until it completes, then replace it with the next batch; the existing-files policy covers only the sites currently in its list. Who: SharePoint admin. Produces: Defaults on every approved library. 9. **Monitor and record** Labels applied by a library default are recorded in the audit log, so you can confirm defaults are working. Keep the list of libraries with defaults, their labels and owners, and review it with the Maintain stage. If you need to switch library defaults off across the tenant, there is a setting for that. Compare the register with the libraries you planned each quarter, and check data explorer for files still unlabelled in those libraries; they are usually files nobody has edited since the default was set. Who: Purview admin. Produces: A maintained register of library defaults. 10. **Make it enforceable** The library default labels every new upload and edited file that has no label or a lower-priority one, without anyone choosing. Files at rest stay as they are unless the existing-files policy covers them, and people can still lower a file's label by hand, so the Maintain review checks downgrades in these libraries. _Enforced by a mechanism._ ## 4. Pilot to production **Rollout approach:** By risk tier (Pilot size: 2 or 3 libraries with consenting owners). Library defaults are only worth it where content is consistently sensitive. Starting with the clearest, highest-risk libraries shows the value and the friction before extending to more libraries. 1. **Agree the candidate list** (Change: Inform) Confirm each library and label with its owner. For each library, record why it qualifies, the label it should carry, and who agreed it. Move on when: Every candidate has an approved label and an owner. 2. **Set pilot defaults** (Change: Explain) Configure defaults on two or three libraries and watch for two weeks. Ask owners to report anything that changed for them or their partners, and keep the test short so the pilot stays focused. Move on when: Owners confirm work continues normally. 3. **Label existing files** (Change: Explain) Run the existing-files policy for pilot sites if chosen. Run the existing-files policy on the pilot sites first, then check with owners that the files they work with every day still open and share as before. Move on when: Existing files carry the default with no access complaints. 4. **Extend to all approved libraries** Set remaining defaults and run existing-files batches. Work through the approved list in the order of sensitivity, and update the register as each library is done. Move on when: All approved libraries have defaults. 5. **Review in the Maintain rhythm** (Change: Sustain) Add the register to the quarterly review. Each quarter, confirm every library on the register still holds the kind of content it was approved for, and remove defaults where it no longer does. Move on when: The register is current and reviewed. ## 5. Common challenges - **If you** Put defaults on mixed-use libraries. What tends to happen: Routine files get labelled as sensitive, sharing gets harder, and people lower labels to cope.. A better approach: Use defaults only where almost everything belongs at one level. - **If you** Expect the default to label files already there. What tends to happen: Old files stay unlabelled, and reports show gaps nobody expected.. A better approach: Use the existing-files policy, or accept that files are labelled as they are edited. - **If you** Let owners set defaults with no record. What tends to happen: Defaults drift from the approved list, and nobody knows which libraries carry which label.. A better approach: Keep a register and set defaults on sensitive libraries through the admin. - **If you** Choose a label with user-defined permissions. What tends to happen: The default can't be selected, or people are prompted for permissions on every file.. A better approach: Use a label with admin-defined permissions, or none, as the default. - **If you** Set an encrypting default without testing partners. What tends to happen: External collaborators who used to open files in the library suddenly can't, and the site owner asks for the default to be removed.. A better approach: Test sharing with every regular external party before setting an encrypting default. - **If you** Treat the library default as a lock. What tends to happen: People lower labels by hand on files that should stay protected, and nobody notices.. A better approach: Pair defaults with the monthly downgrade review and, for the riskiest actions, a DLP rule on those labels. ## 6. Checkpoints **Pilot:** - [ ] Are labels for SharePoint and OneDrive, and PDF support if needed, turned on? - [ ] Do pilot libraries label new and edited files as expected? - [ ] Do owners understand that manual labels are never replaced? - [ ] Has sharing with each regular external party been tested in pilot libraries? **Production:** - [ ] Does every approved library have its default? - [ ] Are existing files handled as planned? - [ ] Is there a register of library defaults reviewed with Maintain? - [ ] Do site owners know who to contact if the default gets in the way? ## 7. Success measures Capture a baseline before you start, or you won't be able to show the change. - Files in approved libraries with a label (Where you see it: Data explorer; Good direction: Up) - Labels applied by library defaults (Where you see it: Audit log; Good direction: Up) - Labels lowered by hand in these libraries (Where you see it: Activity explorer; Good direction: Down) - Owner requests to remove a library default (Where you see it: Service desk; Good direction: Down) **Ready-to-use text: Message to library owners** > From [date], new and edited files in [library] will be labelled [label] automatically. Files you've already labelled keep their label. This helps protect [what the library holds] wherever the files go. If the label gets in the way of your work, tell us at [channel]. **Ready-to-use text: Library default register** > Site | Library | Default label | Existing files labelled (date) | Site owner | Approved by | Next review **Ready-to-use text: Questions to ask a site owner before setting a default** > 1. What does this library hold, and is almost everything in it equally sensitive? 2. Who outside the organization opens these files? 3. Does anyone co-edit these files with partners? 4. If every new file here were labelled [label], what would stop working? 5. Who should we contact if something breaks? ## 8. Additional reading **Plan:** - [Enable sensitivity labels for files in SharePoint and OneDrive](https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-onedrive-files) - [Microsoft Purview service description](https://learn.microsoft.com/en-us/office365/servicedescriptions/microsoft-365-service-descriptions/microsoft-365-tenantlevel-services-licensing-guidance/microsoft-purview-service-description) **Configure:** - [Configure a default sensitivity label for a SharePoint document library](https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-default-label) - [Automatically apply a sensitivity label to Microsoft 365 data](https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically) **Monitor:** - [Get started with data explorer](https://learn.microsoft.com/en-us/purview/data-classification-data-explorer) - [Audit log activities](https://learn.microsoft.com/en-us/purview/audit-log-activities) ## Changelog - Version 1, 2026-10-15, Sev Derghazarian: First version. Facts checked against Microsoft Learn on 2026-10-15.