How to Configure Microsoft Purview Sensitivity Labels for Copilot in Australia

Updated 19 October 2026: Microsoft has blocked new enablement of Restricted SharePoint Search since 31 July 2026 (full retirement 31 January 2027), so this post now points to Restricted Content Discovery and SharePoint Advanced Management instead.

Sensitivity labels must be configured in Microsoft Purview before you enable Microsoft 365 Copilot — not after. Organisations that activate Copilot without a functioning label taxonomy expose their entire Microsoft 365 estate to AI-assisted over-sharing from day one. This guide walks through the exact configuration steps required for Australian organisations, from label taxonomy design through to Copilot-specific boundary controls.

Why Label Configuration Sequence Matters for Australian Organisations

Under the Australian Privacy Act 1988 and the Notifiable Data Breaches scheme, organisations must take reasonable steps to protect personal information. Allowing an AI assistant to traverse unlabelled documents — including contracts, HR records, and client data — without protective controls in place constitutes a failure of those reasonable steps.

The sequence is non-negotiable:

1. Design label taxonomy
2. Publish labels to users
3. Configure auto-labelling policies
4. Validate coverage in simulation mode
5. Activate auto-labelling
6. Configure Copilot data boundary controls
7. Enable Copilot for users

Skipping steps three through five means Copilot will operate against a corpus of largely unlabelled content, which defeats the purpose of having labels at all.

For a broader strategic view of how labels fit into your overall Copilot data governance posture, the Pillar guide covers the full information protection architecture in detail.

Step 1: Design Your Sensitivity Label Taxonomy

Australian organisations should align their label taxonomy to the Australian Government Protective Security Policy Framework (PSPF) classification scheme where practical, even if you are a private sector organisation. This gives you a defensible structure that maps to government supplier requirements.

Recommended four-tier taxonomy:

Add sub-labels only after base adoption exceeds 80 percent of labelled documents. Common sub-labels for Australian organisations include:

• Confidential / Legal Privilege
• Confidential / Personal Information (for Privacy Act-covered data)
• Confidential / Financial

Avoid creating more than 10 labels total in your initial deployment. Cognitive overload causes users to under-label or misclassify, which creates worse outcomes than a smaller, well-understood taxonomy.

Step 2: Create Sensitivity Labels in the Microsoft Purview Compliance Portal

1. Navigate to Microsoft Purview compliance portal (compliance.microsoft.com)
2. Select Information protection from the left navigation panel
3. Select Labels, then Create a label
4. For each label, configure:
   • Name and display name (use your taxonomy names from Step 1)
   • Description for users — write this in plain Australian English, for example: "Use this label for documents containing personal information as defined under the Privacy Act 1988"
   • Colour — assign a distinct colour per label tier to provide visual cues
5. Under Define the scope, select Items (Files, Emails, Meetings) for all labels
6. Under Choose protection settings for labelled items, configure:
   • Encryption — enable for Confidential and Highly Confidential labels
   • For Highly Confidential: set Assign permissions now, restrict to internal users only, and set content expiry where applicable
   • Content marking — enable headers and footers with the label name for printed documents (required for many Australian government contracts)
7. Review settings and publish

Do not apply auto-labelling at this stage — configure it separately in Step 4.

Step 3: Publish Labels via a Label Policy

1. In Microsoft Purview, select Label policies, then Publish label
2. Select all four base labels
3. Assign the policy to all users initially (you can scope to groups later)
4. Configure Default label settings:
   • Set Internal as the default label for new documents in SharePoint and OneDrive
   • Set Internal as the default label for new emails
5. Require users to justify label downgrade — this creates an audit trail when someone removes or lowers a label
6. Enable mandatory labelling for all new documents — do not allow users to save documents without a label

Mandatory labelling is the single highest-impact configuration change for driving label adoption. Without it, users will routinely skip labelling entirely.

Step 4: Configure Auto-Labelling Policies

Auto-labelling applies labels to existing and new content without user action, using sensitive information types (SITs) and trainable classifiers.

For SharePoint and OneDrive (at-rest content):

1. In Microsoft Purview, select Information protection, then Auto-labelling
2. Select Create auto-labelling policy
3. Choose Custom policy
4. Name the policy (e.g., "Auto-label Personal Information as Confidential")
5. Assign the policy to All SharePoint sites and All OneDrive accounts
6. Under Set up rules, configure conditions:
   • For the Confidential / Personal Information sub-label: detect Australian Tax File Number, Australian Medical Account Number, Australian Passport Number, Australian Driver's Licence Number
   • For the Highly Confidential label: detect combinations of the above plus credit card numbers or bank account details
7. Set Turn on policy to Simulation mode
8. Save and activate the simulation

Run simulation mode for a minimum of 14 days before activating. Review matched items daily to validate accuracy and refine conditions. Expect false positive rates of 5 to 15 percent in the first simulation run — this is normal and expected.

Step 5: Review Simulation Results and Activate

1. In the auto-labelling policy, select View matched items
2. Use Content Explorer to review a sample of matched documents (review at least 50 items per rule)
3. For each false positive category, add exclusion conditions to your rules
4. When false positive rate is under 5 percent, select Turn on policy to activate
5. Monitor Activity Explorer daily for the first two weeks post-activation

Do not rush this step. A mass mis-classification event — where thousands of documents are incorrectly labelled as Highly Confidential — can break business workflows and destroy user trust in the labelling system.

Step 6: Configure Copilot Data Boundary Controls

This is the step that connects your sensitivity labels to Copilot's behaviour.

1. Navigate to the Microsoft 365 admin centre (admin.microsoft.com)
2. Select Copilot from the left navigation (under AI + Copilot if your tenant has the new admin centre layout)
3. Select Settings, then Data security and compliance
4. Under Sensitivity label protection, configure:
   • Respect sensitivity labels in Copilot responses — enable this (it prevents Copilot from including labelled content in responses without disclosing the label)
   • Block Copilot from accessing content above this label — set to Confidential or Highly Confidential based on your risk appetite
5. For SharePoint sites that need protection while you review their permissions, apply Restricted Content Discovery in SharePoint Advanced Management during the initial rollout phase. It keeps a site's content out of organisation-wide search and Copilot responses without changing permissions, and it is a temporary measure (Microsoft Learn — Restricted Content Discovery). Restricted SharePoint Search is retiring, with new enablement blocked since 31 July 2026 and full retirement on 31 January 2027

For most Australian organisations deploying Copilot to non-administrative staff, setting the Copilot access boundary at Confidential (blocking Highly Confidential) is the right starting point. Executives and legal teams may require the threshold to be set higher through group-specific policies.

You can take a free Copilot governance assessment to benchmark your current configuration against Australian regulatory expectations and identify the highest-priority gaps.

Step 7: Validate End-to-End Configuration

Before communicating the deployment to users, validate the full chain:

1. Create a test document and manually apply the Highly Confidential label
2. Upload it to a SharePoint site that Copilot has access to
3. Open Copilot in Microsoft 365 and attempt to ask it to summarise or reference the document
4. Confirm Copilot either declines to access the document or discloses the sensitivity label in its response
5. Repeat with a document labelled Internal to confirm Copilot can access it normally

Document your test results. If you are subject to an ACSC Essential Eight assessment or an ISO 27001 audit, this evidence demonstrates that technical controls are functioning as intended.

Ongoing Governance: What to Monitor Weekly

Once your configuration is live, implement these weekly monitoring activities:

• Content Explorer: review the volume of documents per label — a sudden spike in Highly Confidential-labelled documents may indicate a mis-classification event
• Activity Explorer: review label downgrade events — users downgrading labels to avoid restrictions is a leading indicator of policy friction
• Copilot interaction logs: review in the Microsoft Purview Audit logs, filtering on Copilot activity types, to identify any anomalous data access patterns
• Auto-labelling policy match rate: declining match rates may indicate the policy needs updating to capture new document types

Most Australian organisations should plan for a quarterly review cycle of their label taxonomy and auto-labelling policies to account for changes in business processes, regulatory requirements, and the types of sensitive information the organisation handles.

Common Configuration Mistakes to Avoid

Publishing labels without mandatory labelling enabled: Users will not label documents voluntarily at sufficient rates. Mandatory labelling is not optional if you want meaningful Copilot data boundary controls.

Skipping simulation mode for auto-labelling: A single misconfigured auto-labelling rule can label tens of thousands of documents incorrectly within hours of activation.

Setting encryption on all Confidential label documents without testing access: Encryption breaks external sharing workflows. Test encryption policies thoroughly with your IT helpdesk before activating organisation-wide.

Forgetting to label Teams meeting recordings: Meeting recordings in OneDrive are a common source of unlabelled sensitive content. Add a specific auto-labelling policy for video files in your compliance configuration.

Next Steps

With sensitivity labels configured and Copilot data boundaries in place, the next governance layer to implement is a formal Copilot Data Governance Policy that documents your label taxonomy, access rules, and acceptable use boundaries for end users. The free Copilot Governance Assessment will help you identify which policy components you still need to build and prioritise your implementation roadmap.