Sensitivity labels let you classify and protect documents, emails and meetings so that the right handling travels with the content. Creating a label is only half the job: users won’t see it until you publish it. This guide follows Microsoft’s procedure for creating a label in the Microsoft Purview portal, organizing sublabels, and publishing everything with a label policy.
Before you start
- Permissions: make sure your account has the permissions required to create and manage sensitivity labels. Microsoft documents these in a dedicated article.
- Licensing: check the Microsoft Purview service description for the licensing your tenant needs.
- Label scheme: if you have no labels yet, your tenant was created on or after October 1, 2025, or you migrated manually, follow the Modern label scheme instructions. A green message bar on the Sensitivity labels page confirms the migration.
- Plan your names: a label’s name must be unique in the tenant, but its display name doesn’t have to be. If you script labels later, use the label GUID to avoid ambiguity.
Step 1: Open sensitivity labels
In the Microsoft Purview portal, go to Solutions > Information Protection > Sensitivity labels, then select + Create a label.
Step 2: Define the scope
On Define the scope for this label, choose where the label applies:
- Files and other data assets
- Emails
- Meetings, which requires both files and emails to be selected as well
Heads-up: if you select no scopes, the label won’t be available to users in apps.
Step 3: Configure the label’s settings
Work through the remaining prompts. These include protection settings such as encryption and content marking, which Microsoft covers in its overview of what sensitivity labels can do. Start simple: a small set of clearly named labels is easier for users to apply correctly than a long list.
Step 4: Add sublabels and set the order
- Sublabel: select the parent label, choose … under Actions, then Create sublabel.
- Order: use … under Actions and choose Move up or Move down. Label priority matters, so keep the order consistent from least to most sensitive.
In the classic label scheme, remember to select the parent label whenever you select a sublabel.
Step 5: Publish the labels with a policy
- Go to Solutions > Information Protection > Publishing policies and select Publish label.
- Select Choose sensitivity labels to publish, pick your labels, and select Add.
- Assign admin units if your organization uses them. Otherwise keep Full directory.
- Complete the prompts. The settings you see depend on the scopes of the labels you selected.
- If several policies could apply to the same user, reorder them.
Finishing the Create policy flow publishes the policy automatically, and edits to a published policy also take effect automatically.
Common mistakes to avoid
- Forgetting to publish. A label isn’t available in apps or services until it is part of a published policy.
- Too many policies. Use as few as possible, often just one. When editing a label, don’t select the publish option unless you actually need a new policy.
- Expecting instant results. Allow up to 24 hours for label and policy changes to propagate.
- Deleting too eagerly. Removing a label from a policy is less risky and reversible. You can’t delete a label that is still in a policy, and deleting an encryption label archives its protection template, so you can’t reuse that name. Deleted labels may still appear as GUIDs in content and in activity explorer.
What comes next
This procedure doesn’t configure automatic labeling. Once your manual labels are working, Microsoft’s guidance on automatically applying a sensitivity label to Microsoft 365 data is the natural next step.
