Share via

Setting a default Purview Information Protection label for a group of 2 users (Purview label policy with default label not working)

Jeff Streelman 0 Reputation points
2025-08-11T21:28:51.76+00:00

The company has 4 valid, published sensitivity labels which work properly. The original label policy settings are below. Note: there is no default label for documents but labeling is mandatory. Default labels work properly for Emails and Meetings.

  • Label is mandatory for: documents
  • Default label for emails is: Internal
  • Default label for meetings is: Internal
  • Users must provide justification to remove a label or lower its classification

Admin units: None

Published to: Exchange email - All accounts

Priority for this Label policy is "1" (original Label policy)

I created and published a second label policy which applies to only 2 people in the organization. This label will default documents to an Internal classification. This does not work.

  • Label is mandatory for: documents, emails
  • Default label for documents is: Internal <- NOTE THIS IS NEW
  • Default label for emails is: Internal
  • Default label for meetings is: Internal
  • Users must provide justification to remove a label or lower its classification

Admin units: None

Published to: Exchange email - 2 accounts <- THESE ARE THE 2 USERS

Priority for this Label policy is "0" (so it appears above the original Label policy)

These 2 users have E5 licenses, but the default label is not working. Yes, the 2 users are in both Label policies -- do they need to be exempted from the "1" label policy (that would be silly)? These policies have been published for over a week.

Expected behavior: I would expect when the user creates a new Office document (Word, Excel, or PowerPoint), that the blank document would have an Internal sensitivity label applied-- however the documents show no sensitivity label (it must be manually selected on first save).

Microsoft Word: Version 2505 (Build 18827.20202 Click-To-Run) Monthly Enterprise Channel

Microsoft Security | Microsoft Purview
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Pratyush Vashistha 975 Reputation points Microsoft External Staff Moderator
    2025-08-12T07:41:26.43+00:00

    Hello Jeff Streelman! Thank you for posting your query on Microsoft QnA! and providing the detailed scenario and configuration.

    Here’s an explanation of the behavior you’re seeing and key steps to address it, backed by Microsoft documentation:

    Microsoft Purview label policy behavior when users are included in multiple policies is based on policy priority (order number). The policy with the highest priority (highest order number, listed lowest in the UI) determines which settings take effect if there’s a conflict, including the default label for documents.

    For Reference: Similar Issue 1 and Issue 2

    Learn Documentation: https://learn.microsoft.com/en-us/purview/sensitivity-labels

    In your case:

    • Original policy (Order 1): Applied to all users, requires label for documents, no default document label, default label “Internal” for emails/meetings.
    • Second policy (Order 0): Applied only to two users, requires label for documents/emails, sets default label “Internal” for documents, emails, meetings.

    Expected behavior: If a user is included in both policies, settings (such as default label) from the policy with the highest order number (“1” in your setup) take precedence, not the lowest (“0”)—even though “0” appears "above" in the admin UI.

    This conclude that For those two users who are in both policies, because label policy “1” has a higher order number and does not assign a default document label, no default label appears on new documents—even though policy “0” sets one. This is why default document labeling isn’t working as expected.

    Action needed from your side

    1. Adjust Label Policy Order: Ensure the policy intended to win (with the desired default label for those two users) has the higher order number (is lower in the admin UI list). For your two-user policy, set its order to “2” and the all-user policy to “1”, so the two-user policy takes precedence.
    2. Alternative: Exclude Users from Broader Policy: It's usually not necessary to exclude users from policies targeting “all accounts,” but if policy scoping and order still fail to resolve, as a last resort, remove those two users from the general policy and let them be targeted only by the intended policy.
    3. Force Client Sync: Once you change policy priority/order, have the affected users close all Office applications and sign out/sign in. Policy changes can take several hours to propagate, but sign-in/out often speeds this refresh.
    4. Confirm Label Visibility: After updating policies and ensuring Office apps are updated and synced, opening a new document should show the default label as “Internal” for those users.

    References and Documentation:

    Learn about sensitivity labels — Policy priority order (Microsoft Learn)

    Known issues with sensitivity labels in Office (Microsoft Support)

    Let me know if you want help with the exact PowerShell or portal steps to adjust order. Please "Accept as Answer" if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

    User's image

    Thanks and Happy to Help!

    Pratyush

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.