How to publish sensitivity labels in Microsoft Purview

Publishing sensitivity labels in Microsoft Purview is two objects: the labels themselves (name, order, what they do to content) and a label policy that puts a chosen set of them in front of a chosen set of users with defaults and rules. The order matters — build the whole taxonomy first, publish a minimal policy to a pilot group, then widen — because renaming or reordering labels after users have applied them is painful, and encryption on the wrong label locks people out of their own documents.

Taxonomy design, why four labels beat twelve, encryption trade-offs, and the container-label story for Teams and sites are all in the Purview sensitivity labels deep dive. Sensitivity labels for Teams meetings covers the meeting variant. This page is the build and publish.

Prerequisites

• Compliance Administrator or Information Protection Admin role in Purview.
• Licensing per the FAQ — E3/Business Premium for the labels and manual application.
• An agreed label set. A workable default: Public, General (default), Confidential with sublabels All employees and Specific people, Highly Confidential. Write down for each: colour, description shown to users, marking (header/footer/watermark), and whether it encrypts and to whom.
• For container labels (Teams, groups, sites): enable sensitivity labels for groups in Entra with the EnableMIPLabels directory setting, and run Execute-AzureAdLabelSync once from Security & Compliance PowerShell. Skip this step if you only need file and email labels for now.
• A pilot group of 20–50 users across departments, including a couple of heavy external collaborators who will find the encryption problems first.

Steps

1. Create the labels

Purview portal → Solutions → Information protection → Labels → Create a label. For each label:

• Name and display name; a tooltip description users will actually read ("Business information not for public release; safe to share with employees and contractors").
• Scope: Items (files, emails, meetings) for all; add Groups & sites for container labels once the prerequisite is done.
• Items → Protection: for General, Content marking only (a footer is enough). For Confidential – All employees: Apply or remove encryption → Assign permissions now → Add all users and groups in your organization → Co-Author; set user access expires: Never, offline access: 7 days. For Highly Confidential: encrypt, assigned users = a specific group or Let users assign permissions, offline access 1 day. Do not encrypt General or Public.
• Auto-labelling for files and emails: leave off for the first pass unless licensed and tested.

Order the labels in the list from least to most sensitive — the order is the priority used for "requires justification to lower".

2. Create the label policy

Information protection → Label policies → Publish label. Choose the labels to publish (all of them, or a subset for the pilot). Users and groups: the pilot group. Policy settings:

• Users must provide a justification to remove a label or lower its classification: on.
• Require users to apply a label to their emails and documents: off for the pilot, consider on later — mandatory labelling generates helpdesk noise until people are used to it.
• Provide users with a link to a custom help page: your intranet page.
• Default label for documents: General. Default for emails: General (or Same as document). Default for meetings: General if licensed. Default for sites and groups: General if container labels are on.

Name it LP-Pilot-AllLabels and publish.

3. Wait for replication and check clients

Up to 24 hours. Microsoft 365 Apps (Current Channel) show a Sensitivity button on the Home ribbon; Outlook on the web and the new Outlook show it in the compose toolbar; Teams shows the label picker on team creation if container labels are on. If a user has the old AIP client, uninstall it.

4. Pilot for two weeks

Ask the pilot group to label their normal work. Watch for: encrypted documents that external partners cannot open (fix by teaching Specific people or by adding the partner domain to the label), attachments that lose labels when saved from email (expected on some paths — note it), and mobile apps not showing labels (they need the latest versions).

5. Widen the policy

Change Users and groups on the policy to All users, or publish a second policy for the wider population and keep the pilot policy for testing changes — policies are additive, and a user in two policies gets the union of labels with the higher-priority policy's settings.

Verify

• Connect-IPPSSession; Get-Label | Select DisplayName,Priority; Get-LabelPolicy | fl Name,Labels,DistributionStatus shows the labels in the intended order and the policy Success.
• A pilot user applies Confidential – All employees to a Word document, saves to OneDrive, and an external guest with a sharing link cannot open it; an internal user can.
• Activity explorer in Purview shows label application events; Content explorer (E5) shows labelled counts by location.
• Outlook shows the default label on a new email and prompts for justification when a user lowers it.

Roll back

Remove users from the label policy or delete the policy; labels stop appearing in clients but content that already carries a label keeps it, and encrypted content stays encrypted with the label's permissions — a super user (configured under Information protection → Settings → Super users) can always open it. Never delete a label that has been applied: retire it by removing it from every policy, and keep it in the list so existing content remains readable and reportable.