Auto‑Apply Sensitivity Labels to SharePoint Online Items by Content Type

Quick answer

You can automatically apply a Sensitivity label to SharePoint Online documents or list items when their content type matches a specific value (for example, "Contract") by creating an auto‑apply policy in the Microsoft 365 compliance center. The policy runs as a background workflow, evaluates newly uploaded or edited items, and applies the label together with any configured protection (encryption, visual markings, etc.).

How the mechanism works

When a Sensitivity label is published to a SharePoint site, it becomes available for manual application. An auto‑apply policy adds a rule that the compliance service evaluates against each item in the target location. The rule can look at properties such as content type, sensitive information types, or keywords. If the condition is satisfied, the service writes the label identifier to the item’s SensitivityLabelId field and enforces the label’s protection settings.

The evaluation is not real‑time; it occurs in a scheduled background scan. New items are usually labeled within a few minutes, while existing items may take up to 24 hours to be processed.

Worked configuration example

Below is a step‑by‑step example using the Microsoft 365 compliance center UI and a PowerShell snippet for verification. Replace the placeholders with your own values.

1. Create or edit the label
   • Go to Microsoft 365 compliance center → Information protection → Labels.
   • Click Create a label (or edit an existing one).
   • Give it a name, e.g., Contract‑Confidential, and enable Protection (choose encryption or visual markings as needed).
   • Save the label.
2. Publish the label to the target site
   • Still in the compliance center, choose Label policies → Publish labels.
   • Select the label you just created, click Next, then choose the SharePoint site or library where you want auto‑application (e.g., https://contoso.sharepoint.com/sites/projects).
   • Finish the wizard.
3. Create the auto‑apply policy
   • In the compliance center, go to Information protection → Auto‑apply labels → Create auto‑apply policy.
   • Provide a name, e.g., Auto‑apply Contract label.
   • Under Scope, choose SharePoint and select the same site/library you published the label to.
   • Under Conditions, select Content type equals Contract (exact match, case‑sensitive).
   • Under Label to apply, pick the label you created (Contract‑Confidential).
   • Review and create the policy.

After the policy is saved, the compliance service begins evaluating items. You can verify the result using either the UI or PowerShell.

Verification steps

• UI check: Upload a document with the content type set to Contract to the library. Open the item’s properties pane and look under Classification – the label name should appear.
• Compliance center report: Navigate to Information protection → Label analytics and filter by your label; the report shows the number of items labeled by the auto‑apply policy.
• PowerShell check (requires SharePoint PnP PowerShell module and appropriate permissions):

  # Connect to the site
  Connect-PnPOnline -Url "https://contoso.sharepoint.com/sites/projects" -Interactive
  
  # Get a specific item (replace with actual file name)
  $item = Get-PnPListItem -List "Documents" -Query "ContractDoc.docx"
  
  # Retrieve the label field
  $labelValue = $item['SensitivityLabelId']
  Write-Host "Label GUID: $labelValue"
  
  # Optional: resolve GUID to label name via compliance center API (omitted for brevity)
  

  If the policy worked, $labelValue will contain a GUID corresponding to the label you created. Note that the GUID may be blank if the item has not yet been processed; wait a few minutes and retry.

Limits and considerations

• Policy quota: A tenant can have a maximum of 100 auto‑apply policies across all workloads (Exchange, SharePoint, OneDrive).
• Latency: For items already present when the policy is created, evaluation can take up to 24 hours. New items are typically labeled within minutes.
• Size restriction: Auto‑apply does not process items larger than 25 MB unless the label is also configured for client‑side auto‑labeling via the Office client.
• Content‑type matching: The condition is case‑sensitive and must match the exact content type name as it appears in the library’s content type collection.
• Encryption rights: If the label applies encryption, users must have the appropriate Azure Information Protection (AIP) rights; otherwise the label may appear but the content remains unprotected.
• Retroactive effect: Changing a library’s content type after an auto‑apply policy is active does not relabel existing items; you must re‑run the policy or re‑upload the documents.

Common mistakes to avoid

• Forgetting to publish the label to the target SharePoint site – the label will be visible in the compliance center but unavailable for auto‑apply.
• Using a content type name that differs in case or includes extra whitespace (e.g., "contract" vs "Contract").
• Expecting immediate labeling for bulk uploads via PowerShell or SharePoint migration tools; remember the background scan delay.
• Modifying the content type of a library after the policy is live and assuming existing items will be relabeled automatically.
• Overlooking the need for AIP rights when the label includes encryption, leading to a false sense of protection.

Practical tip

After creating an auto‑apply policy, run a quick test with a single document that meets the condition. Verify the label appears in the UI and via PowerShell before rolling out the policy to a larger library or enabling it tenant‑wide. This reduces the risk of missed labeling due to configuration errors.