MS PURVIEW downgrading of labels.

Question

MS PURVIEW downgrading of labels.

Mansha Irfan 185

Hi can anyone clarify if a file labelled restricted has been attached, and the email inherits the file label, can a user still downgrade the email label through override and justify?

Pratyush Vashistha 5,135 Reputation points Microsoft External Staff Moderator

2025-07-25T11:29:45.6+00:00
Hello! Mansha Irfan!

Thanks for posting your query on Microsoft QnA!

I can help clarify this behaviour regarding sensitivity labels in Microsoft Purview.

This is a common question around how sensitivity labels spread and user override capabilities.

Yes, the scenario you described is possible and is a key aspect of how Microsoft Purview Information Protection and sensitivity labels are designed to work, providing both protection and necessary flexibility.

Key Considerations:

File Label Inheritance by Email:

Yes, an email can inherit a sensitivity label from an attached file. When a user attaches a file that already has a sensitivity label (e.g., "Restricted") to an email, the email client (like Outlook) will typically prompt the user or automatically apply the highest label present on any of the attachments to the email itself. This ensures that the communication carrying the sensitive file is protected to at least the same level as the file itself.

This is part of the "automatic labelling for emails based on attachments" feature.

User Downgrade Through Override and Justification:

Yes, a user can typically downgrade an inherited email label, provided your organization's sensitivity label policy allows for it.

When a user attempts to change a label to a lower sensitivity (e.g., from "Restricted" to "Confidential" or "General"), this is considered a downgrade.

Justification: Your Purview sensitivity label policy can be configured to require a justification from the user whenever they downgrade a label. This prompts the user to provide a business reason for the less restrictive classification, which is then logged for auditing purposes. This is a critical control for data governance.

How it works: When a user selects a lower label, a pop-up box will appear, asking them to select a reason from a pre-defined list or type in a custom justification.

How to Confirm and Manage This Behaviour in Purview

This behaviour is controlled by your organization's Microsoft Purview sensitivity label policies and the labels themselves.

Label Policy Configuration:

In the Microsoft Purview compliance portal (or Microsoft 365 compliance centre), navigate to Information Protection > Labels or Label Policies.

When configuring a label policy, you can enable options like:

"Require users to provide a justification to lower a classification level": This setting directly controls the override and justification requirement for downgrades.

"Apply a label based on attached content": This specific setting within the policy dictates if the email should inherit the highest label from attachments.

User Experience:

When an email inherits a "Restricted" label, the user will see that label applied. If they then click the Sensitivity button in Outlook and try to select a lower label, the justification prompt will appear if configured.

References to Support the Answer:

Inherit labels from attachments (Preview):

This document explains how emails can automatically inherit labels from attachments.

Link: Learn about sensitivity labels | Microsoft Learn

What sensitivity labels can do (Scroll down to "Require justification to change a label"):

This section within the sensitivity labels overview specifically describes the "Require users to provide a justification to lower a classification level" setting, which enables the downgrade override with justification.

Link: Learn about sensitivity labels | Microsoft Learn

This functionality is designed to give organizations control while still allowing legitimate business flexibility.

To help manage these situations, it’s a good idea to set up Data Loss Prevention (DLP) policies that can identify when sensitive information has been downgraded. For instance, if an email conversation is labelled as "PROTECTED" and a downgrade occurs, your DLP policies can take the necessary actions.

If you're facing issues or have specific scenarios in mind, it might help to clarify with the following questions:

Are you experiencing a specific error when attempting to downgrade a label?

What specific labels are applied to the email and the attached file?

Please "Accept as Answer" or do a Upvote if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.
Mansha Irfan 185 Reputation points

2025-07-25T12:55:41.46+00:00

Thanks for your answer @Pratyush Vashistha . The customer is asking whenever end user is downgrading label it should be approved via proper approval process via line manager. I know that whenever end-user put justification, we can see that in audit logs but somehow, they want line manager to get notified /alerted for downgrading of label. So is there any way that it can be achieved?
Mansha Irfan 185 Reputation points

2025-07-26T08:52:08.9733333+00:00

Hi @@Pratyush Vashistha can you please reshare the link provided here...."You can refer to this similar issue faced by a customer Issue this may help you with your solution".I'm not able to open this.
Pratyush Vashistha 5,135 Reputation points Microsoft External Staff Moderator

2025-07-26T13:41:54.8+00:00

Hi Mansha Irfan!

Here is the link. Apologies for the inconvenience caused.

https://techcommunity.microsoft.com/discussions/azurepurview/approval-for-sensitive-label-change/4374321

Thanks
Mansha Irfan 185 Reputation points

2025-07-27T05:16:45.83+00:00

Thanks @Pratyush Vashistha
Pratyush Vashistha 5,135 Reputation points Microsoft External Staff Moderator

2025-07-27T06:04:59.8866667+00:00

Hello Mansha Irfan!

Glad I was able to help. In the meantime, when you try the suggested approach, could you please "Accept as Answer" so that you can help others in the community looking for remediation for similar issues.

Thanks

Pratyush
Pratyush Vashistha 5,135 Reputation points Microsoft External Staff Moderator

2025-07-28T04:56:44.8033333+00:00

Hello Mansha Irfan!

If the suggested approach helped you in analyzing and solving your issue, could you please "Accept as Answer" so that you can help others in the community looking for remediation for similar issues.

Thanks

Pratyush

Answer accepted by question author

0 additional answers

Your answer

Mansha Irfan 185 Reputation points

2025-07-25T12:55:41.46+00:00

Thanks for your answer @Pratyush Vashistha . The customer is asking whenever end user is downgrading label it should be approved via proper approval process via line manager. I know that whenever end-user put justification, we can see that in audit logs but somehow, they want line manager to get notified /alerted for downgrading of label. So is there any way that it can be achieved?
Mansha Irfan 185 Reputation points

2025-07-26T08:52:08.9733333+00:00

Hi @@Pratyush Vashistha can you please reshare the link provided here...."You can refer to this similar issue faced by a customer Issue this may help you with your solution".I'm not able to open this.
Pratyush Vashistha 5,135 Reputation points Microsoft External Staff Moderator

2025-07-26T13:41:54.8+00:00

Hi Mansha Irfan!

Here is the link. Apologies for the inconvenience caused.

https://techcommunity.microsoft.com/discussions/azurepurview/approval-for-sensitive-label-change/4374321

Thanks
Mansha Irfan 185 Reputation points

2025-07-27T05:16:45.83+00:00

Thanks @Pratyush Vashistha
Pratyush Vashistha 5,135 Reputation points Microsoft External Staff Moderator

2025-07-27T06:04:59.8866667+00:00

Hello Mansha Irfan!

Glad I was able to help. In the meantime, when you try the suggested approach, could you please "Accept as Answer" so that you can help others in the community looking for remediation for similar issues.

Thanks

Pratyush
Pratyush Vashistha 5,135 Reputation points Microsoft External Staff Moderator

2025-07-28T04:56:44.8033333+00:00

Hello Mansha Irfan!

If the suggested approach helped you in analyzing and solving your issue, could you please "Accept as Answer" so that you can help others in the community looking for remediation for similar issues.

Thanks

Pratyush

Answer 1

Hi Mansha Irfan!

Thanks for your prompt response!

Yes, you are correct that the justification for a label downgrade is recorded in the audit logs. However, for a real-time notification or approval workflow involving a line manager, Microsoft Purview has built-in features for both approval workflows and alert notifications related to sensitivity label actions, but they are not always directly available out-of-the-box for all scenarios, primarily through its Information Protection and Data Loss Prevention (DLP) features, often integrated with Power Automate. You can implement approval workflows for sensitive label changes and configure alert notifications for specific events like label downgrades

The primary mechanism for managing downgrades is through the audit logs and requiring justification.

However, there are ways to achieve a notification/alerting mechanism that could trigger an approval process, albeit requiring some integration work. This typically involves leveraging audit logs in conjunction with Microsoft Sentinel, Azure Logic Apps, or Microsoft Power Automate.

You can refer to this similar issue faced by a customer Issue this may help you with your solution.

Please "Accept as Answer" or do a Upvote if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.

Happy to Help!

Pratyush Vashistha 5,135 Reputation points Microsoft External Staff Moderator

2025-07-29T06:29:01.0933333+00:00

Hello Mansha Irfan!

If the suggested approach helped you in analyzing and solving your issue, could you please "Accept as Answer" so that you can help others in the community looking for remediation for similar issues.

Thanks

Pratyush