M365 PlaybooksPurview · SharePoint · Teams · Exchange· Deploy · Document libraries
Set default labels for sensitive libraries
Purpose
Make sure files in the places that hold the most sensitive work carry the right label without relying on each person to choose it. Some libraries hold almost nothing but sensitive material: HR case files, board papers, legal matters. A default label on those libraries labels new and edited files as they arrive, so protection follows the files even after they leave the site.
Overview
Default sensitivity labels on libraries that hold one kind of sensitive work, so new and edited files are labelled as they arrive.
- Effort
- About 5 to 10 person-days
- Duration
- 3 to 6 weeks
- Complexity
- Low
- Who's in the room
- Purview admin, SharePoint admin, taxonomy owner, owners of the selected sites
- Licensing
- Default labels for SharePoint document libraries need Microsoft 365 E5, Microsoft Purview Suite, Microsoft 365 E5 Information Protection and Governance, or Office 365 E5.
Risk of not doing it
Files in the most sensitive libraries stay unlabelled or under-labelled, so encryption, DLP and Copilot protections based on labels don't apply where they matter most.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Confirm SharePoint and OneDrive label support
Library defaults need sensitivity labels for Office files in SharePoint and OneDrive to be turned on, which the core Deploy playbook covers. If you want PDFs labelled too, PDF support must be turned on separately. The label must be scoped to files and published to the person configuring the library, and only files with content are labelled. Check also that the label you plan to use is published to whoever will configure the library, because only labels published to that person appear in the library settings.
Find the libraries that qualify
A library default suits a library where almost everything belongs at one level. Ask the taxonomy owner and department heads for candidates, and check them with data explorer if you have it. Avoid general team libraries that mix routine and sensitive work; a default there over-labels everyday files and teaches people to lower labels. Good candidates usually share three traits: a clear owner, a single purpose, and content that would cause harm if it reached the wrong person. A library that holds 'everything for the team' rarely qualifies; a library that holds only signed contracts or case files usually does. Write the reason for each candidate down, because it is the first thing the site owner will ask. Keep the first list short, so each default gets a proper conversation with its owner and partners.
Decisions
Decision: Which labels can be library defaults?
Not every label can be a default. A library enabled for Information Rights Management can't have a default label, and labels that let users assign their own permissions, labels whose access expires, and Double Key Encryption labels aren't supported as defaults. A label that encrypts with permissions the admin defines is supported, but it changes how people work with those files, so check that with the site owner first. Check each candidate label against these limits before the conversation with the site owner, so you only offer labels that will work.
Options
- Use the most restrictive label everywhere
- Match each library to the label most of its content needs
Recommended default: Match each library to the label most of its content needs
Decision: What about files already in the library?
The default labels new uploads and existing files when they are edited, if they have no label or a lower-priority one. It doesn't label files at rest that nobody edits. A separate auto-labelling policy can apply each library's default to its existing files, without inspecting content; currently a tenant can have one such policy, covering up to ten sites at a time. Decide whether existing files can wait for edits or need that policy.
Options
- Label new and edited files only
- Also run the existing-files policy, ten sites at a time
Recommended default: Also run the existing-files policy, ten sites at a time
Decision: Who configures the default?
Setting a library's default needs site admin permissions, so site owners can do it themselves. For the most sensitive libraries, it is safer for the SharePoint admin to set it with the site owner's agreement and record it, so defaults match the approved list. Whoever sets it, record the library, the label and the date in the register. Without it, nobody can tell months later why a library labels everything Highly Confidential, or whether it still should.
Options
- Site owners set defaults freely
- Admins set defaults on approved libraries, with owners' agreement
Recommended default: Admins set defaults on approved libraries, with owners' agreement
Pilot configuration
Set defaults on two or three libraries
Configure the default on a few candidate libraries and watch what happens: in Office for the web the label is applied straight away, uploads can take a few minutes, and with desktop apps the label is applied after the app closes. Check that people can still open, share and co-edit the files they need. Ask the site owners to work normally for two weeks and to report anything that changed: a partner who can no longer open a file, a co-editing problem, or a label that looks wrong. If the default label encrypts, test sharing with each external party the library normally works with before going further.
Check how defaults interact with manual labels
A library default never replaces a label someone applied by hand, even a lower one, and it replaces a lower-priority label that was applied automatically or by a policy default. Walk the site owner through what that means: someone can still label a file lower by hand, and that change is audited. This matters because a library default isn't a lock: it labels what arrives, and people can still choose differently by hand. If a library must never hold files below a certain label, combine the default with the monthly downgrade review, and consider a DLP rule for the riskiest actions on those files.
Production configuration
Extend to the approved list
Set defaults on the remaining approved libraries and, if you chose to, run the existing-files policy in batches of up to ten sites, replacing the site list after each batch completes. Keep each batch's site list until it completes, then replace it with the next batch; the existing-files policy covers only the sites currently in its list.
Monitor and record
Labels applied by a library default are recorded in the audit log, so you can confirm defaults are working. Keep the list of libraries with defaults, their labels and owners, and review it with the Maintain stage. If you need to switch library defaults off across the tenant, there is a setting for that. Compare the register with the libraries you planned each quarter, and check data explorer for files still unlabelled in those libraries; they are usually files nobody has edited since the default was set.
Make it enforceable
The library default labels every new upload and edited file that has no label or a lower-priority one, without anyone choosing. Files at rest stay as they are unless the existing-files policy covers them, and people can still lower a file's label by hand, so the Maintain review checks downgrades in these libraries.
Enforced by a mechanism.
Pilot to production
Rollout approachBy risk tier · Pilot size: 2 or 3 libraries with consenting owners
Library defaults are only worth it where content is consistently sensitive. Starting with the clearest, highest-risk libraries shows the value and the friction before extending to more libraries.
Make your pilot representative
- Every major role, not only IT and enthusiasts
- More than one location or time zone
- Heavy users of the workload you are changing
- People who handle sensitive information
- At least one team you expect to be sceptical
Agree the candidate listChange: Inform
Confirm each library and label with its owner. For each library, record why it qualifies, the label it should carry, and who agreed it.
Move on when: Every candidate has an approved label and an owner
Set pilot defaultsChange: Explain
Configure defaults on two or three libraries and watch for two weeks. Ask owners to report anything that changed for them or their partners, and keep the test short so the pilot stays focused.
Move on when: Owners confirm work continues normally
Label existing filesChange: Explain
Run the existing-files policy for pilot sites if chosen. Run the existing-files policy on the pilot sites first, then check with owners that the files they work with every day still open and share as before.
Move on when: Existing files carry the default with no access complaints
Extend to all approved libraries
Set remaining defaults and run existing-files batches. Work through the approved list in the order of sensitivity, and update the register as each library is done.
Move on when: All approved libraries have defaults
Review in the Maintain rhythmChange: Sustain
Add the register to the quarterly review. Each quarter, confirm every library on the register still holds the kind of content it was approved for, and remove defaults where it no longer does.
Move on when: The register is current and reviewed
Common challenges
If youPut defaults on mixed-use libraries
What tends to happenRoutine files get labelled as sensitive, sharing gets harder, and people lower labels to cope.
A better approachUse defaults only where almost everything belongs at one level.
If youExpect the default to label files already there
What tends to happenOld files stay unlabelled, and reports show gaps nobody expected.
A better approachUse the existing-files policy, or accept that files are labelled as they are edited.
If youLet owners set defaults with no record
What tends to happenDefaults drift from the approved list, and nobody knows which libraries carry which label.
A better approachKeep a register and set defaults on sensitive libraries through the admin.
If youChoose a label with user-defined permissions
What tends to happenThe default can't be selected, or people are prompted for permissions on every file.
A better approachUse a label with admin-defined permissions, or none, as the default.
If youSet an encrypting default without testing partners
What tends to happenExternal collaborators who used to open files in the library suddenly can't, and the site owner asks for the default to be removed.
A better approachTest sharing with every regular external party before setting an encrypting default.
If youTreat the library default as a lock
What tends to happenPeople lower labels by hand on files that should stay protected, and nobody notices.
A better approachPair defaults with the monthly downgrade review and, for the riskiest actions, a DLP rule on those labels.
Checkpoints
Pilot
- Are labels for SharePoint and OneDrive, and PDF support if needed, turned on?
- Do pilot libraries label new and edited files as expected?
- Do owners understand that manual labels are never replaced?
- Has sharing with each regular external party been tested in pilot libraries?
Production
- Does every approved library have its default?
- Are existing files handled as planned?
- Is there a register of library defaults reviewed with Maintain?
- Do site owners know who to contact if the default gets in the way?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| Files in approved libraries with a label | Data explorer | Up |
| Labels applied by library defaults | Audit log | Up |
| Labels lowered by hand in these libraries | Activity explorer | Down |
| Owner requests to remove a library default | Service desk | Down |
Ready-to-use text
Message to library owners
From [date], new and edited files in [library] will be labelled [label] automatically. Files you've already labelled keep their label. This helps protect [what the library holds] wherever the files go. If the label gets in the way of your work, tell us at [channel].
Library default register
Site | Library | Default label | Existing files labelled (date) | Site owner | Approved by | Next review
Questions to ask a site owner before setting a default
1. What does this library hold, and is almost everything in it equally sensitive? 2. Who outside the organization opens these files? 3. Does anyone co-edit these files with partners? 4. If every new file here were labelled [label], what would stop working? 5. Who should we contact if something breaks?
Additional reading
Plan
Configure
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-15. |