Inconsistent sensitivity label deployment across pilot users — some see labels in Outlook only, others see none at all (4+ days, no propagation)

Question

Hi all,

We've rolled out Microsoft Purview sensitivity labels to a small pilot group and are seeing inconsistent results across users that I'm struggling to pin down. Hoping someone can help narrow the root cause(s).

Environment

• Labels created and published via label publishing policy in the Microsoft Purview portal
• Pilot scoped to a small group of users (~10 users)
• Mailboxes hosted in Exchange Online
• (Please let me know if any other config details would help)

The symptoms — two distinct groups:

Group A: Labels appear in Outlook, but not in the Office desktop/Office 365 apps (Word, Excel, PowerPoint).

Group B: No sensitivity labels appear anywhere — not in Outlook, not in any Office app.

Users are in what I believe to be the same rollout, yet the experience differs noticeably between them.

What I've already checked / am aware of:

• It has now been 4+ days since publishing, so this is well beyond the documented ~24-hour propagation window — I don't think this is a timing/caching issue anymore.
• I understand label scope (Files & data assets vs. Emails) and SharePoint/OneDrive label integration can affect where labels show up.
• I'm aware licensing and policy group membership can affect visibility per user.

Any guidance on a structured way to diagnose this across the pilot group would be much appreciated. Happy to provide additional configuration details on request.

Thanks in advance!

Answer 1

Hi @Lim Chi Siang

Since the issue has persisted for more than four days, it is unlikely to be related to the normal sensitivity label policy propagation timeframe. Based on Microsoft guidance, this behavior can be associated with differences in label policy assignment, label scope configuration, client support, licensing, or labeling configuration between users.

A few areas worth validating:

1. Label policy assignment and policy priority

Sensitivity labels are published to users and groups through label policies. If a user is assigned multiple label policies, the settings from the policy with the highest priority take precedence. Verifying the policy assignments and policy order for both affected and unaffected users can help identify configuration differences.

2. Label scope configuration

Confirm that the affected labels are configured with the appropriate scopes. Labels can be scoped separately for Files & other data assets and Emails. A label scoped only to Emails may appear in Outlook but not in Word, Excel, or PowerPoint, while a label scoped only to Files & other data assets may not appear in Outlook.

3. Office client requirements

Sensitivity labels in Office applications require a supported Microsoft 365 subscription version of Office. For Outlook, the mailbox must be hosted in Exchange Online. Differences in Office versions, update channels, or licensing between pilot users can result in inconsistent label visibility.

4. Built-in labeling configuration

Microsoft recommends using the built-in sensitivity labeling experience in Office applications. Verify that Outlook and Office applications are using built-in labeling and are not configured to use the retired Azure Information Protection (AIP) add-in.

5. Label policy distribution status

Verify that the label policy distribution completed successfully and that the labels are correctly published to the affected users. Microsoft provides PowerShell and administrative tools to validate policy distribution status.

6. Microsoft 365 Sensitivity Labels Diagnostic

Microsoft provides a built-in diagnostic in the Microsoft 365 admin center that can analyze a specific label and user combination, identify common configuration issues, and provide remediation guidance. Running this diagnostic against one user from Group A and one user from Group B may help isolate the difference.

To help narrow this down further, could you confirm the following:

• Are the affected users members of exactly the same label policy assignments?
• Are the labels scoped for both Files & other data assets and Emails?
• What Office version/build is being used by users in Group A versus Group B?
• Does the published label policy show a successful distribution status?

These details should help determine whether the issue is related to policy targeting, label scope, client configuration, licensing, or policy distribution.

References:
https://learn.microsoft.com/en-us/purview/sensitivity-labels-office-apps?view=o365-worldwide
https://learn.microsoft.com/en-us/purview/sensitivity-labels?view=o365-worldwide#what-labels-can-do
https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/purview/sensitivity-labels/sensitivity-labels-missing?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#outlook-on-the-web

Please let us know if you have any questions or concerns.

Answer 2

Have you tried running in the built-in diagnostics in the Purview portal, what do they show? https://purview.microsoft.com/informationprotection/diagnostics

And this one too: https://aka.ms/PillarMipLabelDiag (see https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/purview/sensitivity-labels/sensitivity-labels-missing for details)

Are the users able to see labels in the webmail (OWA) and the Office Web Apps?

Answer 3

Use a per-symptom, per-user checklist that focuses on three areas: subscription/licensing, label publishing scope, and client configuration for built‑in labeling.

1. Baseline checks for all pilot users (Groups A and B)

For every user in the pilot group, verify the following:

1. Microsoft 365 subscription and licenses
   • Confirm the signed‑in account in Office/Outlook is a Microsoft 365 subscriber account.
   • Confirm the appropriate security/compliance licenses are assigned to each affected user per the Microsoft 365 security & compliance licensing guidance.
   • If a user is not a subscriber or lacks the required license, the Sensitivity button and labels will not appear.
   Relevant guidance:
   • Outlook: causes include non‑subscriber account and missing label publishing.
   • Other Office apps: causes include non‑subscriber account, no valid subscription, and missing licenses.
2. Label publishing policy scope and workload coverage
   • In Microsoft Purview, confirm that the sensitivity labels are actually published via a label policy that includes all pilot users.
   • For each label policy, run in Exchange Online PowerShell:

          Get-LabelPolicy -Identity "Label_policy_name" | fl
     

     Check:
     • Workload contains Exchange (for Outlook).
     • Mode is Enforce.
     • One of the following is set and includes the pilot users:
       • ExchangeLocation
       • ExchangeLocationException
       • ModernGroupLocation
       • ModernGroupLocationException
   • If ExchangeLocation or ModernGroupLocation is a group, verify each pilot user is a member of that group.
3. Label configuration for email vs. files
   • For each label that should appear in Outlook and Office apps, run:

          Get-Label -Identity "Label_name" | fl
     

     Confirm:
     • ContentType contains both File and Email (so labels can appear in Word/Excel/PowerPoint and Outlook).
     • Disabled is False.

If any of these checks fail for a user, correct the configuration using Set-Label / Set-LabelPolicy or by updating the label policies in Purview, then allow time for re‑distribution.

2. Focused troubleshooting for Group A

Symptom: Labels appear in Outlook but not in Word/Excel/PowerPoint.

For these users, Outlook is receiving label policy, but Office apps are not applying or showing built‑in labels.

Perform these steps on an affected user’s device:

1. Confirm Office apps meet version requirements
   • Verify the Office app version meets the requirements listed under “Sensitivity label capabilities in Word, Excel, and PowerPoint.”
   • Older or unsupported builds may not show built‑in labels.
2. Check built‑in labeling registry keys for Office apps
   • On the client, check:
     • HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Security\Labels
     • HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Common\Security\Labels
   • If these keys exist and UseOfficeForLabelling is set to 0, Office apps are prevented from using built‑in labeling.
   • Set UseOfficeForLabelling to 1 so Word/Excel/PowerPoint use built‑in sensitivity labels.
3. Validate subscription and file type support
   • Confirm the signed‑in Office account is the licensed Microsoft 365 account.
   • Confirm the file types being tested are supported for built‑in labeling.
4. Check for known issues
   • Review the list of known issues that affect sensitivity labels in Office apps to see if the behavior matches a documented issue.

3. Focused troubleshooting for Group B

Symptom: No labels in Outlook or any Office app.

For these users, treat it as a full distribution/visibility failure.

1. Outlook‑specific checks
   • Confirm the Outlook version supports built‑in labeling as per “Sensitivity label capabilities in Outlook.”
   • Verify label policy distribution:

          Get-LabelPolicy -Identity "Label_policy_name" | fl
     

     • Confirm DistributionStatus : Success.
   • On the client, check:
     • HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Security\Labels
     • If present and UseOfficeForLabelling is 0, Outlook is using the AIP client instead of built‑in labels. Set UseOfficeForLabelling to **1` to switch to built‑in labels.
2. Reset built‑in labeling cache for Outlook
   • Exit Outlook and all other Office apps.
   • Navigate to %localappdata%\Microsoft\Office\CLP.
   • In this folder, locate the *.policy.xml file (contains label policy for the user) and rename the CLP folder (for example, to CLP_old).
   • Restart Outlook so it reconnects to Microsoft Purview Information Protection services and re‑downloads labels and policies.
3. Office apps (Word/Excel/PowerPoint) checks
   • Repeat the Group A Office‑app checks for these users:
     • Confirm Microsoft 365 subscription and license.
     • Confirm label publishing includes these users.
     • Confirm Office version supports sensitivity labels.
     • Confirm UseOfficeForLabelling is 1 in the relevant registry keys.

4. Cross‑user comparison to isolate differences

To systematically diagnose across the pilot group:

1. Pick one working user (labels everywhere) and one user from Group A and Group B.
2. For each of the three users, compare:
   • Assigned licenses.
   • Group memberships used in label policies.
   • Get-Label and Get-LabelPolicy outputs.
   • Outlook and Office versions.
   • Registry values for UseOfficeForLabelling.
3. Any difference found between the working user and an affected user is a likely root cause.

Once configuration is aligned (labels enabled for both File and Email, policies include all pilot users, built‑in labeling enabled in clients, supported versions and licenses in place), sensitivity labels should appear consistently across Outlook and Office apps.

---

References:

• Sensitivity labels are missing in Outlook, Outlook on the web, and other Office apps
• Known issues with sensitivity labels in Office