6.2 Configure Auto-Labeling Policies

6.2 Configure Auto-Labeling Policies

Quick Answer: Client-side auto-labeling is a setting on the sensitivity label itself and runs in Office apps while someone edits a document or composes email. Service-side auto-labeling is a separate auto-labeling policy that labels files already saved in SharePoint or OneDrive and email processed by Exchange Online. Policies have no “recommended” mode; you validate them in simulation before they apply labels.

Why automatic labeling exists

Manual labeling depends on users remembering your classification scheme. Automatic labeling reduces that burden: you define conditions (sensitive information types, trainable classifiers, sharing state, and other properties), and Microsoft 365 applies or recommends the matching label. SC-401 expects you to know which engine does the work, because the two engines behave differently on overrides, visual markings, PDFs, incoming email, and user interaction.

There is a third, related idea that this section does not cover: default labels for Teams meetings, sites, groups, or Microsoft 365 Copilot. Those are publishing-policy or container settings, not auto-labeling policies for files and emails.

Client-side labeling in Office apps

Configure this on the sensitivity label: Auto-labeling for files and emails. When a user edits a Word, Excel, or PowerPoint document, or composes, replies to, or forwards an email in a supporting Outlook client, the app evaluates your conditions.

Client-side labeling can automatically apply a label or recommend a label with a policy tooltip. In both cases the user decides whether to accept or reject, which is why Microsoft describes this method as helping ensure correct labeling. The label can be applied even before the document is saved, so delay is minimal. Not every Office client version supports auto-labeling; unsupported apps simply never fire the condition.

Client-side labeling cannot restrict by SharePoint site or mailbox location, does not support condition exceptions or nested AND/OR/NOT rule logic, does not auto-label PDF files or images, does not label incoming email, and does not replace a manually applied label. It can apply visual markings, recommend a label, and (if the user has at least the Export usage right) override IRM encryption that was applied without a label.

Find this surface on the label itself, not on the Auto-labeling policies page. Licensing is an E5 / Information Protection P2-tier entitlement. Microsoft 365 E3 and Business Premium include sensitivity labels and manual labeling; they do not include auto-labeling of files and emails. If the Auto-labeling page is missing entirely, also check that you are in the Microsoft Purview portal (not the retired Compliance Center), that the admin role includes Compliance Administrator or Compliance Data Administrator, and that the tenant’s region supports the Azure dependency auto-labeling requires. Microsoft does not publish a single global “auto-labeling is available everywhere” statement; unsupported regions simply hide the page.

Never configure a parent label (a label that has sublabels) for automatic or recommended labeling. Parent labels cannot be applied to content. To auto-label with sublabels, publish both the parent and the sublabel. The label’s scope must include Files & other data assets to label documents and Emails to label email.

When several sublabels under the same parent match on the client: if the file is unlabeled, the highest-order sublabel configured for automatic labeling wins over a recommended sibling. If the file is already labeled with a sublabel from that same parent, the client takes no action, even if the existing sublabel was a default or was applied automatically.

Service-side auto-labeling policies

An auto-labeling policy runs in the service. It does not depend on which Office app version a user has installed. Microsoft also describes this as labeling data at rest (documents in SharePoint and OneDrive) and data in transit (email sent or received by Exchange Online). It does not label email sitting at rest in mailboxes.

Because the user does not interact with the process, auto-labeling policies do not support recommended labeling. You run the policy in simulation instead. Policies can restrict by location, use sharing conditions and exceptions, use nested rule logic, support PDF files and (with OCR) images, inspect Exchange attachments, label incoming email, optionally replace a lower-priority manually applied label, and remove an existing label in SharePoint or OneDrive.

Create policies in the Microsoft Purview portal under Solutions > Information Protection > Policies > Auto-labeling policies. Choose whether the policy will apply a sensitivity label or remove a label, then pick a template (for example a Financial regulation) or a custom policy, name it, choose the label, assign administrative units, and choose locations: Exchange, SharePoint, and OneDrive. Keeping a location at All is exempt from the 100-location cap. If you use Included or Excluded, each policy can target up to 100 locations (SharePoint sites or OneDrive users or groups). PowerShell can add more locations than the portal’s 100-location picker. If you selected administrative units, SharePoint must stay on All; Exchange and OneDrive Included/Excluded lists show only users from those units.

For Exchange, if you replace All included with specific users, email sent from outside your organization is not labeled because those senders are not in your inclusion list. For testing a subset of users, Microsoft’s guidance is to keep Exchange at All and use advanced rules (recipients) rather than shrinking the location list.

Published limits for SharePoint and OneDrive

Microsoft currently documents these service-side limits. Do not invent tighter or looser numbers on the exam:

• Supported files: PDF documents and Office files for Word (.docx), PowerPoint (.pptx), and Excel (.xlsx). Files that are part of an open session (the file is open) are not auto-labeled. Attachments to list items are not supported.
• Maximum of 100,000 automatically labeled files in the tenant per day.
• Maximum of 100 auto-labeling policies per tenant.
• Up to 100 specific locations per policy unless you keep All.
• Auto-labeling does not change existing Modified, Modified by, or date values, in simulation or when labels are applied.
• When the label applies encryption, the Rights Management issuer and owner is the account that last modified the file.
• Files with no content (zero bytes) may not be labeled.

The Auto-labeling page shows how the tenant is tracking against the 100,000 files-per-day throughput limit. Use that number when you plan a new policy.

Exchange behavior that trips people up

PDF and Office attachments are scanned for your conditions. On a match, the email is labeled, not the attachment. If the label applies encryption and the tenant is enabled for PDF attachments, matching PDFs are encrypted with Message encryption. Unencrypted Word, PowerPoint, and Excel attachments inherit encryption from the email.

If Exchange mail flow rules or DLP policies also apply IRM encryption, and an auto-labeling policy matches: the label is applied. If that label applies encryption, the IRM settings from the mail flow rule or DLP policy are ignored. If the label does not apply encryption, the IRM settings apply in addition to the label. Email that already has IRM encryption with no label is replaced by a matching label that has encryption settings.

Incoming email is labeled when conditions match. For senders outside your organization, the Exchange location must be All included and None excluded. Encryption is always applied when the sender is inside your organization. By default, encryption is not applied for external senders unless you configure additional email settings and specify a Rights Management owner. Content markings that use variables can display names of people outside your organization on incoming mail—review that before you enable markings on a label used for inbound auto-labeling.

Will an existing label be overridden?

An auto-labeling policy that applies a label will not strip a label just to leave content unlabeled. (A policy configured to remove a label can remove the selected label in SharePoint and OneDrive, including a manually applied one, and leave the file unlabeled.)

Default override behavior:

• A manually applied label is not replaced by automatic labeling.
• Automatic labeling does replace a lower-priority label that was applied automatically or as a default, but not a higher-priority label.
• Priority follows the label list: the label at the top is least sensitive (lowest order, for example Public at 0); the label at the bottom is most sensitive (for example Highly Confidential at 4). Highly Confidential can override Public; Public cannot override Highly Confidential.

Auto-labeling policies include a configurable setting on Additional label settings to override a manually applied label that has lower priority. Client-side auto-labeling has no equivalent: it never replaces a manual label. A higher-priority manual label is never replaced by either engine. Client-side labeling also will not remove an existing SharePoint or OneDrive label; only a service-side policy can.

Simulation mode

You cannot automatically label documents and emails, or remove labels, until the policy has run at least one simulation. Simulation evaluates and logs matches without applying or removing labels. It is not a fully silent dry run:

• Simulation still generates activity alerts if an alert policy watches auto-labeling or sensitive-information-type activity. Scope or disable those alerts for the simulation window if you do not want a flood of email.
• After you create a policy, Turn on policy, Edit, and Delete are typically unavailable for about 24 hours while the backend provisions. Wait, then refresh.
• Duplicating a policy creates a new policy in simulation regardless of whether the source was on.
• Simulation supports up to 4,000,000 matched files. Above that, you cannot turn the policy on; you must narrow the policy and rerun simulation. That 4,000,000 cap is for simulation only, not for a policy that is already turned on.
• A simulation is a point-in-time WhatIf. It shows a single policy. When two policies cover the same content (one replaces a label, another applies without that option), the conflict is resolved only when all policies run, so production can differ from any one simulation.
• Auto-labeling applies selected sensitive information types only to content created or modified after those information types were created or modified. To classify older unchanged files, run on-demand classification.
• For Exchange, simulation evaluates email sent and received during the run, so results are not repeatable unless the same messages flow again.
• Files updated after the simulation ran can be missing from results; rerun simulation after those edits.

A completed simulation can take about 12 hours and emails the user configured to receive activity alerts. Review Items to review, refine rules or locations, and rerun. You can start with one site or library and widen scope iteratively. You can optionally turn the policy on automatically if it is not edited for 7 days. When you are ready, select Turn on policy. Policies then run continuously for new and modified files until you delete them.

A removal policy has extra traps. Simulation reports every matching file, but after activation the service re-evaluates files whose state recently changed (new, modified, or explicitly re-crawled). Files that matched in simulation but have not been touched may not be removed until you run on-demand classification. A removal policy cannot override a currently applied label that still enforces encryption—remove or downgrade encryption first. Removing a label that applies encryption also removes the encryption. If another active policy applies a label to the same files, apply wins over remove. After a cross-tenant migration, the source-tenant label in file metadata may not be recognized in the target tenant until you republish the label.

When you remove a label that applies encryption with an auto-labeling policy, the person who creates the policy does not need Export or Full Control—unlike a user manually removing an encrypting label.

Use New-AutoSensitivityLabelPolicy with -Mode TestWithoutNotifications to create a policy already in simulation from Security & Compliance PowerShell, then New-AutoSensitivityLabelRule to attach sensitive information type conditions.