How to Fix Sensitivity Label Does Not Apply to a Site

When you assign a sensitivity label to a SharePoint site in the Microsoft Purview compliance portal, the label may not apply as expected. The site might remain unlabeled, or the label might not enforce the expected settings like external sharing restrictions or access control. This problem often occurs because of conflicting configurations between the label policy and site-level settings, or because the label is not published to the correct users or groups. This article explains why sensitivity labels fail to apply to SharePoint sites and provides step-by-step instructions to resolve the issue.

Why a Sensitivity Label Fails to Apply to a SharePoint Site

Sensitivity labels in Microsoft 365 are designed to protect content by applying classification and encryption settings. When a label is applied to a SharePoint site, it controls external sharing, access from unmanaged devices, and authentication context. The label can be assigned manually by a site owner or automatically through auto-labeling policies.

The label fails to apply for several common reasons:

Label Policy Scope Does Not Include SharePoint Sites

A sensitivity label must be configured to support containers like SharePoint sites. In the label settings, the option “Use this label to protect content in SharePoint sites and Microsoft 365 groups” must be enabled. If this option is off, the label will not appear in the site settings or apply automatically.

Label Not Published to the Correct Users

The label must be published to users who have the right to assign it. If the site owner or site admin is not included in the label policy, they cannot see or apply the label. This is the most frequent cause of the label not applying.

Conflicting Site-Level Sharing Settings

A label that restricts external sharing cannot override a site-level sharing setting that allows more permissive access. For example, if the site allows sharing with anyone, but the label requires authenticated sharing only, the label may fail to apply or may not enforce the restriction.

Licensing or Feature Rollout Gaps

Sensitivity labels for SharePoint sites require a Microsoft 365 E3 or E5 license. Additionally, the feature must be enabled in your tenant. If you recently upgraded your license, the feature may take up to 24 hours to activate.

Steps to Force the Sensitivity Label to Apply

Follow these steps in order. Verify each condition before moving to the next.

Step 1: Confirm the Label Supports SharePoint Sites

1. Open the Microsoft Purview compliance portal
   Go to https://compliance.microsoft.com and sign in as a Compliance Administrator or Global Administrator.
2. Navigate to label settings
   Select Information protection > Labels. Find the label you are trying to apply and click its name.
3. Check the container option
   In the label properties, under Define the scope of this label, ensure Groups and sites is selected. Then under Protection settings for groups and sites, verify that Use this label to protect content in SharePoint sites and Microsoft 365 groups is turned on.
4. Save the changes
   Click Next through the wizard and then Save. If the option was off, enable it and save. Wait 30 minutes for the change to propagate.

Step 2: Publish the Label to the Correct Users

1. Go to label policies
   In the Purview portal, select Information protection > Label policies.
2. Edit the policy containing your label
   Click the policy name that includes your label. If no policy exists, click Create a policy and follow the wizard.
3. Add users or groups
   Under Assign admin units or Publish to users and groups, add the site owners, site admins, and any users who need to assign the label. For site-wide application, include the group that owns the site.
4. Save and publish
   Click Next through the wizard and then Save. Wait 30 minutes for the policy to apply.

Step 3: Manually Assign the Label in SharePoint Admin Center

1. Open SharePoint admin center
   Go to https://admin.microsoft.com/SharePoint and sign in as a SharePoint Administrator.
2. Select the site
   Under Sites > Active sites, click the site where the label should apply.
3. Assign the sensitivity label
   In the site details pane, scroll to Sensitivity label. Click the dropdown and select the correct label. If the label does not appear in the list, return to Step 1 and confirm the label scope.
4. Save the change
   Click Save at the bottom of the pane. The label should now appear on the site.

Step 4: Use PowerShell to Force the Label

If the label still does not apply, use SharePoint Online Management Shell to assign it directly.

1. Install and connect to SharePoint Online PowerShell
   Run these commands in an elevated PowerShell console:
   Install-Module -Name Microsoft.Online.SharePoint.PowerShell
Connect-SPOService -Url https://yourtenant-admin.sharepoint.com
2. Get the label GUID
   Run:
   Get-SPOMicrosoft365GroupSensitivityLabel
   Copy the GUID of the label you want to apply.
3. Apply the label to the site
   Run:
   Set-SPOSite -Identity https://yourtenant.sharepoint.com/sites/yoursite -SensitivityLabel <GUID>
4. Verify the label
   Run:
   Get-SPOSite -Identity https://yourtenant.sharepoint.com/sites/yoursite | Select SensitivityLabel
   The output should show the GUID. If empty, the label did not apply.

If SharePoint Still Has Issues After the Main Fix

Sensitivity Label Does Not Enforce External Sharing Restrictions

If the label applies but external sharing is not restricted, check the site-level sharing settings. Go to SharePoint admin center > Active sites > your site > Policies > External sharing. Set the sharing limit to match or be more restrictive than the label. For example, if the label sets sharing to “Only people in your organization,” set the site sharing to “Only people in your organization” or “New and existing guests.” The label cannot override a more permissive site setting.

Site Owners Cannot See the Label in Site Settings

Site owners see the label option only if they are included in the label policy. Verify the policy includes the site owner’s user account or the Microsoft 365 group that owns the site. Also confirm that the label scope includes “Groups and sites.” If the label still does not appear, wait 24 hours for propagation.

Label Applies but Then Disappears After a Few Hours

This behavior indicates a conflict with an auto-labeling policy or a retention label. Check if another policy is overwriting the sensitivity label. In Purview, go to Information protection > Auto-labeling and review any policies that target the site. Disable or adjust conflicting policies. Also check if a retention label is applied to the site, as retention labels can interfere with sensitivity labels.

Manual Assignment vs Auto-Labeling: Key Differences

Item	Manual Assignment	Auto-Labeling Policy
Trigger	Site owner or admin selects the label	Policy runs on a schedule or at creation
Control	Full user control over label choice	Automatic, no user action needed
Policy requirement	Label must be published to the user	Label must be configured for auto-labeling
Propagation time	Instant after save	Up to 24 hours for full application
Common failure	User not in policy scope	Site not included in auto-labeling scope

Now you can diagnose and fix sensitivity label failures on SharePoint sites. Start by verifying the label scope and publishing policy in the Purview portal. If the label still does not apply, use the SharePoint admin center or PowerShell to assign it directly. For persistent issues, review site-level sharing settings and check for conflicting auto-labeling policies. Use the Set-SPOSite -SensitivityLabel command as the final method to force the label onto the site.