Sensitivity Label Does Not Apply to a Site: Root Cause and Fix

You set a sensitivity label on a SharePoint site, but the site still shows no label or the wrong label. This problem typically occurs because the label is not published to the correct users or groups, or because a container-level policy is missing. In this article, you will learn why the label fails to apply and how to verify and fix each layer of the configuration.

Why a Sensitivity Label Does Not Apply to a SharePoint Site

Sensitivity labels in SharePoint are enforced through Azure AD Conditional Access and Microsoft 365 Groups. When you assign a label to a site, the label is actually applied to the underlying Microsoft 365 Group. If the label is not published to that group’s owners and members, the site ignores it. Another common cause is that the label is not configured for containers. Labels that only apply to files and emails will not appear in the site’s sensitivity picker.

The Label Policy Must Include the Site’s Users

Each sensitivity label is published through one or more label policies. A policy defines which users and groups can see and use the label. If the policy does not include the site’s owners and members, those users cannot assign the label to the site. Even if a global admin assigns the label directly, the site may revert to no label when the policy is not applied to the site’s members.

The Label Must Be Enabled for Containers

Sensitivity labels have a setting called “Enable this label for containers.” This setting controls whether the label can be applied to Microsoft 365 Groups, Teams, and SharePoint sites. If this checkbox is not selected, the label will not appear in the site’s sensitivity settings. You must enable this option for each label that you want to use on sites.

Steps to Verify and Fix the Sensitivity Label Assignment

Step 1: Check the Label’s Container Setting

1. Open the Microsoft 365 Compliance Center
   Go to https://compliance.microsoft.com and sign in as a Compliance Administrator or Global Administrator.
2. Navigate to Sensitivity Labels
   Select Information protection > Sensitivity labels.
3. Edit the label that should apply to the site
   Click the label name, then click Edit label. In the wizard, go to the Define scope page.
4. Enable container support
   Check the box Groups & sites. Then click Next until you reach the Container settings page. Verify that Enable this label for containers is selected.
5. Save the label
   Click Submit and then Done. Wait up to 24 hours for the change to propagate, or force a sync by running Set-SPOTenant -SyncAadB2BManagementPolicy in SharePoint Online Management Shell.

Step 2: Verify the Label Policy Includes the Site’s Users

1. Go to Label Policies
   In the Compliance Center, select Information protection > Label policies.
2. Open the policy that publishes the label
   Click the policy name. Under Users and groups, check whether the site’s owners and members are included. If the policy uses a dynamic group, confirm that all site members are in that group.
3. Add missing users or groups
   Click Edit policy and go to Assign users and groups. Add the missing users or groups. Click Next and then Submit.

Step 3: Apply the Label to the Site

1. Open the SharePoint admin center
   Go to https://admin.microsoft.com/SharePoint.
2. Select the site
   Under Sites > Active sites, click the site name.
3. Assign the sensitivity label
   In the Policies tab, find the Sensitivity section. Click Edit. Choose the correct label from the dropdown list. Click Save.
4. Confirm the label is applied
   Return to the site’s Policies tab. The Sensitivity field should now show the label name. If it still shows “None,” repeat Step 1 and check the policy propagation.

If the Sensitivity Label Still Does Not Apply

“The label is not available for this site”

This error appears when the label’s container setting is disabled or the policy does not include the site’s users. Follow Step 1 and Step 2 above. Also verify that the site is a group-connected team site. Communication sites and classic sites do not support sensitivity labels.

“The label was applied but the site reverted to None”

This usually means the Microsoft 365 Group expired and was renewed without the label. Check the group’s expiration policy in Azure AD > Groups > Expiration. If the group is set to expire, the label may reset when the group is renewed. Set the expiration period to a longer duration or disable expiration for that group. Then reapply the label in the SharePoint admin center.

“The label appears in the picker but does not enforce restrictions”

The label must have container-level settings configured. In the label’s edit wizard, go to Container settings and verify that privacy, external sharing, and access control options are set. If these fields are left as “None,” the label will not enforce any site-level restrictions.

Sensitivity Label for Container vs Sensitivity Label for Files: Key Differences

Item	Label for Containers	Label for Files
Scope	Groups, Teams, SharePoint sites	Documents, emails, calendar items
Setting location	Groups & sites checkbox in label scope	Files & emails checkbox in label scope
Enforcement	Privacy, guest access, external sharing	Encryption, watermark, headers, footers
User assignment	Site owner or admin via SharePoint admin center	End user via Office apps or auto-labeling
Policy propagation	Uses Azure AD group membership	Uses client-side policy download

Now you can verify each layer of the sensitivity label configuration: the label’s container setting, the policy’s user assignment, and the site’s label assignment. Start by checking the label scope in the Compliance Center, then confirm the policy includes all site members. If the label still fails, inspect the Microsoft 365 Group expiration policy. For a quick check, run Get-SPOSite -Identity | Select SensitivityLabel in SharePoint Online Management Shell to confirm the label value.