Label Rectifier
After a migration, most files often land on the default sensitivity label, usually in the wrong site. Label Rectifier finds them in your Purview Content Explorer export, suggests the right label for each folder, and writes the relabel plan and script. Free, and it runs entirely in your browser.
PrivateYour CSV is read in this browser and never uploaded. The tool opens with sample data for a fictional company, Contoso.
Export the Content Explorer report
Run this in Security & Compliance PowerShell. The account needs the Content Explorer List Viewer role, and Content Explorer Content Viewer to see file names. Export one label per run; the cmdlet pages results up to 10,000 rows at a time.
Export script
Exporting your other labels too, such as Confidential and Highly Confidential, gives a full before and after picture. The analysis only needs the default-label export.
Load the export
Showing sample data for Contoso. Load your CSV to replace it.
Get-Label | ft DisplayName,Guid,Priority. A higher priority is more sensitive.folder: and site: match text in the URL; sit: matches a sensitive info type. The highest-priority match wins.Folders on the default label
Pick a target label per folder. Sensitive info rules can still raise single files.| Site › library › folder | Files | Share | With sensitive info | Target label |
|---|
File-level plan
| File | Now | Target | Reason |
|---|
Reclassify the files
assignSensitivityLabel for each file. It's a metered API, so the app registration must be linked to an Azure subscription, with Files.ReadWrite.All or Sites.ReadWrite.All. Raising a label needs no justification; lowering one does.Relabel plan CSV
Only files whose label changes are included.
Relabel script (Graph PowerShell)
Run it with -WhatIf on a pilot folder first, then check the result in Content Explorer and Activity Explorer before the full run.
Before you run it on a real tenant
Check the column names
Content Explorer exports vary between versions. The tool detects the URL, label and sensitive info type columns, and you can remap them if it guesses wrong.
Use your real label GUIDs
Replace the sample labels with the output of Get-Label, so the plan carries the right label IDs.
Budget for the metered API
assignSensitivityLabel is billed per call through Azure. Link the app registration to a subscription before the run, or every call fails with HTTP 402.
Pilot, then widen
Run with -WhatIf, then on one folder, and confirm in Content Explorer before relabelling the rest. The script logs every file it touches.
How to fix default labels after a migration
New to this? Our guide Files stuck on the default sensitivity label after migration explains why it happens, how to find the affected folders in Content Explorer, and the three ways to relabel at scale.
Not sure where to start?
Book a 30-minute call and tell us what worries you about Microsoft 365: oversharing, an audit, or a Copilot rollout. Or email us and we'll reply within one working day.