In a Microsoft Community Hub post published on 3 November 2026, Harish Sonkusale of Microsoft set out why Purview service-side auto-labeling rollouts in SharePoint and OneDrive fail to get approval. The playbook says the blockers are usually access impact, proof of classification, rollback and tenant size, rather than the labelling technology itself.
The article is aimed at teams moving from simulation to production. It treats auto-labeling as a change-control problem, with security, privacy and compliance, IT operations and data owners all involved before a policy is switched on.
Access impact comes first
Service-side auto-labeling applies sensitivity labels to files at rest. The first approval question is whether a label changes who can open a file. Classification-only labels do not change access, while encrypting labels apply label permissions.
For SharePoint and OneDrive, encrypting auto-labels must use Assign permissions now with no expiry. The last person who modified the file becomes the Rights Management owner. Microsoft recommends using classification-only labels for broad coverage, and reserving encryption for a smaller set of high-risk sites where access has been tested.
This is relevant where libraries already use Information Rights Management. Client-side auto-labeling can replace unlabeled Information Rights Management when the user has the Export right; service-side auto-labeling does this only for email. Approvers need evidence showing before-and-after access by label, including members, guests, web access, desktop access and downloads.
Pre-flight checks decide whether anything happens
A missing prerequisite can leave a policy running without labelling anything, and without an error. The playbook lists the checks that should sit inside change control before simulation or turn-on.
- Auditing turned on.
- Sensitivity labels enabled for SharePoint and OneDrive.
- PDF labelling enabled if PDFs are in scope.
- Auto-labeling available in the tenant's region.
- E5-tier licensing.
- A sublabel or standalone label, not a parent label.
- The label scoped to files.
- For an encrypting label, Assign permissions now and no expiry.
- Data Classification Content Viewer rights for reviewing matches.
- Compliance Administrator, Compliance Data Administrator or Information Protection rights for turn-on.
The role model matters because global admins do not receive Data Classification Content Viewer rights by default. The same control should apply to activation. A scheduled turn-on date can activate a policy even if nobody has reviewed the results.
Simulations need business evidence
Simulation is where data owners and compliance reviewers get their evidence. They need to see the scope, owner-reviewed samples, who can view matches, the audit trail, regional scope, user communications, the named approver and pause criteria.
Simulation can also trigger existing alert policies, so alert scope may need to be adjusted during testing. Auto-labeling does not change Modified or Modified By, which may help reviewers distinguish labelling activity from content changes.
Labels alone do not stop Microsoft 365 Copilot from using content. The playbook states that a data loss prevention policy is needed for that control. That distinction is likely to matter in tenants where labelling work is being tied to Copilot readiness.
Rollback is not the same as removal
Rollback planning is one of the approval gates. A removal policy leaves files unlabeled, and an active apply policy wins over a removal policy. Bulk relabelling through Microsoft Graph is a protected, metered API.
The safer route is to separate policy authors from approvers, avoid unattended turn-on dates and export simulation results before every edit or rerun. Microsoft recommends turning on one policy at a time, reviewing daily for the first two weeks and testing the rollback runbook on a pilot site before production.
Tenant limits shape the rollout
Large tenants need a sizing exercise before approval. Microsoft lists a tenant maximum of 500,000 labelled files a day, shared by all SharePoint and OneDrive policies. It also lists 100 policies, 1,000 explicitly selected sites or 50,000 adaptive-scope sites per policy, and 20 million matches per simulation.
Adaptive scopes refresh daily and can take days to fill. The playbook recommends hand-picking sites where the list is maintained, using adaptive scopes where membership changes, and choosing All only after classification quality has been proven. It also recommends segmenting by business unit or region, checking scope membership before simulation and starting under the 20 million match ceiling.
Go-live still needs measurement
After turn-on, most surprises trace back to classification, policy overlap or file state. A simulation shows one policy at a time, while conflicts are resolved only when all active policies run. An apply policy also takes precedence over a removal policy.
Existing labels are another source of failed expectations. A manually applied lower-priority label is replaced only if the override option is on. A manually applied higher-priority label is not replaced. Automatic or default labels are replaced only by a higher-priority label.
For monitoring, the Insights tab gives a 30-day labelled-versus-failed view. Activity explorer can lag by 60 to 90 minutes and does not name the policy that labelled an email. Coverage by simulation context appears only after turn-on and is available for 30 days.
There are also file limits to plan around. Service-side labelling covers .docx, .xlsx, .pptx and PDF when PDF support is enabled. It does not label open files or list attachments, and it does not add visual markings such as headers, footers or watermarks to documents.
Purview auto-labeling approvals, DLP controls for Copilot exposure and rollback evidence are the questions ECS's Security topic deals with, alongside Security Copilot, Zero Trust, Sentinel, Purview and DevSecOps. Sessions and workshops give practitioners room to compare policy design, tenant limits and operational controls with people who have run comparable work. Bring the tenant scenarios and approval blockers that are difficult to settle from documentation alone.
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.