How to create sensitivity labels for documents and email

What this check looks at

Checks, from Microsoft Secure Score, that sensitivity labels are published so people can mark and protect confidential documents and email.

Sensitivity labels are how Microsoft 365 knows which documents and emails are confidential, so it can encrypt them, mark them, keep them from being shared outside and show DLP and Copilot what they are. Labels are created and published in Microsoft Purview; until they are published, nobody can apply one. This check is the Secure Score view of that, for tenants where ConfigCheckup does not read Purview directly.

The check uses Microsoft Secure Score’s assessment of its information protection actions, matched by name (those about sensitivity labels and information protection, not retention or DLP). It passes when Secure Score shows every matching action as done, and warns when any is not, naming up to three. It reports not checked when Secure Score does not track labels for the tenant, usually because it has no Microsoft Purview Information Protection licence. Secure Score can take up to 48 hours to catch up with a change; the check that reads Purview directly (NL-PVW-106) shows it sooner.

Without labels every document looks the same to every protection. A board paper, a client contract and a lunch menu are treated alike: shared as freely, kept as long, and opened by whoever receives them, wherever they are.

Why it matters

Labels are how Microsoft 365 knows which documents are confidential, so it can encrypt them, stop them being shared externally and show them to DLP. Without labels, every document looks the same to every protection.

A typical case: a departing employee forwards a folder of client contracts to their personal Gmail. If the contracts had carried a Confidential label with encryption for the organisation’s staff, the files would have been unreadable outside it. Without labels they open normally, and the firm has to tell its clients their contracts have left its control.

Labels also make the rest of the security programme cheaper: DLP rules become "block Confidential to outside addresses" rather than long lists of patterns, and reviews can start with what is labelled most sensitive.

CIS Microsoft 365 Foundations Benchmark 3.3.1 asks for sensitivity label policies to be published (this check covers it partly, through Secure Score). It is ISO 27001 A.5.12 and A.5.13, the NCSC Cyber Assessment Framework’s B3.a and the DSPT’s standard on personal confidential data. Manual labelling is included with Business Premium and E3.

How to fix it

Where: Microsoft Purview portal → Information protection

Before you start

• Agree three or four labels with the business, with a short plain-English description of each.
• Decide whether any label applies encryption; that changes who can open files.

Step by step

1. 1See which Secure Score actions are open. In the Microsoft Defender portal, open Microsoft Secure Score, go to Recommended actions and search for "label". Note each information protection action not completed; they match the ones in the evidence.
2. 2Agree the labels with the business. Agree three or four labels with short descriptions, for example Public, Internal, Confidential and Confidential – internal only, and decide which should encrypt content and which should only mark it.
3. 3Create the labels with protection. In the Microsoft Purview portal, go to Solutions > Information Protection > Sensitivity labels > Create a label. Set the scope to files and emails. For Confidential, turn on access control (encryption with permissions for all users and groups in your organisation) and content marking (a header or footer); allow sharing outside only for Public. Repeat for each label.
4. 4Publish them to all users. Go to Information Protection > Publishing policies > Publish labels, choose the labels, publish to all users and groups, set a default label for documents and email, and require a justification for removing or lowering a label. Submit. Labels can take up to 24 hours to reach Office apps.
5. 5Turn on labels for files in SharePoint and OneDrive. Connect with SharePoint Online PowerShell as a SharePoint Administrator: Connect-SPOService -Url https://<tenant>-admin.sharepoint.com. Run Set-SPOTenant -EnableAIPIntegration $true so labelled and encrypted files can be searched, co-authored and opened in the browser.
6. 6Confirm the change. Word and Outlook show a Sensitivity button with your labels. Within 48 hours the matching Secure Score actions show as completed, and the next assessment passes; NL-PVW-106 confirms the publishing policy straight away where Purview is read directly.

What users will notice

Users see a Sensitivity button in Office apps and can label documents and emails.

How to confirm it worked

Microsoft Purview, Information protection, Label policies: a published policy covers all users.

Frameworks and controls

This check maps to controls in 12 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Learn about sensitivity labels (Microsoft Learn)

Related checks

• How to publish sensitivity labels in Microsoft Purview
• How to apply sensitivity labels to Teams, groups and sites
• How to set up retention labels in Microsoft Purview
• How to publish retention labels in Microsoft Purview

The full Microsoft 365 security checklist, worst first