# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-M365-DATA-005
title: Publish sensitivity labels to all users
finding:
  title: No sensitivity labels are published to users
  description: Users have no way to classify documents and emails, so protection, DLP and Copilot rules based on labels have nothing to work with.
status: active
profiles: [baseline]
risk:
  severity: medium
assessment: manual
tags: [sensitivity-labels, information-protection, purview, classification]

description: |
  The organization has a sensitivity label taxonomy that matches its classification policy (for
  example *Public*, *Internal*, *Confidential*, *Highly confidential*, with sub-labels for
  encryption where needed). At least one label publishing policy makes these labels available to
  all users in Office apps, Outlook and the Microsoft 365 web apps, with a link to the internal
  classification guide.
rationale: |
  Labels are the foundation for content-aware protection in Microsoft 365: encryption that follows
  the file, DLP rules, Copilot exclusions and audit of who handles classified data. Without
  published labels, users cannot mark what is sensitive and most information protection controls
  stay theoretical.
impact: |
  Users see a sensitivity button in Office apps. Labels with encryption can block access for
  external partners or older clients: start with non-encrypting labels and test encryption on a
  pilot group. Training is needed for consistent labelling.

audit:
  manual: |
    1. Sign in to the Microsoft Purview portal (https://purview.microsoft.com) as at least a Global
       Reader.
    2. Browse to **Solutions** > **Information Protection** > **Sensitivity labels** and check that
       labels exist and are active.
    3. Browse to **Solutions** > **Information Protection** > **Publishing policies** and check that
       a policy publishes these labels to **All users and groups** (or to groups that together cover
       all users).
    4. Alternative in Security & Compliance PowerShell: `Get-Label | Format-Table
       DisplayName,Priority,ContentType,Disabled` and `Get-LabelPolicy | Format-List
       Name,Labels,ExchangeLocation,ModernGroupLocation,Enabled,Mode`.
    5. Fail if no label is published, or if the publishing policies leave users out.

remediation:
  manual: |
    1. Agree the label taxonomy with the data owners and the security team.
    2. Sign in to the Microsoft Purview portal as at least an Information Protection Admin (or
       Compliance Administrator).
    3. Browse to **Solutions** > **Information Protection** > **Sensitivity labels** > **Create a
       label** for each level, with scope **Files & other data assets** and **Emails**.
    4. Browse to **Publishing policies** > **Publish label**, select the labels, target **All users
       and groups**, set **Provide users with a link to a custom help page**, and publish.
    5. PowerShell alternative: `New-Label` and `New-LabelPolicy -Labels <labels> -ExchangeLocation All`.
  rollback: |
    Remove labels from the publishing policy or delete the policy. Do not delete labels already
    applied to content.

references:
  - title: Learn about sensitivity labels
    url: https://learn.microsoft.com/purview/sensitivity-labels
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Create and publish sensitivity labels
    url: https://learn.microsoft.com/purview/create-sensitivity-labels
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
  - title: Get-LabelPolicy
    url: https://learn.microsoft.com/powershell/module/exchangepowershell/get-labelpolicy
    publisher: Microsoft
    kind: vendor-doc
    accessed: 2026-10-24
mappings:
  - framework: cis-m365
    framework_version: "7.0.0"
    id: "3.3.1"
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-16
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: MP-3
    relation: related
related_controls:
  - id: CB-M365-DATA-004
    type: related
  - id: CB-M365-DATA-006
    type: related
  - id: CB-M365-POWER-015
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 0.1.0
created: 2026-10-24
updated: 2026-10-24