Sensitivity labels are missing in Outlook, Outlook on the web, and other Office apps

• Applies to:

  Microsoft Purview

Symptoms

You have configured sensitivity labels in the Microsoft Purview compliance portal to classify and protect user documents and email messages in your organization. When your users try to apply the sensitivity labels in Outlook, Outlook on the web, or other Office apps, the sensitivity labels are missing, or the Sensitivity button is not available. This article provides resolutions that you can try for different clients.

Outlook

This issue occurs for one or more of the following reasons:

• The user account that's signed in to Outlook isn't a Microsoft 365 subscriber.
• The security labels aren't published in the Microsoft Purview compliance portal.
• The Outlook version doesn't support the built-in labeling.
• The label policy distribution process isn't successful.

Resolution

To resolve this issue, use one or more of the following methods:

• Verify that the user account that's signed in to Outlook is a Microsoft 365 subscriber.

• Verify that the sensitivity labels are published in the Microsoft Purview compliance portal.

• Verify that the Outlook version meets the requirements that are listed in Sensitivity label capabilities in Outlook.

• Verify that the label policy distribution is successful. To do this, run the following PowerShell cmdlet:

  Get-labelpolicy -identity "Label_policy_name" | fl 
  

  If you see the following result in the output, this indicates that the distribution is successful.

  DistributionStatus      : Success
  

• Verify that the Outlook client is using built-in labeling. To do this, check the following registry subkey on the client computer:

  HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Security\Labels

  If the registry subkey is present, and the UseOfficeForLabelling value is set to 0, this indicates that Outlook is using the AIP client instead of the built-in support for sensitivity labels. In this case, set the UseOfficeForLabelling value to 1 so that Outlook uses the built-in support for sensitivity labels.

• Reset Office built-in labeling by following these steps:

  1. Exit Outlook and all other Office apps.
  2. Navigate to the %localappdata%\Microsoft\Office\CLP directory. In this directory, the <domain.com>.policy.xml file contains the information about the sensitivity labels that are assigned to the user profile.
  3. Rename the CLP folder. For example, rename it as CLP_old.
  4. Restart Outlook. Then, Outlook will connect or authenticate to the Microsoft Information Protection services and download the labels or policies.

Outlook on the web

This issue occurs if the sensitivity labels are configured incorrectly. You can investigate this issue by using a Fiddler or network trace while you reproduce the issue. Here's an example of a Fiddler response. In the response, check whether the label policies are retrieved from the server.

Resolution

Run the following cmdlets to check the sensitivity label configuration:

• Get-label -identity "Label_name" | fl
  

  In the output, verify that the following properties are configured correctly:

  • ContentType contains File and Email.
  • Disabled is set to False.

• Get-labelpolicy -identity "Label_policy_name" | fl
  

  In the output, verify that the following properties are configured correctly:

  • Workload contains Exchange.

  • Mode is set to Enforce.

  • One of the following properties is set:

    • ExchangeLocation
    • ExchangeLocationException
    • ModernGroupLocation
    • ModernGroupLocationException

    If ExchangeLocation is a distribution list or group, or if ModernGroupLocation is specified, make sure that the affected user is a member of the specified group.

If the sensitivity labels are configured incorrectly, you can reconfigure them by running the Set-Label or Set-LabelPolicy PowerShell cmdlet or by following the steps in create and configure sensitivity labels and their policies.

Other Office apps

This issue occurs for one or more of the following reasons:

• The user account that's signed in to the Office apps isn't a Microsoft 365 subscriber.
• The security labels aren't published in the Microsoft Purview compliance portal.
• There's no valid subscription to the Office edition.
• Office file types aren't supported.
• Office built-in labeling is turned off through Group Policy.
• The licenses aren't assigned to the affected users.

Resolution

To resolve this issue, use one or more of the following methods:

• Verify that the user account that's signed in to the Office apps is a Microsoft 365 subscriber.

• Verify that the sensitivity labels are published in the Microsoft Purview compliance portal.

• Verify that the Office app version meets the requirements that are listed in Sensitivity label capabilities in Word, Excel, and PowerPoint.

• Verify that Office file types are supported for built-in labeling.

• Verify that the Office apps are using built-in labeling by checking the following registry subkeys:

  • HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Security\labels
  • HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Common\Security\Labels

  If these registry subkeys are present, and the UseOfficeForLabelling value is set to 0, this indicates that the Office apps are prevented from using built-in labeling. In this case, set the UseOfficeForLabelling value to 1 to enable the Office apps to use built-in labeling.

• Verify that the appropriate licenses are assigned to the affected users per Microsoft 365 guidance for security & compliance.

• Check whether there are any known issues that affect sensitivity labels in the Office apps.