Microsoft Purview: Troubleshooting Auto-Labeling Policy for Azure SQL Data Assets

Question

Hi Team,
I have configured an auto-labeling policy in Microsoft Purview with the sensitive label scope set to "Files & other data assets," targeting specific Azure SQL databases. Despite these settings, the policy isn't applying labels as expected. Here's what I've implemented so far:

1. Sensitivity Label Configuration:
   • Updated the sensitivity label to include "Files & other data assets" in its scope.
2. Auto-Labeling Policy Setup:
   • Created an auto-labeling policy explicitly targeting selected Azure SQL databases.
3. Protection Policies:
   • Established protection policies to control access to items with applied sensitivity labels on Azure SQL.
4. Custom Classification Rule:
   • Developed a custom classification rule and associated it with a scan on the registered Azure SQL databases.

Troubleshooting Steps Taken:

• Verified that the sensitivity label is published and includes the "Files & other data assets" scope.
• Ensured that the protection policies are properly configured to enforce access controls.
• Checked that the custom classification rule is correctly associated with the scan and is detecting the intended sensitive information types.

Observations:

• The auto-labeling policy isn't applying labels to the Azure SQL data assets as anticipated.

References:

• https://learn.microsoft.com/en-us/purview/data-map-sensitivity-labels
• https://learn.microsoft.com/en-us/purview/data-map-sensitivity-labels-apply

Any insights or suggestions would be greatly appreciated.

Answer 1

Hello Rahul Thatikonda,

Thank you for providing this detailed follow-up! This is helpful, and you have absolutely pinpointed the exact source of the problem with this observation:

Currently, Purview's auto-labeling policies can only use sensitive information types (SITs)—including both built-in and custom SITs—as conditions for auto-labeling. Custom classification rules (like those created in the Purview governance portal using regex, keywords, or ML) are not selectable in the auto-labeling policy configuration, which is a functional limitation.

Validated documentation and discussion:

1. Microsoft’s docs on auto-labeling describe adding conditions for policies, and reference only “sensitive information types” as available selectors. There is no mention of custom classification rules (those built and applied via data scans in Purview) for policy conditions. See: https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically
2. On multiple Microsoft Q&A discussions, users confirm that while custom sensitive info types (SITs you define and publish through Microsoft 365 Compliance Center) do appear in auto-labeling conditions, Purview custom classification rules themselves do not. Example: https://techcommunity.microsoft.com/discussions/azurepurview/unable-to-have-labels-applied-based-on…

What I have understood from my research that to apply a sensitivity label automatically, you must specify the condition using sensitive info types as the criteria for your policy. Built-in and custom SITs can both be used. Other classification mechanisms, such as Purview custom classification rules, are not supported in auto-labeling conditions.

References:

• Microsoft Learn: How automatic labeling works (https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically)
• Microsoft Q&A on data classification and auto-labeling (https://learn.microsoft.com/en-ie/answers/questions/2259378/purview-service-side-auto-labeling-for-…)

If you need official roadmap confirmation or updated documentation, I recommend submitting feedback directly in Microsoft Docs or posting to the Microsoft Tech Community forum (https://feedback.azure.com/d365community), as this is a widely acknowledged architectural limitation. If you have more details about the type of classification or need alternate approaches, please let me know for further suggestions.

Meanwhile I will also work with product team to get the confirmation and resolution. Will let you know on the same thread.

Thanks again for engaging on Microsoft QnA! Portal.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Happy to help!

Pratyush