Troubleshooting playbook for Auto labelling in SharePoint and OneDrive

• E5/P2-tier license (Microsoft 365 E5, E5 Compliance, E5 Information Protection & Governance, or AIP P2)

• PDF support enabled if PDFs are in scope (EnableSensitivityLabelforPDF = True)

•  Compliance Administrator or Information protection or Compliance Data Administrator role (Data Classification Content Viewer to preview matches)

• Label published to at least one user, scoped to “Files & other data assets”, and not a parent label

• Auto-labeling available in your region (the page is visible in the Microsoft Purview portal)

• Encrypting labels use “Assign permissions now” and never expire; no S/MIME

• Unified audit log turned on (required for simulation)

• When files are created or edited with SIT, they are classified immediately. However, corner cases to check include Custom SIT created or edited after the file’s last change, and New SIT requiring old files to be checked again; these require on-demand classification. 

• Sensitivity labels enabled for SharePoint/OneDrive files (EnableAIPIntegration = True)

• OneDrive accounts associated with their users (detached accounts aren’t supported)

Auto-labeled files per tenant per day

500,000, shared by all SharePoint/OneDrive policies (was 100,000; rolling out, MC1461154)

Auto-labeling policies per tenant

Up to 100 policies

Explicitly selected locations per policy

1,000 SharePoint sites (was 100)

SharePoint adaptive scope

Up to 50,000 sites (configure with PowerShell)

Simulation size and duration

Up to 20,000,000 matched files (was 4M; MC1469958); ~12 h target

New policy provisioning

~24 h before Turn on / Edit / Delete are available

View coverage report

30 days after the latest simulation completes

Library defaults → existing files

1 policy per tenant, up to 10 sites

Group 1

Setup and access

1. Auto-labeling page missing, or a policy can't be created or saved

No E5/P2-tier license; legacy portal instead of the Microsoft Purview portal; no Compliance Administrator or Compliance Data Administrator role; region not supported (backend Azure dependency).

Fix the license or role; check region availability. Get-Command New-AutoSensitivityLabelPolicy confirms the cmdlet exists. “No matching database is available” on save is transient: retry; open a case only if it persists 24 h.

Group 2

Simulation

2. Simulation stuck “In progress”, no results, or expired

It runs as a backend search job and finishes within 24 hours. 12 hour was the old typical time with 4M limit, however after upgrading to 20M, it may now take upto 24 hours. Editing the policy mid-run can leave the status stuck; a restart from an older PowerShell session can fail before any job is created.

Check TestModeStatus and LastSimulationCompletionDate; restart from a search-only session (Toolkit A), one policy at a time, no portal edits during the run. Results usually start within 24 h; open a case if matches haven't moved 48–72 h after restart.

3. Simulation finishes with zero matches and no error

Missing pre-flight item; scope misses the content; rule too strict (confidence, instance count, AND/OR logic, unpublished classifier); files unchanged since the SIT was created or edited; “Document property is” needs exact managed-property values (no regex; values with “&” may not match).

Walk the checklist; confirm the SIT exists in Content explorer; test with a new sample file in an in-scope site; run on-demand classification for older files, then rerun.

4. Simulation results incomplete or different after turn-on (also alert storms, duplicates stuck in simulation, Items to review not loading)

Simulation is per policy and point-in-time. It considers the file's existing label but no other policies. Files edited after the run are missed, and Matched items is a sample estimate. Duplicates start in simulation, and Items to review shares DLP's test-mode surface.

List all policies on the same locations or labels and rerun after editing. Above 20,000,000 matches, narrow the scope and rerun. Pause alert policies during simulation, set a duplicate's mode explicitly, and retry Items to review a few hours later.

5. Turn on, Edit or Delete greyed out; no content preview

Still provisioning (~24 h after creation); turn-on needs Compliance Administrator or Compliance Data Administrator; more than 20M matches. Preview needs Data Classification Content Viewer, which Global Admins don't have by default.

Wait 24 h and refresh; assign the role (for preview, e.g. the Information Protection Investigators role group); narrow the policy and restimulate.

Group 3

Turn-on and labeling

6. Policy on, but nothing labeled and no failures

Mode isn't Enable yet (still TestWithoutNotifications, or a scheduled turn-on hasn't happened; a displayed date isn't confirmation); distribution incomplete; label unpublished; files open or checked out; content out of scope.

Run Get-AutoSensitivityLabelPolicy … | fl Mode,DistributionStatus and -IncludeProgressFeedback; check the Insights tab and Activity explorer. Allow 24 h; open a case at 48 h if every check passes.

7. Matched files not labeled after turn-on

SharePoint/OneDrive couldn't apply the label, so the file keeps its old label or none or user might have labelled manually.

Overview > Labeling failures card (top 3 reasons, 30 days) > Labeling failures tab > file > Details > Failure reason. Many files, same code? Check service health first, then check the failure-code table. Another way is checking history of the file through activity explorer.

8. PDFs not labeled

PDF support is off, so matching PDFs aren't sent for labeling: skipped silently, with no failure and no error.

Check: Get-SPOTenant | fl EnableSensitivityLabelforPDF. Enable via the “Protect PDFs with Auto-labeling” banner or Set-SPOTenant -EnableSensitivityLabelforPDF $true (per geo in multi-Geo). Signed PDFs unsupported. Still unlabeled when enabled? Open a case.

9. Encrypting label fails, or output looks different

SharePoint/OneDrive policies need “Assign permissions now” with no expiry; S/MIME labels can't be auto applied. By design: no headers, footers or watermarks on documents; the RMS issuer/owner is the last modifier.

Run Get-Label -Identity <label> -IncludeDetailedLabelActions | fl; switch to a compliant label. Also, by design: removing an encrypting label removes the encryption. Set expectations before rollout.

Group 4

Label outcomes

10. Library default label vs. SIT-based auto-labeling — which label wins?

Two mechanisms target the same file, and label priority decides. A library default overrides a lower-priority automatically applied label, but never a manually applied one. An auto-labeling policy replaces a default label only with a higher-priority label.

Compare priorities (Get-Label | ft Name,Guid,Priority) and check how the file's label was applied (Activity explorer). Contact Support only if the higher-priority label doesn't win.

11. Existing label not replaced, or replaced unexpectedly

Manual labels stay unless “Replace manually applied labels with lower priority” is on. Automatic or default labels are replaced only by a higher-priority label. Within one parent, the highest-order sublabel wins.

Check how the label was applied (Activity explorer); compare priorities (Get-Label | ft Name,Guid,Priority); review overlapping policies. Only a remove-label policy leaves files unlabeled.

12. Relabel files from an old label to a new one

The policy UI has no “current label” condition, so use one policy per mapping with the advanced rule “Document property is” InformationProtectionLabelId = <source label GUID>.

The target must outrank the source; also turn on the manual override if the old label was applied manually. Simulate on a small scope first; don't remove the old label first.

13. Too many wrong labels (false positives)

The rule is broader than the data: low confidence or instance count, loose AND/OR logic, or a classifier that doesn't fit.

Pause expansion; sample matches with their detected SITs. Raise confidence and counts, AND multiple SITs, tune a custom SIT, add location or file-type conditions, or split policies; then restimulate.

Group 5

Scale and scope

14. New limits or preview features not showing yet; planning against old limits

Limits rose in Sept–Oct 2026 (500K files/day, 20M simulation, 1,000 sites) and are rolling out tenant by tenant. Editing an active policy without re-simulating is also rolling out.

Previews and limit increases reach tenants in waves, so check the prerequisites and the Message center rollout dates. Track progress with View coverage, a link on the policy that opens a Sankey chart of labeled, pending, failed and not-processed files. It's available for 30 days after the latest simulation completes (LastSimulationCompletionDate) and greys out after that until you rerun simulation.

15. Fewer files labeled per day than expected

500,000/day is a tenant maximum shared by all active SharePoint/OneDrive policies: not per policy, not guaranteed, and 100,000 until the rollout reaches you. Failures cut throughput.

Check the 30-day files-processed chart and -IncludeProgressFeedback; fix dominant failure codes first; collect several days of evidence before opening a case.

16. Site in the adaptive scope, but existing files not labeled

Scope membership doesn't backfill files unchanged since the SIT was created or edited.

Confirm membership and that the scope is attached to the policy. Test a new, a modified and an unchanged file: only unchanged missed → on-demand classification; new or modified missed → open a case.

17. Library default label missing on pre-existing files

Library defaults apply only to new and edited files. Existing files need the auto-labeling option that applies library default labels to existing files (no content inspection).

Confirm the library has a default label and the site is in scope. Limit: one such policy per tenant, up to 10 sites; work in batches. Open, checked-out, locked, unsupported or unsupported-encrypted files are skipped; open a case only if none apply.

18. Some files are never labeled

At rest, only .docx, .pptx, .xlsx and PDF are supported. Open files, list-item attachments and 0-byte files can't be labeled. Exchange labels the email, not the attachments.

By design, no workaround; submit format requests as product feedback.

Retried automatically

FileLocked, FileCheckOut, GetTagsFailure, RmsUnavailable, Conflict, Transient, UnauthorizedAccessException, TransientErrorStorageConnection, GenericException, SqlThrottled, Unknown_SPException

No action; monitor “Spikes of SqlThrottled, TransientErrorStorageConnection or Unknown_SPException” often match a service incident; contact Support if Unknown_SPException repeats for the same files.

Needs your action

EncryptedFileNotSupported (remove password or non-Microsoft encryption) · DisabledOrUnsupportedLabel (publish or activate the label) · InvalidFileName (rename or shorten) · CancelledByEventHandler (review custom SharePoint event receivers) · QuotaExceeded (free space or raise the quota, then rerun) · UnsupportedFileType (enable PDF labeling; with PDF support off, PDFs may not appear here at all)

Fix is let the policy retry. Until then, the file keeps its previous label or stays unlabeled.

By design

CannotOverrideCurrentLabel (equal or higher-priority label already present) FileNotSupported / FileExtensionNotSupported · ZeroByteFile · DirectoryNotFound / FileNotFound (deleted or moved after classification)

Nothing to fix.

A · Restart a stuck simulation (ExchangeOnlineManagement 3.9.0+)

Update-Module ExchangeOnlineManagement

Connect-IPPSSession -EnableSearchOnlySession

Get-AutoSensitivityLabelPolicy -Identity "<policy>" -IncludeTestModeResults $true | Format-List

Set-AutoSensitivityLabelPolicy -Identity "<policy>" -StartSimulation $true

B · Distribution and progress

Get-AutoSensitivityLabelPolicy -Identity "<policy>" -DistributionDetail | Format-List Mode,DistributionStatus,DistributionResults

Set-AutoSensitivityLabelPolicy -Identity "<policy>" -RetryDistribution   # only if distribution failed; one policy at a time

Get-AutoSensitivityLabelPolicy -Identity "<policy>" -IncludeProgressFeedback   # to label / labeled in last 7 days / total

C · Labels and tenant settings

Get-Label | Format-Table Name,Guid,Priority

Get-Label -Identity "<label>" -IncludeDetailedLabelActions | Format-List

Get-SPOTenant | Format-List EnableAIPIntegration,EnableSensitivityLabelforPDF # SharePoint Online Management Shell

Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled         # Exchange Online PowerShell

• Tenant ID

• Labeled, pending and failed counts for the same window

•  Policy name and GUID (shown in the portal URL), mode, and the UTC time it was turned on or last edited

• Failure codes with 3–5 example file URLs

• Label GUID, priority and encryption settings

• Output of the toolkit cmdlets

• Rule logic (SITs/classifiers, confidence, counts) and scope (sites or adaptive scope)

• Service health check result

• Latest simulation match count and LastSimulationCompletionDate

• Expected vs. observed behavior and business impact