Microsoft Purview | Information Protection: Apply default SharePoint library sensitivity labels to data at rest

What and why

Microsoft Purview is introducing a new auto-labeling policy that applies a SharePoint document library's default sensitivity label to existing files stored in that library. Previously, default library sensitivity labels were applied only to new or modified files. With this update, organizations can extend labeling to historical content, including files that existed before the default library sensitivity label was configured for the site, without requiring users to open or edit files and without creating content inspection rules.

This capability helps improve labeling coverage, reduce the number of unlabeled files, and support information protection objectives across existing SharePoint content.

Rollout schedule

• General Availability (Worldwide): Beginning in early October 2026 and expected to complete by mid-October 2026

Impact on your organization

Who is affected

• Microsoft Purview administrators who manage sensitivity labels and auto-labeling policies
• Organizations using SharePoint document libraries with default sensitivity labels configured
• Users are affected only if administrators enable and configure this new policy

Platforms and services

• Microsoft Purview Information Protection
• Microsoft Purview Auto-labeling
• SharePoint Online

What will happen

After an administrator creates and enables this policy:

• Auto-labeling will evaluate existing files in selected SharePoint document libraries.
• Files that do not have a sensitivity label applied will receive the library's default sensitivity label.
• Files that existed in a library before the default sensitivity label was configured can now be labeled automatically.
• Files that have a lower-priority sensitivity label applied may be upgraded to the library's default sensitivity label (depending on the policy setting).
• Users are not required to open or edit files for labeling to occur.
• Content inspection conditions, such as sensitive information types or trainable classifiers, are not required for this policy.
• Labeling occurs as a background service process and is not immediate.
• The same default sensitivity label already applied to new or modified files in the library is used for existing files.
• The feature is opt-in and requires administrator configuration.

The following limits apply:

• One policy of this type can be configured per tenant.
• A maximum of 10 SharePoint sites can be included in a policy.
• The user configuring the policy must have either the Compliance Administrator or SharePoint Administrator role so the policy can read the default SharePoint library label.

Action required and recommendations

No action is required unless your organization plans to use this capability.

If you intend to use this feature:

• Review SharePoint document libraries and identify those that have a default sensitivity label configured.
• Verify that the required sensitivity labels have been published to users before configuring the policy.
• Update internal information protection guidance, if applicable.

Learn more

• Automatically apply a sensitivity label to Microsoft 365 data | Microsoft Learn

Compliance considerations