Table of Contents
New Auto-Label Policy Extends the Usefulness of a Default Sensitivity Labels for Document Libraries
Microsoft added the ability to enable a default sensitivity label for SharePoint Online document libraries in 2022. When a document library has a default sensitivity label, SharePoint Online assigns the sensitivity label to any file added to the library or modified thereafter. Existing files only receive the default sensitivity label after subsequent activity. SharePoint Online applies the label when an unlabeled file is edited or when the file has a lower-priority sensitivity label.
This facility is extremely useful because it removes the need for users to remember to assign an appropriate sensitivity label to files added to the document library. It is a premium feature and requires licensing that includes the necessary Information Protection capabilities, such as Microsoft 365 E5 or equivalent compliance and protection add-ons.
Downside of Default Sensitivity Labels
The downside of assigning a default sensitivity label to document libraries is that some user action with a file is required before SharePoint Online is prompted to apply the default label. If sensitive or confidential files exist in the document library before an administrator configured the library with a default sensitivity label and are never subsequently edited, they won’t receive protection.
In the era of AI-driven tools, this can be an important consideration if you want to block a tool like Microsoft 365 Copilot Chat from using those files when it generates responses to user prompts. Sensitivity labels that apply encryption also block third-party AI tools such as the Microsoft 365 Connector for Claude from being able to process content, so it’s obviously important to extend protection to existing files which might never be modified.
Extending the Reach of a Default Sensitivity Label
Message center notification MC1477181 (22 September 2026) announced the introduction of a special auto-label policy for sensitivity labels to extend the reach of default labels to cover unlabeled existing files. Only one such policy can exist in a tenant, and the policy is limited to processing a maximum of ten SharePoint Online sites. The account used to configure the policy must hold either the Compliance administrator or SharePoint administrator role.
Figure 1 shows how to configure the auto-label policy with the target sites. Each site included in the policy must have at least one document library configured with default sensitivity labels. If you attempt to add a site that doesn’t meet this requirement, Purview signals an error that the default label cannot be verified.
A Purview Information Protection background job scans the configured sites to identify document libraries with default sensitivity labels. If the scan finds files that are missing the library’s default label, SharePoint Online applies the label automatically. Only file formats that support sensitivity labels are processed, which currently means Office files and PDFs.
Administrators can also configure the policy to replace existing labels that have a lower priority than the library’s default label. SharePoint Online can replace labels that were assigned either automatically or manually.
Some files might be inaccessible when background processing occurs and therefore cannot be labeled. These include open files, files protected by labels with double-key encryption or user-defined permissions, or files that are locked or checked-out. However, after several processing passes the net result should be that almost every file in the library should be protected, which is exactly what’s required.
The special auto-label policy for default sensitivity labels is now generally available. More information about the policy is available in the documentation.
A Great Idea Limited by the Number of Target Sites
There’s nothing to dislike about extending the protection afforded by default sensitivity labels. The only obvious drawback is that a tenant can have just one policy covering up to ten sites, which means administrators must choose their targets carefully. The most likely candidates are sites containing highly confidential information that are not already protected against AI-driven disclosure through controls such as Restricted Content Discovery.
Microsoft suggests a workaround where the policy applies labels to files in one set of ten sites before being updated to process another set of ten. Administrators can continue rotating sites through the policy until Purview processes every site that contains document libraries with default sensitivity labels. However, given the speed at which Purview background jobs typically operate, rotating sites through the policy could prove both time-consuming and tedious.