Publish sensitivity labels to all users

Description

The organization has a sensitivity label taxonomy that matches its classification policy (for example Public, Internal, Confidential, Highly confidential, with sub-labels for encryption where needed). At least one label publishing policy makes these labels available to all users in Office apps, Outlook and the Microsoft 365 web apps, with a link to the internal classification guide.

Rationale

Labels are the foundation for content-aware protection in Microsoft 365: encryption that follows the file, DLP rules, Copilot exclusions and audit of who handles classified data. Without published labels, users cannot mark what is sensitive and most information protection controls stay theoretical.

Impact

Users see a sensitivity button in Office apps. Labels with encryption can block access for external partners or older clients: start with non-encrypting labels and test encryption on a pilot group. Training is needed for consistent labelling.

Audit

1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global Reader.
2. Browse to Solutions > Information Protection > Sensitivity labels and check that labels exist and are active.
3. Browse to Solutions > Information Protection > Publishing policies and check that a policy publishes these labels to All users and groups (or to groups that together cover all users).
4. Alternative in Security & Compliance PowerShell: Get-Label | Format-Table DisplayName,Priority,ContentType,Disabled and Get-LabelPolicy | Format-List Name,Labels,ExchangeLocation,ModernGroupLocation,Enabled,Mode.
5. Fail if no label is published, or if the publishing policies leave users out.

Remediation

1. Agree the label taxonomy with the data owners and the security team.
2. Sign in to the Microsoft Purview portal as at least an Information Protection Admin (or Compliance Administrator).
3. Browse to Solutions > Information Protection > Sensitivity labels > Create a label for each level, with scope Files & other data assets and Emails.
4. Browse to Publishing policies > Publish label, select the labels, target All users and groups, set Provide users with a link to a custom help page, and publish.
5. PowerShell alternative: New-Label and New-LabelPolicy -Labels <labels> -ExchangeLocation All.

Rollback

Remove labels from the publishing policy or delete the policy. Do not delete labels already applied to content.

References

• Learn about sensitivity labels Microsoft, vendor-doc, accessed 2026-10-24
• Create and publish sensitivity labels Microsoft, vendor-doc, accessed 2026-10-24
• Get-LabelPolicy Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Related controls

• related CB-M365-DATA-004 Enforce a DLP policy for Microsoft 365 Copilot
• related CB-M365-DATA-006 Extend sensitivity labels to SharePoint, groups and sites, with default and automatic labelling
• related CB-M365-POWER-015 Enable sensitivity labels for Fabric and Power BI content

People and lifecycle