Why it happens
Two Purview settings apply a label without anyone choosing one. A sensitivity label policy can set a default label for documents, which Office apps apply to unlabelled files when they're created or edited. A SharePoint document library can also have its own default sensitivity label, applied to new and edited files in that library.
A migration touches every file at once. If either default is switched on when the files arrive, or when a sync or script edits them afterwards, everything in scope picks up the same label. A contract, a payroll export and a lunch menu all end up as General.
Check before you change anything: Note which label policies have a default label for documents, and which libraries have a default sensitivity label set. Those two lists usually explain the whole problem.
Why it matters
Most protection in Microsoft 365 keys off the label. When sensitive files carry a low label:
- Data loss prevention rules written for Confidential content don't fire.
- Encryption and access restrictions attached to higher labels never apply.
- Microsoft 365 Copilot respects labels and permissions, so under-labelled files can surface in answers for anyone who can open them.
- Reports show the estate as well classified when it isn't, which undermines audit evidence.
The default label isn't wrong in itself. It's wrong for the files that deserved a higher one, and after a migration you can't tell which those are without looking.
Step 1: Find the files stuck on the default label
Start in Content Explorer in the Microsoft Purview portal. Filter by the default label and you'll see how many items carry it in each SharePoint site and OneDrive account. Export the list: the export gives you file paths, which is what you need to work folder by folder.
Then open Activity Explorer and filter on label activity for the migration dates. A large spike of the same label being applied over a few days is the migration. Labels applied by people one at a time, before or after, are usually deliberate and worth leaving alone.
You're looking for patterns, not individual files: Sites or folders where nearly everything carries the default label are the ones to fix first. A folder of HR records or board papers sitting at General is the clearest sign.
Our free Label Rectifier does this sorting for you. Load your Content Explorer export and it groups the files by site and folder and shows where the default label dominates. It runs in your browser, so the export doesn't leave your machine.
Step 2: Decide the right label for each folder
Relabelling file by file isn't realistic, and it isn't necessary. Files in the same folder usually share a purpose and an owner, so decide labels at folder level:
- List the folders where the default label dominates, largest first.
- For each, ask the owner what the folder holds and agree a label from your taxonomy.
- Mark folders that hold mixed content. Those are better handled by auto-labelling on content, in step 3.
- Record each decision, who made it and when. That's your audit trail for the change.
Agree the rule for existing manual labels up front: The usual choice is to leave any label a person applied deliberately and change only the ones applied by default.
Step 3: Relabel at scale
There are three ways to apply the new labels. Most organisations use more than one.
| Approach | Best for | Watch out for |
|---|---|---|
| Service-side auto-labelling policies | Mixed folders where sensitive information types (bank details, passport numbers, your own classifiers) identify what needs a higher label | Run in simulation first. Check how the policy treats files that already have a label: Microsoft's rules depend on whether that label was applied manually or automatically, and on label priority. |
| Bulk relabel through Microsoft Graph | Folders where you've agreed one label for everything inside | Applying labels through Graph is a metered API, so check Microsoft's current billing and permission requirements before a large run. Test on a copy of one folder first. |
| Owners relabel in SharePoint | Small, sensitive folders where the owner should make the call | Slow at scale. Give owners a short list and a deadline, not the whole estate. |
Label Rectifier turns your folder decisions into a relabel plan and a Microsoft Graph script you can review before running. Whatever route you take, change one site first, check the result in Content Explorer, then roll out in batches.
Step 4: Stop it happening again
- Before the next migration, decide whether library default labels should be on while files are copied in. Often it's better to migrate first, then label.
- Map source locations to labels in advance. A folder called Payroll on the old file share should arrive as Confidential, not inherit a library default.
- Pilot with one department and check Content Explorer before moving everyone.
- Keep the default label for new everyday documents, where it does its job. It's a safety net, not a classification.
- Review Content Explorer monthly for any site where one label suddenly dominates.
Quick checklist
- List label policies with a default label for documents, and libraries with a default sensitivity label
- Export Content Explorer results for the default label
- Confirm the migration dates in Activity Explorer
- Rank folders by how many files carry the default label
- Agree a label per folder with each owner, and record it
- Simulate auto-labelling for mixed folders
- Relabel one site, check it, then go in batches
- Change the migration runbook so it doesn't recur
Need help with a large estate? Our information protection service covers label design, auto-labelling and clean-ups like this one.