Copilot-Generated Document Missing a Sensitivity Label: Safe Checks

Official documentation checked October 14, 2026.

A missing sensitivity label on a Copilot-generated document should be checked before you share the file. It is not evidence that Copilot always creates an unprotected temporary container, and there is no documented Copilot setting called “Inherit sensitivity label from conversation” to switch on.

Microsoft supports label inheritance in specified content-generation workflows. First identify the workflow, source label and destination; then apply the approved classification or have the administrator investigate the failed inheritance without removing protection.

Check Whether This Workflow Should Inherit a Label

Microsoft’s Copilot information-protection guidance documents inheritance when Word, PowerPoint and Outlook create new content from labeled sources. Examples include drafting in Word with a referenced file and creating a PowerPoint presentation from a file; the documentation also describes Edit in Pages. When several labeled sources participate, the highest-priority applicable label is used.

This does not mean that every prompt, copied chat response or arbitrary export carries a file label. A label displayed in a chat provides sensitivity context; inspect the actual destination rather than assuming the chat display proves that a new file is protected. A prompt containing only newly typed text may have no labeled source from which to inherit.

Also check the source itself. A sensitivity label on a SharePoint site or team does not automatically label every document inside it. Microsoft lists that distinction in its Copilot protection considerations.

Apply the Approved Label Before Sharing the Document

1. Open the generated file in a supported Office app. Confirm the correct organizational account. Record the file name, saved location and format so you do not accidentally inspect a different draft.
2. Inspect the file’s sensitivity indicator. In supported Windows Office apps, use the sensitivity bar near the file name or Home > Sensitivity. The label is not universally displayed in the bottom status bar. Follow Microsoft’s instructions for your platform.
3. Select the label required by your organization. Use its published classification guidance. Label names and available choices vary; “Internal” or “Confidential” are not universal configurations. If the correct label is unavailable or you lack permission, keep the document restricted and contact the owner or IT.
4. Save and verify. Reopen the saved file and confirm the applied label. Where encryption is required, verify the intended recipients’ access with an approved test, not by sending the real document to an unauthorized account. A watermark or label name alone is not proof of encryption.

Do not remove a source label, decrypt a file, or paste its contents into an unprotected copy to get around a blocked insertion. Preserve the original and use an approved handling route.

Investigate a Failed Inheritance With the Administrator

For a workflow that should inherit, collect a minimal reproduction using non-sensitive test content: app and build, generation command, source and destination label names, source location, and the exact error. Include whether the destination is read-only or already protected.

The Copilot protection considerations identify important limits. If the required inherited label is not published to the user, or the user cannot change protection on the destination, the content should not be inserted. User-defined encryption permissions and encryption applied separately from a label can also prevent supported inheritance. Do not interpret a failed insertion as a reason to downgrade protection.

Inspect file-format support for the actual app and labeling method. Labeling is not limited to .docx, .xlsx and .pptx: supported PDF labeling also exists. Conversely, saving or exporting to a different format is not a guarantee that the source label survives. Test the destination rather than changing extensions or relying on a screenshot of the source.

For Copilot Pages, use the Page’s supported label controls and the Loop/Page labeling requirements. Do not assume all Word labeling and encryption configurations are supported there.

Use Automatic Labeling as a Separate Control, Not a Repair Toggle

Automatic labeling can help protect matching content, but it does not reconstruct every Copilot source relationship or guarantee immediate coverage. Microsoft distinguishes client-side automatic labeling and service-side policies. The latter process supported files saved in selected SharePoint/OneDrive locations; a policy is not a scan of every local draft.

An administrator should verify the actual entitlement, role, labeling prerequisites, supported formats and chosen locations. Define conditions that identify the sensitive information, test them in simulation and review both missed matches and false positives before enabling the policy. A keyword such as “Internal” is not a reliable classification strategy for all generated documents.

For one urgent file, apply and verify the approved label directly if you are authorized. For recurring gaps, correct the publishing, workflow or automatic-labeling configuration and retest. Never share an unlabeled confidential file on the assumption that an asynchronous policy will protect it later.