Sensitivity Labels in Word and Excel: Set Up, Apply, and Enforce

Word, Excel, PowerPoint and Outlook in Microsoft 365 Apps carry sensitivity labeling as a built-in feature. The Azure Information Protection add-in that older guides describe was retired on April 11, 2024, and Microsoft disabled it in Office between May and December 2024, so a tenant still relying on it has users with no labels at all.

What the user sees depends on three things:

• A label exists in Microsoft Purview and is published to that user through a label policy. No policy, no Sensitivity button.
• The user is signed in with a work or school account; a personal Microsoft account shows nothing.
• The app build supports the feature in use. Manual labeling has been available for years; some policy settings need a newer build (details below).

Licensing follows one split. Manual labeling, where a person picks the label, is covered by Microsoft 365 Business Premium ($22.00 per user per month on an annual term, Microsoft list price, October 2026 price list), Microsoft 365 E3 ($39.00) and Microsoft 365 E5 ($60.00). Automatic labeling, where Purview applies or recommends a label because the content matches a pattern, needs Microsoft 365 E5 or the Microsoft 365 E5 Information Protection and Governance add-on ($7.00).

A sensitivity label is a piece of metadata stored in the file. On its own it classifies. Each label can also carry settings that act on the file:

Markings are cheap and visible. Encryption is the setting that breaks workflows when it is wrong, usually a vendor who cannot open a quote; encrypt only the labels whose files must not leave a named group, and keep that group small.

Labels sit in an ordered list in Purview, and a label further down the list counts as more sensitive; that order decides what a downgrade is, which is what the justification prompt keys on. The same taxonomy feeds the data loss prevention policies in Purview DLP for a 50-user firm.

Most label projects fail at the taxonomy, not the technology. Rules that hold up:

1. Four labels, named for the business: Public, General, Confidential, Highly Confidential. Six or more and users stop reading the menu.
2. Give each label one sentence a receptionist would understand.
3. Decide the settings per label: Public and General carry nothing; Confidential adds a footer marking; Highly Confidential adds a watermark and, if needed, encryption limited to a named group such as Finance or Leadership.
4. Use sublabels only when a parent needs two behaviors (Confidential for all employees versus Confidential for leadership only); they appear as a submenu in Word and Excel.
5. Write down who owns the taxonomy; labels are hard to retire once documents carry them.

The default label is the one decision users never make, so choose it deliberately. General is the usual choice: it marks everything as internal without encrypting anything.

The work happens in the Microsoft Purview portal, not in the Microsoft 365 admin center.

1. Sign in with a Compliance Administrator or Information Protection Admin role. Go to Solutions, then Information Protection, then Sensitivity labels.
2. Select Create a label. Enter the name, the display name and the one-sentence description for users.
3. Choose the scope: Files & other data assets and Emails. Leave Meetings off unless you run Teams Premium. Groups & sites is the container scope; add it on a second pass, since it needs a separate setting in Microsoft Entra ID.
4. On the protection settings page, turn on Apply content marking for Confidential and Highly Confidential and type the text. Turn on Apply or remove encryption only for the labels you decided to encrypt, assign the group and the rights, and set offline access and expiry.
5. Skip the Auto-labeling for files and emails page unless the tenant has E5 or the E5 Information Protection and Governance add-on; without the license the setting cannot be used.
6. Review and create. Repeat for each label, then arrange the list with Public at the start and Highly Confidential at the end.

Creating a label publishes nothing. Until a label policy includes the user, Word and Excel show no Sensitivity button.

Still in Information Protection, open Label policies and select Publish labels.

1. Choose the labels. Publish all four to everyone; keep a separate policy with the encrypted sublabels for the groups that need them.
2. Assign the policy to a pilot group of 5 to 10 people from the departments that handle the most sensitive files.
3. The policy settings decide behavior:
   • Apply this label by default to documents and, separately, to emails. Set General.
   • Users must provide a justification to remove a label or lower its classification. Turn this on from day one; it writes the reason to the audit log.
   • Require users to apply a label to their documents and emails. This is mandatory labeling: off for the pilot month, then on, after which an unlabeled save or send prompts for a label and cannot be skipped.
   • Provide users with a link to a custom help page: a one-page intranet article with the four labels and their sentences.
4. Name the policy, review, and submit.

Minimum app builds matter here. Microsoft's version table lists a default label for new documents from Current Channel 1910 on Windows, and a default label applied to existing unlabeled documents from Current Channel 2208 on Windows and 16.63 on Mac. Semi-Annual Enterprise Channel receives label features later, so check the channel first.

One tenant-level switch controls whether SharePoint and OneDrive understand labels on Office files. Without it, Office for the web shows no labels and the services cannot read encrypted files, so co-authoring, search, eDiscovery and data loss prevention do not work on them.

In the SharePoint Online Management Shell, check the state:

(Get-SPOTenant).EnableAIPIntegration

If it returns False, turn it on:

Set-SPOTenant -EnableAIPIntegration $true

It covers new and changed files encrypted with a cloud key, not Double Key Encryption. Container labels for Teams and SharePoint sites use a different setting (the EnableMIPLabels group setting in Entra ID), so this switch does not light them up.

The user steps are the same on Windows, Mac and the web:

1. In Word or Excel, open the file, select the Home tab and select Sensitivity. Pick the label. The label name appears in the title bar and under File, then Info.
2. To change a label, select Sensitivity again and choose another. If the new label is lower in sensitivity and the policy requires justification, a dialog asks for the reason before the change is saved.
3. To remove a label, open the Sensitivity menu and clear the selection. When the policy requires a label, the remove option is not available.
4. In Outlook, while composing, select Sensitivity on the Message tab.
5. When mandatory labeling is on, saving an unlabeled file or sending an unlabeled email shows a prompt to choose a label; the user cannot proceed without one.

Microsoft enforces the split. Since January 2024 new customers have needed the right license to use sensitivity labels, and existing customers had a grace period that ended in early April 2024.

Prices are Microsoft list prices per user per month on an annual term, October 2026 price list. Microsoft 365 F1 and F3 are on Microsoft's manual labeling list as well.

The decision rule: buy the add-on for the people whose files Purview should label without asking, usually finance, HR and anyone handling client identifiers. Everyone else labels by hand.

The milestones are ours; the settings behind them are Microsoft's.

Do I need Microsoft 365 E5 to use sensitivity labels in Word and Excel?

No. Manual labeling, including content marking and encryption, is covered by Microsoft 365 Business Premium, E3, E5, F1 and F3. E5 or the E5 Information Protection and Governance add-on ($7.00 per user per month on an annual term, Microsoft list price, October 2026 price list) is needed only for automatic and recommended labeling.

Why do my users not see the Sensitivity button?

In almost every case the user is not in a published label policy, is signed in with a personal account, or the app is on a build below the minimum for that feature. Check the policy scope first, then the account, then the Office update channel.

Can a label encrypt an Excel file so only my team can open it?

Yes. A label with encryption and assigned permissions limits opening to the users or groups you name, with the rights you set. The file stays encrypted when it is emailed, copied or downloaded.

Does the Azure Information Protection add-in still work in Office?

No. Microsoft retired the add-in on April 11, 2024 and disabled it in Office between May and December 2024. Built-in labeling in Microsoft 365 Apps replaces it; the Purview Information Protection client 3.0 keeps the scanner, viewer and file labeler but no Office add-in.

Does labeling a Team or SharePoint site label the files inside it?

No. A container label controls the site's privacy, external sharing and unmanaged-device access; the files keep their own labels. Container labels also need the separate Entra ID group setting, not the SharePoint file switch.

• Learn about sensitivity labels — Microsoft Learn, checked 2026-10-11
• Create and configure sensitivity labels and their policies — Microsoft Learn, checked 2026-10-11
• Minimum versions for sensitivity labels in Office apps — Microsoft Learn, checked 2026-10-11
• Enable sensitivity labels for files in SharePoint and OneDrive — Microsoft Learn training, checked 2026-10-11
• Apply sensitivity labels to your files and email — Microsoft Support, checked 2026-10-11
• MC713037: Azure Information Protection Add-in for Office is retiring — Microsoft 365 Message Center post, public mirror, checked 2026-10-11
• MC736438: License enforcement for Microsoft Purview Information Protection for sensitivity labels — Microsoft 365 Message Center post, public mirror, checked 2026-10-11
• Microsoft commercial price list, October 2026 (US), for the Microsoft 365 and Purview prices quoted