Microsoft Purview Sensitivity Labels for SharePoint

Sensitivity labels are one of the cleanest ways to turn SharePoint governance from policy text into enforceable tenant behavior. They help admins classify sites, reduce oversharing, control guest access, set safer sharing defaults, and protect sensitive files after they leave SharePoint. The implementation only works well when you separate two ideas: labels for files and labels for containers.

• Use container labels to govern SharePoint site behavior, and file labels to protect individual documents.
• Enable SharePoint and OneDrive label integration before validating file-label behavior.
• Use PowerShell to discover label GUIDs, sync labels, apply site labels, and export coverage reports.
• Validate sharing defaults, guest behavior, unmanaged-device controls, and unlabeled-site exceptions before broad rollout.
• Troubleshoot in order: scope, publication, synchronization, site assignment, then user-facing behavior.

What Sensitivity Labels Do in SharePoint

SharePoint uses sensitivity labels in two related but different ways. File labels classify and protect individual documents. Container labels classify the SharePoint site, Microsoft 365 group, or team that holds the work. That distinction matters because applying a label to a site does not automatically stamp the same label on every file inside the site.

A mature SharePoint label strategy uses both. Container labels set the boundary for the workspace. File labels protect the content itself, especially when documents are downloaded, emailed, synchronized, or moved to another location.

Recommended Label Model for SharePoint

Start with a small taxonomy. Too many labels slow adoption, create exceptions, and make reporting harder. For most Microsoft 365 tenants, four site labels are enough for the first rollout.

Implementation Plan

Implement labels in phases. A big-bang label launch usually creates confusion because site owners see new choices before governance has decided what each label means.

• 1
  Inventory sensitive SharePoint sites

  Export all active sites, owners, sharing capability, templates, storage, and activity. Identify sites with HR, finance, legal, executive, regulated, or customer data.

• 2
  Define label behavior before creating labels

  Agree which labels allow guests, which block external sharing, which require unmanaged-device restrictions, and which should change default sharing links.

• 3
  Enable SharePoint and container support

  Turn on sensitivity labels for SharePoint and OneDrive files, then synchronize labels for Microsoft 365 groups and SharePoint site use.

• 4
  Pilot with controlled sites

  Apply labels to a small set of real sites. Include at least one communication site, one team site, one guest-enabled site, and one high-sensitivity site.

• 5
  Validate behavior and publish the policy

  Confirm labels appear where expected, site settings are enforced, sharing defaults change correctly, and owners understand what each label means.

PowerShell Prerequisites

Use the SharePoint Online Management Shell for SharePoint tenant and site configuration, and Exchange Online PowerShell for Microsoft Purview label operations exposed through Security & Compliance PowerShell.

Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser -Force
Install-Module ExchangeOnlineManagement -Scope CurrentUser -Force

Update-Module Microsoft.Online.SharePoint.PowerShell
Update-Module ExchangeOnlineManagement

Get-Module Microsoft.Online.SharePoint.PowerShell -ListAvailable |
    Sort-Object Version -Descending |
    Select-Object -First 1 Name, Version

Get-Module ExchangeOnlineManagement -ListAvailable |
    Sort-Object Version -Descending |
    Select-Object -First 1 Name, Version

Use an account with the right administrative roles. Global Administrator is common during initial enablement, but production operations should use least privilege roles such as Compliance Administrator, Information Protection Administrator, SharePoint Administrator, or Security Administrator where appropriate.

PowerShell: Enable Labels for SharePoint Files

First enable support for sensitivity labels in SharePoint and OneDrive. This lets the service process labeled Office files in SharePoint and OneDrive, and it is required before default document-library labels can behave as expected.

$tenantName = "contoso"
$adminUrl   = "https://$tenantName-admin.sharepoint.com"

Connect-SPOService -Url $adminUrl

# Enable sensitivity label integration for Office files in SharePoint and OneDrive.
Set-SPOTenant -EnableAIPIntegration $true

# Optional: enable PDF label support when your tenant and licensing support it.
Set-SPOTenant -EnableSensitivityLabelforPDF $true

Get-SPOTenant |
    Select-Object EnableAIPIntegration, EnableSensitivityLabelforPDF

PowerShell: Discover Label IDs

Most SharePoint label operations require the label GUID. Get it from Purview PowerShell before applying labels to sites in bulk.

Connect-IPPSSession

Get-Label |
    Select-Object DisplayName, Name, Guid, ContentType, Priority, Disabled |
    Sort-Object Priority |
    Format-Table -AutoSize

Get-Label |
    Select-Object DisplayName, Name, Guid, ContentType, Priority, Disabled |
    Export-Csv .\purview-sensitivity-labels.csv -NoTypeInformation

For labels that must be available to SharePoint sites, confirm the label scope includes Groups & sites. In PowerShell output, that scope is reflected as site and unified group support in the label content type.

PowerShell: Sync Labels for Sites and Groups

After creating or changing labels for Groups & sites, synchronize them so they become available for Microsoft 365 groups and SharePoint-backed workspaces. Microsoft documentation notes that availability can take time after synchronization.

Connect-IPPSSession

# Synchronize Purview sensitivity labels to Microsoft Entra ID.
Execute-AzureAdLabelSync

# Check the label list again after sync and replication.
Get-Label |
    Where-Object { $_.ContentType -match "Site|UnifiedGroup" } |
    Select-Object DisplayName, Guid, ContentType, Disabled |
    Format-Table -AutoSize

PowerShell: Configure Safer Sharing Defaults

Some useful SharePoint label settings are configured through advanced label settings. A common governance pattern is to make confidential sites default to specific-people links, with view permission unless editing is explicitly needed.

Connect-IPPSSession

$label = Get-Label -Identity "Confidential"

# Default sharing links for sites using this label should target specific people.
Set-Label -Identity $label.Guid -AdvancedSettings @{
    DefaultSharingScope = "SpecificPeople"
}

# Default link permission should be View, not Edit.
Set-Label -Identity $label.Guid -AdvancedSettings @{
    DefaultShareLinkPermission = "View"
}

# Alternative: force the default sharing option to people with existing access.
# This overrides DefaultSharingScope and DefaultShareLinkPermission.
# Set-Label -Identity $label.Guid -AdvancedSettings @{
#     DefaultShareLinkToExistingAccess = "True"
# }

PowerShell: Apply a Label to One SharePoint Site

Use Set-SPOSite when you need to label an individual site or when different sites need different labels. This is the safer rollout command for pilot work.

$tenantName = "contoso"
$adminUrl   = "https://$tenantName-admin.sharepoint.com"
$siteUrl    = "https://$tenantName.sharepoint.com/sites/finance"

Connect-SPOService -Url $adminUrl

$labelId = [Guid]"00000000-0000-0000-0000-000000000000"

Set-SPOSite -Identity $siteUrl -SensitivityLabel $labelId

Get-SPOSite -Identity $siteUrl |
    Select-Object Url, Title, Template, SharingCapability, SensitivityLabel

PowerShell: Bulk Apply Labels to Sites

Bulk application should always start with an export and review. The script below identifies candidate sites, exports them for owner approval, then applies the label only if you remove the dry-run guard.

$tenantName = "contoso"
$adminUrl   = "https://$tenantName-admin.sharepoint.com"
$labelId    = [Guid]"00000000-0000-0000-0000-000000000000"
$dryRun     = $true

Connect-SPOService -Url $adminUrl

$candidateSites = Get-SPOSite -Limit All |
    Where-Object {
        $_.Url -like "https://$tenantName.sharepoint.com/sites/finance*" -and
        $_.Template -notlike "SPSPERS*"
    } |
    Select-Object Url, Title, Owner, Template, SharingCapability, SensitivityLabel

$candidateSites | Export-Csv .\candidate-sites-for-confidential-label.csv -NoTypeInformation

if ($dryRun) {
    $candidateSites | Format-Table Url, Title, SharingCapability, SensitivityLabel -AutoSize
    Write-Host "Dry run only. Review the CSV, then set `$dryRun = `$false to apply the label."
    return
}

foreach ($site in $candidateSites) {
    Set-SPOSite -Identity $site.Url -SensitivityLabel $labelId
    Write-Host "Applied label to $($site.Url)"
}

Microsoft also documents using Set-SPOTenant with the SensitivityLabel parameter when applying the same label to many sites returned from a site query. Use that approach only when the target set is well reviewed because the blast radius is larger.

Validation Checklist

Validation needs to prove both configuration and user-facing behavior. A label that appears in a report but does not enforce the expected sharing, guest, or device behavior is not complete.

Tenant-level validation

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

Get-SPOTenant |
    Select-Object `
        EnableAIPIntegration,
        EnableSensitivityLabelforPDF,
        SharingCapability,
        DefaultSharingLinkType,
        DefaultLinkPermission

Label and policy validation

Connect-IPPSSession

Get-Label |
    Select-Object DisplayName, Guid, ContentType, Priority, Disabled |
    Sort-Object Priority |
    Format-Table -AutoSize

Get-LabelPolicy |
    Select-Object Name, Labels, ExchangeLocation, SharePointLocation, ModernGroupLocation, Enabled |
    Format-List

Site-level validation

Connect-SPOService -Url "https://contoso-admin.sharepoint.com"

$sites = Get-SPOSite -Limit All |
    Where-Object { $_.Template -notlike "SPSPERS*" } |
    Select-Object Url, Title, Owner, Template, SharingCapability, SensitivityLabel

$sites |
    Export-Csv .\sharepoint-sites-label-status.csv -NoTypeInformation

$sites |
    Group-Object SensitivityLabel |
    Sort-Object Count -Descending |
    Select-Object Count, Name |
    Format-Table -AutoSize

$sites |
    Where-Object { [string]::IsNullOrWhiteSpace($_.SensitivityLabel) } |
    Export-Csv .\sharepoint-sites-without-sensitivity-label.csv -NoTypeInformation

User acceptance validation

• Create one test site for each label and confirm the label appears in the SharePoint admin center Active sites view.
• Open each test site as a site owner and confirm the selected label is visible where expected.
• Test the Share button in a labeled site and confirm the default link type matches the label design.
• Test guest invitation behavior from a confidential site and a general collaboration site.
• Test access from an unmanaged device when the label is intended to trigger stronger access rules.
• Upload labeled and unlabeled documents to a pilot library and confirm Office for the web opens them as expected.

Troubleshooting

Most SharePoint sensitivity label issues come from scope, synchronization, publication, licensing, or using the wrong PowerShell session. Work through the layers in order.

PowerShell troubleshooting commands

$tenantName = "contoso"
$adminUrl   = "https://$tenantName-admin.sharepoint.com"
$siteUrl    = "https://$tenantName.sharepoint.com/sites/finance"

Connect-SPOService -Url $adminUrl
Connect-IPPSSession

$tenantSettings = Get-SPOTenant |
    Select-Object EnableAIPIntegration, EnableSensitivityLabelforPDF, SharingCapability

$siteSettings = Get-SPOSite -Identity $siteUrl |
    Select-Object Url, Title, Template, SharingCapability, SensitivityLabel

$labels = Get-Label |
    Select-Object DisplayName, Guid, ContentType, Priority, Disabled

$policies = Get-LabelPolicy |
    Select-Object Name, Labels, Enabled, ExchangeLocation, SharePointLocation, ModernGroupLocation

$tenantSettings | Format-List
$siteSettings   | Format-List
$labels         | Format-Table -AutoSize
$policies       | Format-List

Governance Operating Model

The real value of sensitivity labels is not the label name. It is the governance model around the label: who can apply it, who approves exceptions, how drift is detected, and what happens when a site changes purpose.

• Label owners: Assign business and security owners for each label. Do not let IT invent the taxonomy in isolation.
• Creation standards: Require new sensitive sites to select a label during provisioning, ideally through a request or template process.
• Quarterly review: Export unlabeled sites, externally shared sites, and highly confidential sites with guests every quarter.
• Exception register: Keep a dated exception list for confidential sites that need guests, organization links, or relaxed device controls.
• Copilot readiness: Treat unlabeled high-risk sites as blockers before broad Microsoft 365 Copilot rollout.

Recommended Rollout Timeline