Microsoft Copilot
What is sensitivity labeling before a Copilot rollout?
Sensitivity labeling before a Copilot rollout means every team, group and SharePoint site carries a label that says how sensitive its content is, so access and data protection rules can follow. What decides whether they protect anything is finding what is still unlabeled and getting its owner to choose one.
In short
- Copilot answers from whatever the person asking can open, so unlabeled content is content nobody has classified.
- Purview creates and enforces labels. Finding what is unlabeled and who owns it is a separate job.
- Owners label best, because they know what their site holds.
- Track the count of unlabeled sites every week, because that number is your evidence.
Step by step
Five steps take a tenant from a label scheme on paper to labels on the workspaces Copilot reads.
-
Agree a small label scheme
Define three to five labels in Microsoft Purview, such as Public, Internal, Confidential and Highly Confidential, with one sentence on what belongs in each. Decide what each label controls for a team or site: guest access, external sharing and privacy.
Tip: A scheme people can remember beats a complete one. Owners will not choose between twelve labels.
-
List every unlabeled team and site
Report all teams, Microsoft 365 groups and SharePoint site collections without a sensitivity label, with their owner, member count and last activity. Include sites with guests and external sharing, since they carry the most risk.
-
Ask owners to label, with a due date
Send each owner the list of their unlabeled workspaces and ask them to choose a label by a fixed date. Escalate unanswered requests to the owner's manager, and decide beforehand what happens to workspaces nobody claims.
In Rencore: -
Label the riskiest sites first
Do not wait for the whole tenant. Start with sites that hold sensitive data or have external access, then work down. Apply a default label to the long tail so nothing stays unclassified.
-
Measure the gap and keep it closed
Track the number of unlabeled workspaces weekly and keep the policy running, because self-service creates new ones every day. A falling count, with names and dates, is the evidence that Copilot reads classified content.
In Rencore:
Why unlabeled content becomes a Copilot problem
Copilot does not bring new permissions. It searches what a person can already reach and turns it into an answer, quickly and in plain language. A site that holds salary data, a contract archive or a board paper and carries no label looks the same as a harmless one, to your policies and to anyone searching.
Labels turn that judgement into a setting that rules can act on: who may be a member, whether guests are allowed, what protection applies to the files. They only help where they exist. In most tenants years of self-service created teams and sites faster than anyone labeled them, so the first job is a list of what is missing. For the full readiness plan, see the Copilot rollout How-to linked below.
Connectors in this How-to
Each connector page in the Rencore docs lists the objects, policies, reports and actions behind these steps.
Last updated 11 November 2026
