How to publish sensitivity labels in Microsoft Purview

What this check looks at

Checks, in Microsoft Purview directly, that a sensitivity label policy is switched on and publishes labels to people.

Sensitivity labels (for example Public, Internal, Confidential) are created in Microsoft Purview, but nobody can use them until a label policy, which the portal calls a publishing policy, makes them available to users or groups. The policy also sets the defaults: a default label for documents and email, whether people must justify lowering a label, and whether labelling is mandatory.

The check reads the label policies directly from Purview. It passes when at least one policy is switched on, contains labels and is published to users or groups (its Exchange or Microsoft 365 groups location is set). It fails when there is no label policy at all, or when the policies are off or empty, and warns when a publishing policy came back without whether it is on.

Without published labels, nobody can mark a document as confidential in a way the rest of Microsoft 365 understands. Encryption that travels with the file, headers and footers that mark it, DLP rules that look for labelled content and Copilot’s handling of sensitive files all depend on labels being applied. A confidential file emailed to the wrong person can be opened by them; a labelled, encrypted one cannot.

Why it matters

Labels only protect anything once they are published: until then nobody can apply them, so no document is marked confidential, encrypted or kept from external sharing, and DLP and Copilot cannot tell sensitive files apart.

A typical case: an HR adviser forwards a salary review spreadsheet to what they think is a colleague, but autocomplete picks an outside address. If the spreadsheet had carried a "Confidential – internal only" label with encryption for the organisation’s staff, the recipient would have seen only a message that they do not have permission. Without it, the file opens, and the firm has a breach to assess.

Labels are also the foundation for later steps the business will want: DLP that treats Confidential files differently, Copilot that respects labels, and automatic labelling once the business is ready for it.

CIS Microsoft 365 Foundations Benchmark 3.3.1 asks that information protection sensitivity label policies are published. It is ISO 27001 controls A.5.12 and A.5.13 (classification and labelling of information). Manual labelling is included with Microsoft 365 Business Premium and E3.

How to fix it

Where: Microsoft Purview portal → Information protection → Publishing policies

Before you start

• Agree a short label set with the business (three or four labels) and what each one protects.
• Decide whether documents and email get a default label.

Step by step

1. 1Agree a short label set. Agree three or four labels with the business, each with a one-line description users will see: for example Public, Internal, Confidential and Confidential – internal only. Decide which labels encrypt content, since that changes who can open the files.
2. 2Create the labels. In the Microsoft Purview portal, go to Solutions > Information Protection > Sensitivity labels and select Create a label. Give it a name, display name and description, set the scope to files and emails, and for the confidential labels turn on access control (encryption, assigning permissions to all users and groups in your organisation) and content marking (a "Confidential" header or footer). Repeat for each label.
3. 3Publish them to everyone. Go to Information Protection > Publishing policies (Label policies in older versions of the portal) and select Publish labels. Choose the labels, publish to all users and groups, require a justification to remove a label or lower its classification, and set a default label for documents and email if the business wants one. Name the policy and submit.
4. 4Or create and publish them in PowerShell. Connect to Security & Compliance PowerShell (Install-Module ExchangeOnlineManagement, then Connect-IPPSSession) as a Compliance Administrator. Create each label with New-Label -Name "Confidential" -DisplayName "Confidential" -Tooltip "<description>", then publish them with New-LabelPolicy -Name "Sensitivity labels – all staff" -Labels "Public","Internal","Confidential" -ExchangeLocation All.
5. 5Turn on labels for files in SharePoint and OneDrive. So that labelled and encrypted Office files can be searched, co-authored and opened in the browser, turn on sensitivity labels for SharePoint and OneDrive. Connect with SharePoint Online PowerShell as a SharePoint Administrator: Connect-SPOService -Url https://<tenant>-admin.sharepoint.com. Run Set-SPOTenant -EnableAIPIntegration $true.
6. 6Tell users and confirm the labels arrive. Labels can take up to 24 hours to appear. Then Get-LabelPolicy | Select-Object Name, Enabled, Labels, ExchangeLocation shows an enabled policy with your labels published to All, and Word, Excel and Outlook show a Sensitivity button listing them.

What users will notice

People see a Sensitivity button in Office apps and Outlook and can label documents and email. Labels with encryption limit who can open the content.

How to confirm it worked

Get-LabelPolicy | Select-Object Name, Enabled, Labels, ExchangeLocation shows an enabled policy with labels published to All; the labels appear in Word within 24 hours.

Frameworks and controls

This check maps to controls in 13 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.

The framework mappings were last checked against the published standards in October 2026.

Microsoft’s documentation

• Create and publish sensitivity labels (Microsoft Learn)

Related checks

• How to create sensitivity labels for documents and email
• How to publish retention labels in Microsoft Purview
• How to keep email and files with Purview retention policies
• How to set up retention labels in Microsoft Purview

The full Microsoft 365 security checklist, worst first