# Test labels and get ready to deploy - URL: https://m365playbooks.com/playbooks/test-labels-and-get-ready-to-deploy/ - Topic: Sensitivity labels and label policies (Program) - Product: Purview, SharePoint, Teams, Exchange - Stage: Prepare - Last reviewed: October 15, 2026 - Version: 1 - Written by: Sev Derghazarian ## 1. Purpose Prove that labels work with how the organization actually works before anyone outside the project sees them. Encryption and labels touch every process that opens, stores, signs or shares a file, including systems outside Microsoft 365. Testing them in a sandbox against a real test matrix, and recording what changes for people, is what turns a rollout from a series of surprises into a series of decisions. ## 2. Overview A sandbox test against a matrix of real processes, a register of impacts and limitations, support readiness, and a go/no-go before Deploy. - Effort: About 10 to 20 person-days - Duration: 4 to 8 weeks - Complexity: Medium - Who's in the room: Purview admin, owners of critical processes (e-signature, records, finance, legal), Microsoft 365 Apps admin, service desk lead, communications lead - Beyond E5: Nothing beyond Microsoft 365 E5 - Risk of not doing it: Without testing, the first person to find that a signed PDF workflow or a partner platform can't handle labelled files is a user, and the rollout stalls while it's fixed in production. ## 3. Key activities ### Prerequisites 1. **Set up a sandbox that behaves like production** Use a test tenant, or publish the labels only to a small test group in production through its own label policy. A test tenant is safest, but it rarely has your real integrations; a scoped test group in production tests the real thing, as long as everyone in it knows they are testing. Many organizations use both: the test tenant for settings, a production test group for processes. Turn on the same platform settings you plan for production: sensitivity labels for Office files in SharePoint and OneDrive, co-authoring for encrypted files, and PDF labelling if needed. Co-authoring for encrypted files can only be turned off later with PowerShell, so test it before deciding. Who: Purview admin. Produces: A sandbox with labels, policies and settings matching the specification. 2. **List every process that touches labelled content** Ask process owners what opens, stores, converts, signs or sends their files: e-signature, document management and other specialist applications, scanning and printing, archiving, mobile access, and partners. Most surprises come from systems outside Microsoft 365, so this list is the backbone of the test matrix. Who: Purview admin with process owners. Produces: A list of processes to test. ### Decisions 3. **Decision: What does the test matrix cover?** Cover Office apps on desktop, web and mobile; co-authoring (without co-authoring for encrypted files, AutoSave is off for encrypted files); PDFs (signed PDFs can't be labelled, and Print to PDF removes the label after a warning); the retired Azure Information Protection add-in and perpetual Office, which don't show labels; external recipients opening encrypted files; search, eDiscovery and DLP on encrypted content; Copilot with and without the EXTRACT right; and each process on your list. Options: Office apps only; Office apps plus every process that touches labelled files. Recommended default: Office apps plus every process that touches labelled files. Who: Purview admin. Produces: A test matrix with an owner for each row. 4. **Decision: Who signs off?** IT can confirm that labels work in Microsoft 365, but only a process owner can confirm that their process still works. Ask each owner to sign off their rows; it also gives them a stake in the rollout. Where an owner can't sign off, record why and what would change their mind, so the go/no-go discussion starts from facts. Options: IT signs off alone; Each process owner signs off their rows. Recommended default: Each process owner signs off their rows. Who: Taxonomy owner. Produces: Named sign-off owners. ### Pilot configuration 5. **Run the matrix with the people who own each process** Test with real documents (anonymized where needed) and the people who use each process every day. Run each scenario with each label that applies protection, not just the top one, and with at least one external partner where files leave the organization. Record the result, the workaround if one is needed, and whether it blocks deployment. Fix and retest; some fixes are label changes, others are process changes or guidance. Who: Purview admin with process owners. Produces: A completed matrix with results and fixes. 6. **Record impacts, limitations and benefits** For each audience, write what changes, what no longer works or needs a workaround, and what they gain. This register is what leadership signs off, what the adoption plan explains, and what the service desk answers from. Be honest about limitations: a workaround people hear about before the rollout is accepted far more readily than one they discover on their own. Who: Taxonomy owner with the communications lead. Produces: An impacts, limitations and benefits register. ### Production configuration 7. **Get support ready** Brief the service desk with the register and the known issues, ideally with a short hands-on session in the sandbox, give them a short decision tree (wrong label, can't open, can't share, can't remove), and agree how a ticket reaches the Purview admin and the taxonomy owner. Who: Service desk lead. Produces: A briefed service desk and escalation path. 8. **Draft the adoption plan** Use the register to decide who needs to hear what, and when, through Deploy's observe, nudge and enforce phases. The Go further adoption playbook in this topic sets it out step by step. Who: Communications lead. Produces: A draft adoption plan. 9. **Hold the go/no-go** Review the matrix, the register and support readiness with the taxonomy owner and process owners. Go means no blocking issue is open, every critical process is signed off, and the communications are ready. No-go means a dated list of what must change. Agree the criteria before testing starts, so the decision isn't argued from scratch at the end. Who: Taxonomy owner. Produces: A recorded go/no-go decision. 10. **Make it enforceable** Labels and policies stay limited to the test group until the go/no-go is signed. The label policy's scope is the mechanism; the signed checklist is the gate. _Enforced by a mechanism._ ## 4. Test to sign-off 1. **Build the sandbox** Labels, policies and platform settings match the specification. Move on when: The sandbox behaves like production. 2. **Run the test matrix** Process owners test with real documents. Move on when: Every row has a result. 3. **Fix and retest** (Change: Explain) Change labels, processes or guidance and retest what failed. Move on when: No blocking issue is open. 4. **Go/no-go** (Change: Inform) Owners review the matrix, register and support readiness. Move on when: Every critical process is signed off. ## 5. Common challenges - **If you** Test only Office apps. What tends to happen: A partner platform or e-signature workflow fails on the first day of the rollout.. A better approach: Build the matrix from every process that touches labelled files. - **If you** Forget digitally signed PDF workflows. What tends to happen: Signed PDFs can't be labelled, and a contract process breaks.. A better approach: Test signed PDF workflows explicitly and agree a workaround before Deploy. - **If you** Test with IT only. What tends to happen: Everything works for IT and fails for finance or legal.. A better approach: Have each process owner test and sign off their own rows. - **If you** Leave the impacts register until the end. What tends to happen: Communications are written from assumptions, and people discover limitations on their own.. A better approach: Write the register as you test, so the adoption plan and service desk briefing draw on it. - **If you** Treat the go/no-go as a formality. What tends to happen: Known issues ship, and the first wave becomes the real test.. A better approach: Agree go criteria in advance and record a dated no-go list when they aren't met. ## 6. Checkpoints **Pilot:** - [ ] Does the sandbox use the same settings planned for production? - [ ] Does every process that touches labelled files have a row in the matrix? **Production:** - [ ] Were the go criteria agreed before testing started? - [ ] Is every critical process signed off by its owner? - [ ] Is the impacts register written and shared with leadership? - [ ] Is the service desk briefed? - [ ] Is the go/no-go recorded? ## 7. Success measures Capture a baseline before you start, or you won't be able to show the change. - Test cases passed (Where you see it: Test matrix; Good direction: Up) - Open blocking issues (Where you see it: Test matrix; Good direction: Down) - Critical processes signed off (Where you see it: Go/no-go checklist; Good direction: Up) **Ready-to-use text: Test matrix (copy into a spreadsheet)** > Columns: Area | Scenario | Label | Steps | Expected | Result | Workaround | Blocking (Y/N) | Owner | Signed off. > Rows to start with: Word, Excel, PowerPoint desktop, web and mobile | Co-authoring an encrypted file | Opening an encrypted file as an external recipient | Email with a labelled attachment | Print to PDF and Save as PDF | Labelling a PDF in SharePoint | Signed PDF workflow | E-signature platform | Document management or other specialist application | Scanning and printing | Search and eDiscovery for encrypted files | DLP on labelled content | Copilot summary with and without EXTRACT | Lowering a label (justification prompt) | Older Office or the retired AIP add-in. **Ready-to-use text: Impacts, limitations and benefits register** > Columns: Audience | What changes | What stops working or needs a workaround | What they gain | How we'll tell them | Owner. **Ready-to-use text: Go/no-go checklist** > 1. No blocking issue open. 2. Every critical process signed off by its owner. 3. Impacts register approved. 4. Service desk briefed with known issues. 5. Adoption plan and first-wave messages ready. 6. Rollback known: how to unpublish labels from the pilot. ## 8. Additional reading **Plan:** - [Get started with sensitivity labels](https://learn.microsoft.com/en-us/purview/get-started-with-sensitivity-labels) **Configure:** - [Manage sensitivity labels in Office apps](https://learn.microsoft.com/en-us/purview/sensitivity-labels-office-apps) - [Enable sensitivity labels for files in SharePoint and OneDrive](https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-onedrive-files) - [Enable co-authoring for encrypted documents](https://learn.microsoft.com/en-us/purview/sensitivity-labels-coauthoring) - [Apply encryption using sensitivity labels](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels) - [Considerations for Microsoft Purview to manage Microsoft 365 Copilot](https://learn.microsoft.com/en-us/purview/ai-m365-copilot-considerations) **Monitor:** - [Minimum versions for sensitivity labels in Microsoft 365 Apps](https://learn.microsoft.com/en-us/purview/sensitivity-labels-versions) ## Changelog - Version 1, 2026-10-15, Sev Derghazarian: First version. Facts checked against Microsoft Learn on 2026-10-15.