Sensitivity Labels Not Available as Default Label in SharePoint Document Libraries

Question

Sensitivity Labels Not Available as Default Label in SharePoint Document Libraries

Ihuaghian Edodo Ogieva 0

I have successfully created and published sensitivity labels in Microsoft Purview for a pilot group. The labels work correctly on individual documents and can be applied to the Microsoft 365 group associated with our SharePoint site and to the site itserlf (as you can see in the image Label Intern applied to site). However, when I go to a document library's settings to configure a default sensitivity label, the dropdown list to select a label doesn't appear. The option to "Show the default label on documents" is not present.

Verified Configuration:

The following settings have been confirmed to be correctly configured:

✅ Sensitivity labels are created and published in the Purview compliance portal.

✅ An active label policy is assigned to the correct Microsoft 365 group.

✅ Label scope is configured for "Files & other data assets, Emails, Sites, UnifiedGroup".

✅ The EnableAIPIntegration=True setting is enabled at the tenant level.
✅ The EnableLabelsMIP=True setting is enabled at the tenant level.
✅ The DisableDocumentLibraryDefaultLabel=False setting is enabled at the tenant level.
✅ Information Rights Management (IRM) is disabled on the all Sites.
✅ The user configuring the library has tenant administrator permissions.
✅ A sensitivity label has been applied to the associated Microsoft 365 group.
✅ A sensitivity label has been applied to the associated SharePoint Site.

Observed Behavior:

❌ The dropdown to select a "Default Label" in Document Library Settings doesn't appear at all.

❌ The "Show default label" option does not display any available labels.

✅ Labels can be manually applied to individual documents within the library.

✅ Sensitivity settings are working at the site/group level.

Potential Root Cause & Question for the Community:

From my research, I found information suggesting that configuring a default sensitivity label for a SharePoint Online library require minimum a Microsoft 365 E3 license . The official Microsoft documentation on licensing for this specific feature is not entirely clear.

Has anyone else experienced this specific behavior? Can anyone confirm if an E5 license is a strict requirement for the "Default Label" feature in SharePoint libraries, or is there another configuration step I might have missed?
This is the document i find: Files in SharePoint to be automatically labeled with a default sensitivity label https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-default-label

Tags: #Purview #SharePoint #SensitivityLabels #DefaultLabel #MIP #Troubleshooting

0 comments

1 answer

Your answer

Answer 1

Smaran Thoomu 35,375 Moderator

Hi Ihuaghian Edodo Ogieva
Thank you for sharing the detailed configuration and verification steps - that’s very helpful.

Based on your description, the reason you’re not seeing the “Default sensitivity label” option under Document Library Settings is likely due to licensing requirements and feature availability.

Currently, the ability to configure a default sensitivity label for SharePoint document libraries is available only to users who have one of the following licenses:

Microsoft 365 E5,
Microsoft 365 E5 Compliance, or
Microsoft 365 E5 Information Protection and Governance add-on (for tenants with E3 base).

If your users are on E3-only plans without the E5 Information Protection add-on, the “Default label” dropdown will not appear in the library settings - even if all tenant and site-level configurations are correct.

You can find this clarified under Microsoft’s documentation here: Files in SharePoint to be automatically labeled with a default sensitivity label

To resolve:

Confirm the user (or pilot group) has E5 compliance or Information Protection & Governance add-on assigned.
After applying the correct license, sign out and back in to refresh permissions.
Reopen the Library Settings → Information management policy settings, and the Default Label dropdown should appear.

Even without the default library label, users can still manually apply labels to individual documents - as you confirmed. The default label feature simply automates labeling at upload time and requires the higher-tier license.

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Ihuaghian Edodo Ogieva 0 Reputation points

2025-10-10T10:17:34.6366667+00:00
Hi @Smaran Thoomu
I'm a bit surprised that I need an E5 licence to do this.
Because I was able to set “Default sensitivity label” option under Document Library Settings in another tenant with a E3 licence.
My Microsoft 365 E3 licence has this features:- Avatars for Teams

Avatars for Teams (additional)

Azure Information Protection Premium P1

Azure Rights Management

Common Data Service

Common Data Service for Teams

DO NOT USE - Microsoft MyAnalytics (Full)

Exchange Online (Plan 2)

Graph Connectors Search with Index

Immersive spaces for Teams

Information Protection and Governance Analytics – Standard

Information Protection for Office 365 - Standard

Insights by MyAnalytics

Insights by MyAnalytics Backend

Microsoft 365 Lighthouse (Plan 1)

Microsoft 365 Lighthouse (Plan 2)

Microsoft Azure Multi-Factor Authentication

Microsoft Bookings

Microsoft Clipchamp

Microsoft Defender for Cloud Apps Discovery

Microsoft Defender for Endpoint Plan 1

Microsoft Entra ID P1

Microsoft Forms (Plan E3)

Microsoft Intune Plan 1

Microsoft Kaizala Pro

Microsoft Loop

Microsoft Planner

Microsoft Search

Microsoft StaffHub

Microsoft Stream for Office 365 E3

Microsoft Teams

Mobile Device Management for Office 365

Nucleus

Office for the Web

People Skills - Foundation

Power Apps for Office 365

Power Automate for Office 365

Power Virtual Agents for Office 365

Project for Office (Plan E3)

RETIRED - Commercial data protection for Microsoft Copilot

RETIRED - Places Core

SharePoint (Plan 2)

Skype for Business Online (Plan 2)

Sway

The latest desktop version of Office

To-Do (Plan 2)

Universal Print

Viva Engage Core

Viva Learning Seeded

Whiteboard (Plan 2)

Windows 10/11 Enterprise (Original)

Windows Autopatch

Windows Update for Business Deployment Service

Yammer Enterprise

Meanwhile the other tenant where I'm trying to set Default Sensitivity Label without success, I'm using a Microsoft 365 E3 EEA (no Teams) has same charatheristics relating to Information Protection Featuras...expect for few features as you can see in the image attached.

Considering the current situation I have few key questions:

I guess Default Label Setting in SPO Library is an automatization features only available with top tier license such as E5, but why I'm able to use it with my E3 licence and not with my Microsoft E3 EEA (No Teams)?

Also, giving the situation what add-on do I need to be able to enable this feature in my Microsoft E3 EEA (No teams) license?

If I get a E5 licence, do I just need one E5 license for the Purview Compliance Administrator, who will create and assign the default label setting in the Test SharePoint Site or apart from the Compliance Administrator every other member of that Test SharePoint Site needs to have E5 licence as well to benefits from this feature of autolabeling in SharePoint Libraries.?

Thanks in advance for your help
Smaran Thoomu 35,375 Reputation points Moderator

2025-10-13T16:03:53.9066667+00:00
Hi Ihuaghian Edodo Ogieva
Thank you for sharing these additional details and for explaining the differences between your tenants - that’s a very good observation.

Let me help clarify the situation:

The ability to configure a default sensitivity label in SharePoint Online document libraries depends on two things -

Feature availability (which is gradually rolled out and tied to certain service plans), and

Licensing eligibility (based on the assigned Microsoft Information Protection SKU).

Why it worked in your other E3 tenant

It’s possible that your other tenant includes or previously had access to the Information Protection and Governance – Premium (P2) capabilities through a legacy or bundled plan. Some Microsoft 365 E3 tenants (especially older or EDU/enterprise agreements) may have inherited partial MIP functionality even without a full E5 add-on — which explains why the “Default Label” dropdown appeared there.

In contrast, the Microsoft 365 E3 EEA (No Teams) SKU is a special European Economic Area variant with slightly different service mappings. In this variant, the advanced auto-labeling and default library labeling features are not included by default.

Licensing requirement to enable this feature

To enable the Default Sensitivity Label option consistently across document libraries, one of the following licenses is required in the tenant:

Microsoft 365 E5

Microsoft 365 E5 Compliance

Microsoft 365 E5 Information Protection and Governance add-on (for tenants with E3 base license)

These include the Microsoft Information Protection Premium (P2) capability that enables automatic and default labeling features in SharePoint and OneDrive.

How many users need the E5 license

You do not need to assign an E5 license to every user in the site. Only the user(s) configuring the default label (e.g., Compliance Administrator or SharePoint Admin) and the service context applying the policy need to hold the required E5 or add-on license. Other site users can still upload and benefit from the automatically applied label even if they’re on E3.

That said, for production rollout or compliance enforcement, Microsoft recommends that any user interacting with labeled content (view/edit/upload) also has appropriate licensing to remain compliant.

To enable this feature in your current Microsoft 365 E3 EEA (No Teams) tenant:

Add the Microsoft 365 E5 Information Protection and Governance add-on, or

Assign a Microsoft 365 E5 license to your Compliance Administrator.

After assigning the license:

Sign out and back in,

Wait up to 24 hours for policy synchronization,

Check the Document Library Settings → Default sensitivity label section again.

Hope this clarifies the difference between the two tenants and licensing behavior.

If this answers your query, please click Accept Answer and Yes for “Was this answer helpful.” And if you have further questions or want to validate the feature post license assignment, feel free to reply here - I’ll be happy to follow up.
Marc Aigner 0 Reputation points

2025-11-07T10:23:11.03+00:00
Hi @Smaran Thoomu ,

one more question about licensing. We have a customer with Microsoft 365 Business Premium licenses.

Microsoft has recently released two (three) new add-ons for this purpose:

Microsoft 365 Purview Suite for Business Premium

Microsoft 365 Defender Suite for Business Premium

Microsoft 365 Purview & Defender Suite für Business Premium

We have now added the Purview Suite for the customer, but we still do not see the option to configure the default label.

Do we actually need the E5 add-ons mentioned?

Kind regards

Marc
Smaran Thoomu 35,375 Reputation points Moderator

2025-11-07T10:29:05.74+00:00

Marc Aigner | Digital Workplace 360 GmbH That’s a great question - and you’re right to check the new Purview Suite for Business Premium add-on.

Currently, even though the Purview Suite for Business Premium adds several Microsoft Information Protection (MIP) and Data Lifecycle features, it does not include the “Information Protection Premium (P2)” capability that enables default labeling for SharePoint document libraries.

That feature is still tied to the E5-level Information Protection and Governance license.

So, to enable the Default Sensitivity Label option in SharePoint libraries, your customer would still need either:

Microsoft 365 E5, or

Microsoft 365 E5 Compliance, or

The Microsoft 365 E5 Information Protection and Governance add-on (on top of Business Premium or E3).

The new Purview Suite for Business Premium brings a lot of value - including audit, DLP, and basic sensitivity labeling - but default labeling in SharePoint/OneDrive specifically requires the E5 Information Protection and Governance capability (MIP P2).

Hope that clears it up!
Ihuaghian Edodo Ogieva 0 Reputation points

2025-11-07T10:56:41.2933333+00:00
Hi @Smaran Thoomu ,

It’s me again. I’ve now obtained an E5 license and everything works as expected. I can perform the following actions:

Allow label inheritance from SharePoint libraries (set a default sensitivity label on a library)

Apply and modify sensitivity labels at the site or library level in SharePoint

Apply and modify sensitivity labels on individual documents in SharePoint

Our environment includes a mix of these licenses:

Microsoft 365 Business Basic

Microsoft 365 Business Standard

Microsoft 365 Business Premium

Office 365 E1

Microsoft 365 E5

We’ve noticed that the sensitivity labeling option appears for users included in the sensitivity label policy, regardless of their assigned license (including Business Basic, Business Standard, Business Premium, and Office 365 E1). This seems to be because there is at least one E5 license in the tenant.

I also understand there may be certain E5 capabilities that operate at the tenant level. Could you confirm whether this explains the behavior shown in the attached screenshot?

Since we want to ensure full compliance—and we suspect that one E5 license for a Compliance Administrator may not be sufficient—could you please clarify:

Are there any scenarios where users with licenses lower than E3/E5 can legally use sensitivity labeling features?

Is licensing enforced per user (i.e., each user who uses the functionality must have the appropriate license)? If so, how many licenses—and which types—do you recommend per organization/tenant?

Should every user who applies, modifies, or interacts with sensitivity labels be assigned an E3 or E5 license?

Which specific roles must be licensed (administrators only, end users, or both)?

We’d appreciate your official clarification to ensure our implementation remains compliant with Microsoft licensing terms.

Many thanks,Hi [Name],

It’s me again. I’ve now obtained an E5 license and everything works as expected. I can perform the following actions:

Allow label inheritance from SharePoint libraries (set a default sensitivity label on a library)

Apply and modify sensitivity labels at the site or library level in SharePoint

Apply and modify sensitivity labels on individual documents in SharePoint

Our environment includes a mix of these licenses:

Microsoft 365 Business Basic

Microsoft 365 Business Standard

Microsoft 365 Business Premium

Office 365 E1

Microsoft 365 E5

We’ve noticed that the sensitivity labeling option appears for users included in the sensitivity label policy, regardless of their assigned license (including Business Basic, Business Standard, Business Premium, and Office 365 E1). This seems to be because there is at least one E5 license in the tenant.

I also understand there may be certain E5 capabilities that operate at the tenant level. Could you confirm whether this explains the behavior shown in the attached screenshot?

Since we want to ensure full compliance—and we suspect that one E5 license for a Compliance Administrator may not be sufficient—could you please clarify:

Are there any scenarios where users with licenses lower than E3/E5 can legally use sensitivity labeling features?

Is licensing enforced per user (i.e., each user who uses the functionality must have the appropriate license)? If so, how many licenses—and which types—do you recommend per organization/tenant?

Should every user who applies, modifies, or interacts with sensitivity labels be assigned an E3 or E5 license?

Which specific roles must be licensed (administrators only, end users, or both)?

We’d appreciate your official clarification to ensure our implementation remains compliant with Microsoft licensing terms.

Many thanks,
Marc Aigner 0 Reputation points

2025-11-07T16:58:57.02+00:00

Hi @Smaran Thoomu ,

That's unfortunate to hear. But when I look at Microsoft's current comparison documents for SMB plans, this feature should be included in the Purview Suite:

https://aka.ms/M365BusinessPlans

Kind regards

Marc
Smaran Thoomu 35,375 Reputation points Moderator

2025-11-07T18:37:57.3233333+00:00
Hi Ihuaghian Edodo Ogieva and Marc Aigner

Thank you both for the detailed follow-up and for sharing the screenshots - that really helps clarify the situation.

You are correct that the Microsoft 365 Purview Suite for Business Premium plan now lists “Default sensitivity labels for SharePoint document libraries” as an included feature in Microsoft’s latest documentation (as shown in your screenshot from aka.ms/M365BusinessPlans).

However, here’s the key distinction to be aware of:

While the Purview Suite for Business Premium plan includes Information Protection Premium (P2) capabilities for manual labeling and some automated labeling scenarios,

The default sensitivity label configuration in SharePoint/OneDrive libraries still depends on backend service enablement tied to the Microsoft 365 E5 Information Protection & Governance capability - which has only recently begun rolling out to Purview Suite tenants.

At the moment, some tenants already see the “Default Sensitivity Label” option after adding the Purview Suite add-on, while others do not yet - due to phased feature enablement across regions and license types.

What this means for your scenario

You don’t need to purchase additional E5 licenses if your tenant is licensed with the Purview Suite for Business Premium add-on - the feature will become available once backend rollout completes.

If you need the capability immediately (for production or compliance reasons), assigning an E5 Compliance or E5 Information Protection & Governance add-on to your compliance administrator will ensure full access right away.

Once the rollout reaches your tenant, the same functionality will be available under the Purview Suite add-on as well.

Regarding licensing scope

Licensing is per user, not per tenant. Microsoft recommends that any user who applies, modifies, or interacts with labeled files should have a license that includes the Microsoft Information Protection Premium (P2) capability.

Administrators who configure and publish labeling policies must have this capability.

End users without it can still view and upload labeled files but technically should not be assigning or changing labels.

Hope this clears up the confusion around the differing behaviors between tenants and license plans.
Roger Cooper 0 Reputation points

2026-05-13T01:33:59.11+00:00

Hi @Smaran Thoomu

I'm having the same issue as the original poster **Ihuaghian Edodo Ogieva.

**Now that it's several months later, I still don't have the ability to set a default SharePoint Library labels so it seems unlikely to me that this is a backend service update issue.

I can set a label for a site but it doesn't do anything for the labelling in the libraries.

When I run the following in PowerShell in an attempt to force the default label,
Set-PnPList -Identity "1 Accounts" -DefaultSensitivityLabelForLibrary "Confidential"

It returns,
Set-PnPList: You do not have required licenses to perform this operation. Please read here for licensing related requirements : "https://go.microsoft.com/fwlink/?linkid=2186840"

I have MS365 Business Premium with MS Purview Suite for Microsoft 365 Business Premium. The apps I have for this license are;
Azure Information Protection Premium P2

Customer Lockbox

Customer Lockbox (A)

Data Classification in Microsoft 365

Information Barriers

Information Protection and Governance Analytics - Premium

Information Protection and Governance Analytics – Standard

Information Protection for Office 365 - Premium

Information Protection for Office 365 - Standard

Microsoft 365 Advanced Auditing

Microsoft 365 Audit Platform

Microsoft 365 Communication Compliance

Microsoft Communications DLP

Microsoft Customer Key

Microsoft Defender for Cloud Apps

Microsoft Endpoint DLP

Microsoft Information Governance

Microsoft Insider Risk Management

Microsoft Insider Risk Management - Exchange

Microsoft ML-Based Classification

Microsoft Records Management

Office 365 Advanced eDiscovery

Office 365 Privileged Access Management

Premium Encryption in Office 365

Purview Discovery

I need the default labelling working for just 10 users. Our finance dept wants to transfer around 100K files to SharePoint and wants them labelled as they are copied into the various SharePoint libraries.

Is there anything else I should be trying please? If I was to get an E5 license for myself, can I set the default label for a library and have that work for others with the MS Purview Suite for Microsoft 365 Business Premium license?