M365 PlaybooksPurview · SharePoint · Teams · Exchange· Prepare · Testing and readiness
Test labels and get ready to deploy
Purpose
Prove that labels work with how the organization actually works before anyone outside the project sees them. Encryption and labels touch every process that opens, stores, signs or shares a file, including systems outside Microsoft 365. Testing them in a sandbox against a real test matrix, and recording what changes for people, is what turns a rollout from a series of surprises into a series of decisions.
Overview
A sandbox test against a matrix of real processes, a register of impacts and limitations, support readiness, and a go/no-go before Deploy.
- Effort
- About 10 to 20 person-days
- Duration
- 4 to 8 weeks
- Complexity
- Medium
- Who's in the room
- Purview admin, owners of critical processes (e-signature, records, finance, legal), Microsoft 365 Apps admin, service desk lead, communications lead
- Beyond E5
- Nothing beyond Microsoft 365 E5.
Risk of not doing it
Without testing, the first person to find that a signed PDF workflow or a partner platform can't handle labelled files is a user, and the rollout stalls while it's fixed in production.
Key activities
The plan in order: what must be true first, what to decide, then how to configure the pilot and production.
Prerequisites
Set up a sandbox that behaves like production
Use a test tenant, or publish the labels only to a small test group in production through its own label policy. A test tenant is safest, but it rarely has your real integrations; a scoped test group in production tests the real thing, as long as everyone in it knows they are testing. Many organizations use both: the test tenant for settings, a production test group for processes. Turn on the same platform settings you plan for production: sensitivity labels for Office files in SharePoint and OneDrive, co-authoring for encrypted files, and PDF labelling if needed. Co-authoring for encrypted files can only be turned off later with PowerShell, so test it before deciding.
List every process that touches labelled content
Ask process owners what opens, stores, converts, signs or sends their files: e-signature, document management and other specialist applications, scanning and printing, archiving, mobile access, and partners. Most surprises come from systems outside Microsoft 365, so this list is the backbone of the test matrix.
Decisions
Decision: What does the test matrix cover?
Cover Office apps on desktop, web and mobile; co-authoring (without co-authoring for encrypted files, AutoSave is off for encrypted files); PDFs (signed PDFs can't be labelled, and Print to PDF removes the label after a warning); the retired Azure Information Protection add-in and perpetual Office, which don't show labels; external recipients opening encrypted files; search, eDiscovery and DLP on encrypted content; Copilot with and without the EXTRACT right; and each process on your list.
Options
- Office apps only
- Office apps plus every process that touches labelled files
Recommended default: Office apps plus every process that touches labelled files
Decision: Who signs off?
IT can confirm that labels work in Microsoft 365, but only a process owner can confirm that their process still works. Ask each owner to sign off their rows; it also gives them a stake in the rollout. Where an owner can't sign off, record why and what would change their mind, so the go/no-go discussion starts from facts.
Options
- IT signs off alone
- Each process owner signs off their rows
Recommended default: Each process owner signs off their rows
Pilot configuration
Run the matrix with the people who own each process
Test with real documents (anonymized where needed) and the people who use each process every day. Run each scenario with each label that applies protection, not just the top one, and with at least one external partner where files leave the organization. Record the result, the workaround if one is needed, and whether it blocks deployment. Fix and retest; some fixes are label changes, others are process changes or guidance.
Record impacts, limitations and benefits
For each audience, write what changes, what no longer works or needs a workaround, and what they gain. This register is what leadership signs off, what the adoption plan explains, and what the service desk answers from. Be honest about limitations: a workaround people hear about before the rollout is accepted far more readily than one they discover on their own.
Production configuration
Get support ready
Brief the service desk with the register and the known issues, ideally with a short hands-on session in the sandbox, give them a short decision tree (wrong label, can't open, can't share, can't remove), and agree how a ticket reaches the Purview admin and the taxonomy owner.
Draft the adoption plan
Use the register to decide who needs to hear what, and when, through Deploy's observe, nudge and enforce phases. The Go further adoption playbook in this topic sets it out step by step.
Hold the go/no-go
Review the matrix, the register and support readiness with the taxonomy owner and process owners. Go means no blocking issue is open, every critical process is signed off, and the communications are ready. No-go means a dated list of what must change. Agree the criteria before testing starts, so the decision isn't argued from scratch at the end.
Make it enforceable
Labels and policies stay limited to the test group until the go/no-go is signed. The label policy's scope is the mechanism; the signed checklist is the gate.
Enforced by a mechanism.
Test to sign-off
Build the sandbox
Labels, policies and platform settings match the specification.
Move on when: The sandbox behaves like production
Run the test matrix
Process owners test with real documents.
Move on when: Every row has a result
Fix and retestChange: Explain
Change labels, processes or guidance and retest what failed.
Move on when: No blocking issue is open
Go/no-goChange: Inform
Owners review the matrix, register and support readiness.
Move on when: Every critical process is signed off
Common challenges
If youTest only Office apps
What tends to happenA partner platform or e-signature workflow fails on the first day of the rollout.
A better approachBuild the matrix from every process that touches labelled files.
If youForget digitally signed PDF workflows
What tends to happenSigned PDFs can't be labelled, and a contract process breaks.
A better approachTest signed PDF workflows explicitly and agree a workaround before Deploy.
If youTest with IT only
What tends to happenEverything works for IT and fails for finance or legal.
A better approachHave each process owner test and sign off their own rows.
If youLeave the impacts register until the end
What tends to happenCommunications are written from assumptions, and people discover limitations on their own.
A better approachWrite the register as you test, so the adoption plan and service desk briefing draw on it.
If youTreat the go/no-go as a formality
What tends to happenKnown issues ship, and the first wave becomes the real test.
A better approachAgree go criteria in advance and record a dated no-go list when they aren't met.
Checkpoints
Pilot
- Does the sandbox use the same settings planned for production?
- Does every process that touches labelled files have a row in the matrix?
Production
- Were the go criteria agreed before testing started?
- Is every critical process signed off by its owner?
- Is the impacts register written and shared with leadership?
- Is the service desk briefed?
- Is the go/no-go recorded?
Success measures
Capture a baseline before you start, or you won't be able to show the change.
| Measure | Where you see it | Good direction |
|---|---|---|
| Test cases passed | Test matrix | Up |
| Open blocking issues | Test matrix | Down |
| Critical processes signed off | Go/no-go checklist | Up |
Ready-to-use text
Test matrix (copy into a spreadsheet)
Columns: Area | Scenario | Label | Steps | Expected | Result | Workaround | Blocking (Y/N) | Owner | Signed off. Rows to start with: Word, Excel, PowerPoint desktop, web and mobile | Co-authoring an encrypted file | Opening an encrypted file as an external recipient | Email with a labelled attachment | Print to PDF and Save as PDF | Labelling a PDF in SharePoint | Signed PDF workflow | E-signature platform | Document management or other specialist application | Scanning and printing | Search and eDiscovery for encrypted files | DLP on labelled content | Copilot summary with and without EXTRACT | Lowering a label (justification prompt) | Older Office or the retired AIP add-in.
Impacts, limitations and benefits register
Columns: Audience | What changes | What stops working or needs a workaround | What they gain | How we'll tell them | Owner.
Go/no-go checklist
1. No blocking issue open. 2. Every critical process signed off by its owner. 3. Impacts register approved. 4. Service desk briefed with known issues. 5. Adoption plan and first-wave messages ready. 6. Rollback known: how to unpublish labels from the pilot.
Additional reading
Configure
Changelog
Changelog (1 version)
| Version | Date | Author | Change |
|---|---|---|---|
| 1 | Sev Derghazarian | First version. Facts checked against Microsoft Learn on 2026-10-15. |