Microsoft 365 Setup Guide: Purview & Copilot Labels

01 / PREREQUISITES

Prepare your tenant

Confirm feature-specific licensing for file sensitivity labeling, encryption, Microsoft 365 Copilot work-data grounding and any DLP or advanced audit controls you intend to use. A Copilot licence does not automatically include every Purview capability.
Assign least-privilege Purview roles for label and policy management, such as Information Protection Admins or a custom role group containing Sensitivity Label Administrator. Use authorized SharePoint and Entra administrators for their respective configuration tasks; avoid routine Global Administrator use.
Open purview.microsoft.com with your work account. Use Solutions → Information Protection for labels and label policies. Portal wording can vary as Microsoft updates the experience.
Confirm Microsoft 365 audit recording is enabled in Purview Audit. Do not assume that a visible dashboard means all desired workloads or events are being collected.
Choose pilot users and data owners. Prepare synthetic finance or payroll documents and separate authorized, unauthorized and restricted-rights test accounts. Remove unnecessary broad SharePoint and OneDrive access before introducing Copilot.

Microsoft references: roles and prerequisites and enable and verify auditing.

02 / INFORMATION PROTECTION

Create and publish sensitivity labels

Agree a taxonomy with data owners—for example, Public, Internal, Confidential and Highly Confidential. These are illustrative names, not a prescribed Microsoft taxonomy. Define who may access each category and which protection it requires.
In Information Protection → Sensitivity labels, create a label with a scope that includes files and other data assets, and emails if needed. Add clear user-facing descriptions and configure supported markings. A site/group label alone does not label its documents.
For restricted categories, configure encryption and assign permissions to the intended users or groups. Review usage rights and recovery arrangements before deploying broadly. Classification without encryption does not remove existing SharePoint permissions.
Order Microsoft labels from least sensitive to most sensitive as documented by Microsoft. Separately, Label Master's monitoring rank uses 0 as the highest sensitivity; do not copy Microsoft's ordering numbers blindly into the monitoring rank.
Create a label publishing policy and select the pilot users or groups. Configure a default label, mandatory labeling and justification for supported downgrade/removal operations only where your rollout requires them. Publish the policy; creating a label alone does not make it available to users.
Allow policy propagation—Microsoft advises allowing 24 hours for label and policy changes; group-related dependencies can take 24–48 hours. Open a supported, up-to-date subscription Office app with a targeted work account, check the Sensitivity menu and apply a label to the synthetic document.

Enable SharePoint and OneDrive processing

Follow Microsoft's tenant enablement instructions for sensitivity labels on Office files in SharePoint and OneDrive. Use the supported portal enablement option or have an authorized SharePoint administrator enable EnableAIPIntegration through the SharePoint Online Management Shell. This enables supported service-side processing; it is not a Copilot permission bypass.

Upload a supported labeled Office file and verify its label and encrypted-file behavior in Office for the web. Review Microsoft's file-format, encryption and co-authoring limitations. Library default labels and automatic labeling are separate configurations with their own licensing and prerequisites; they do not retroactively protect every file merely because the tenant feature is enabled.

References: create and publish labels, SharePoint / OneDrive enablement, encryption and usage rights.

03 / COPILOT CONTROLS

Protect Copilot grounding and output

There is no universal “connect Purview to Copilot” switch. Copilot uses supported Microsoft 365 integrations and respects existing access and protection rights. Configure and test the relevant labels, access controls and policies in the same tenant.

Test encrypted documents with the intended usage rights. Microsoft documents that Copilot cannot summarize protected content when the user has VIEW but not EXTRACT, although it may return a reference link. An authorized user with the necessary rights may still summarize it.
Verify source-label display and label inheritance in the actual Copilot app and output workflow. Supported flows can inherit source labels, but copying text, exporting content or using a custom agent does not guarantee inherited protection.
If licensed, open Purview Data Loss Prevention and create a policy for the Microsoft 365 Copilot and Copilot Chat location. Configure supported sensitivity-label conditions to exclude selected files or emails from grounding. Test in simulation before enforcing; a reference link may still be shown.
Treat sensitive-prompt restrictions and external web-search restrictions as separate DLP scenarios. Verify the supported conditions and actions for the experience your pilot uses; blocking web search does not necessarily block internal Microsoft 365 grounding.
Review supported AI activity in Purview DSPM for AI and Audit. Configure required collection and retention separately. Labels, DLP enforcement, audit-log retention and interaction-content retention are distinct controls.

Labels are one layer, not the whole boundary

A non-encrypted “Confidential” label alone does not prevent Copilot from using an over-shared file. Remediate permissions, configure protection and DLP, and test negative-access cases. Microsoft capabilities support governance; they do not automatically make an organization compliant.

References: Copilot protection considerations and Copilot DLP.

04 / MONITORING CONNECTION

Connect Microsoft 365 to Label Master

Use a Label Master workspace owner or administrator account. Tenant validation identifies your Microsoft tenant; it does not grant consent or activate live monitoring.

Open Settings → Integrations → Microsoft 365 and expand Backend setup & Azure details. If shared platform credentials are configured, a dedicated app is optional. Otherwise choose Use my own Azure app.
For a customer-provided app, register a single-tenant confidential application in Microsoft Entra ID. Record the tenant ID and application (client) ID, configure the Web callback URI shown in Settings, and create a client secret. Enter the client ID and secret value—not its identifier—in the protected credentials form. This form does not require a tenant-ID entry. Never include secrets in a document, prompt or screenshot.
Configure the application permissions listed below, not delegated permissions. Office 365 Management APIs is a separate API from Microsoft Graph. Required tenant-wide admin consent must be granted by an appropriately authorized Microsoft administrator.
Click Save credentials if using your own app, then Connect. Complete Microsoft admin consent in the new tab; use Open consent if the popup is blocked. Return to Settings and confirm Connected. This uses app-only authentication, not a signed-in employee's delegated access. Re-grant consent when changing required application permissions.
Run Permission diagnostics, Test connection, then Poll now. Polling is blocked if diagnostics fail. Under Settings → Label hierarchy, use Import Microsoft Purview labels to import the catalog separately. Review your existing hierarchy before choosing Replace all, which deletes the existing local hierarchy first. Set monitoring ranks and alert rules, then check Activity / Purview views.

Application permissions for the current connection

Office 365 Management APIs: ActivityFeed.Read · ActivityFeed.ReadDlp
Microsoft Graph: InformationProtectionPolicy.Read.All · AuditLog.Read.All · Directory.Read.All · Files.Read.All · Sites.Read.All
Optional Microsoft 365 email alerts: Mail.Send — only when sending alert emails from a tenant mailbox.

These permissions include broad tenant read access. Have your tenant administrator review the app and its scope before consenting. Follow the current Settings guide if requirements change. Graph RealTimeActivityFeed.Read.All does not replace Office 365 Management APIs ActivityFeed.Read. Passing diagnostics does not independently verify every enrichment or delivery capability.

The production callback is https://labelmaster.site/api/public/ms/callback. Register the exact callback for the origin you use; preview and other domains can require different redirect URIs. Use the value displayed in Settings as the source of truth.

Monitoring depends on Microsoft permissions, licensing, audit availability and polling. A successful connection does not prove that every DLP match or AI interaction is available, and Label Master is not an inline Copilot firewall.

05 / RELEASE CHECKS

Validate before a wider rollout

A targeted pilot user can select and apply the published file label in a supported Office app.
An authorized user can use the protected file; an unauthorized user cannot. A VIEW-without-EXTRACT account behaves as expected in Copilot.
A Copilot request against an excluded synthetic document produces the expected DLP outcome; output labeling is checked independently.
A controlled label change appears in Microsoft Audit and later in Label Master after polling, with the expected actor and old/new labels where supplied.
The security team can retrieve policy matches and investigation evidence, and exceptions have an owner and review date.

The label does not appear in Office

Check the publishing-policy user/group scope, the signed-in work account, file-label scope, app support and policy propagation. Review conflicting policies and licensing. Creating a label without publishing it is a common cause.

Copilot can still use a confidential document

Check whether the label actually encrypts the file, the user's effective rights, and the DLP policy's scope and enforcement state. An allowed user with sufficient rights is not an access-control failure. Container labels and classification-only labels do not automatically block file grounding.

Connected, but no events appear in Label Master

Confirm the correct tenant, app permission type, admin consent, secret validity and connection-test result. Check that a synthetic event exists in Microsoft Audit before investigating polling. Microsoft audit ingestion can be delayed; Poll now cannot retrieve an event Microsoft has not yet exposed.

Official Microsoft references

Portal labels, licensing and supported experiences can change. Verify current Microsoft documentation before applying production changes. Microsoft, Purview and Copilot are Microsoft trademarks; Label Master is independent and complements Microsoft Purview.

Back to AI governance Sign in to Label Master

Microsoft 365 setup guide