Sensitivity Label Auto-Labeling in Outlook Mobile and Mac

Sensitivity label auto-labeling is one of the most frequently misunderstood features in Microsoft Purview. Organizations enable it, it doesn't behave as expected, and the first assumption is that Outlook is broken or the policy didn't publish. In most cases the configuration is misconfigured, and the root cause is almost always a failure to distinguish between how client-side and service-side labeling work, and which Purview settings control which behavior.

This article covers how both modes actually work, how attachment-based label inheritance fits in, and how to configure each correctly in Purview. Mobile support and Mac support are addressed specifically because both are commonly misrepresented in vendor documentation.

Two modes of auto-labeling, and why the distinction matters

Microsoft Purview provides two separate mechanisms for automatically applying sensitivity labels to email. They run at different points in the mail flow, are configured in different places in the compliance portal, and have different implications for client support.

Client-side auto-labeling

Client-side auto-labeling happens inside the Outlook application while a user is composing a message. The Outlook client scans the content being typed, subject line, body, attachments, and either recommends a label (showing a bar the user can accept or dismiss) or automatically applies one without prompting. This requires that Outlook support the feature on the specific platform, and it requires a label policy published to the user that has auto-labeling conditions configured at the label level.

The user-facing experience is immediate and interactive. Users see label recommendations in context, which builds awareness of classification. The tradeoff is that client-side labeling only runs when a supported Outlook client is doing the composing, it does not apply to messages sent by automated systems, calendar invites, or clients that don't implement the feature.

Service-side auto-labeling

Service-side auto-labeling runs in Exchange Online (for email) and in SharePoint and OneDrive (for stored documents). It applies to messages after they have been sent, based on content conditions you define in a separate auto-labeling policy in Purview. It operates on traffic from every sending client, Outlook for Windows, Outlook for Mac, mobile, OWA, Outlook for Android, and any other email client connecting to Exchange Online.

Service-side auto-labeling is the more reliable baseline for ensuring all outbound email meets a minimum classification standard. It cannot provide real-time user feedback the way client-side labeling does, and it runs after the message is already sent, so it cannot block an unlabeled message from leaving. What it can do is ensure that messages which were not labeled by the client get labeled at the Exchange layer, useful for audit, DLP enforcement, and retention policy targeting.

How attachment-based label inheritance actually works

When a user attaches a labeled Office document, PDF, or other file to an email, Outlook can recognize the label on the attachment and apply or recommend a matching label for the email itself. This is called attachment-based label inheritance, and it is a client-side feature, it works in the Outlook application during composition, not at the Exchange service layer after sending.

The mechanics are straightforward: Outlook reads the sensitivity label metadata embedded in the attached file and compares it to the current label on the email. If the attachment carries a higher-classification label than the email, Outlook either prompts the user to apply that label (Recommended mode) or applies it automatically (Automatic mode), depending on how the label policy is configured.

What this is not: it is not content scanning. Outlook is not inspecting the contents of the attachment to infer a label, it is reading the label that was already applied to the document. If the attachment was never labeled in the first place, there is nothing to inherit.

Attachment-based inheritance works in Outlook for Windows, Outlook for Mac, and Outlook on the Web. It is not currently available as a client-side feature in Outlook for iOS or Android, mobile users who attach labeled files do not see a label recommendation from the attachment in the compose window. Service-side auto-labeling in Exchange Online can still label those messages after sending, but that is a separate mechanism.

Configuring auto-labeling in Microsoft Purview

Client-side auto-labeling: label policy settings

Client-side auto-labeling for email, including attachment-based inheritance, is configured in your label policy, not in a separate auto-labeling policy. In the Microsoft Purview compliance portal (purview.microsoft.com), navigate to Information Protection → Label policies, edit your policy, and advance to the Settings for emails page of the wizard.

The relevant settings on that page:

• Default label for emails, applies a specific label to all email unless the user changes it. This is a passive default, not auto-labeling in the strict sense.
• Require users to apply a label to their email messages, mandatory labeling. Users cannot send without choosing a label. this setting applies to new messages; requiring labels on reply and forward is a separate toggle on the same page.
• For email messages with attachments, apply a label that matches the highest classification of those attachments, this is the attachment inheritance setting. Options are: do not apply a label automatically, recommend a label, or apply a label automatically. This controls the behavior described in the previous section.

These settings take effect when the policy is published to users. Policy publication can take up to 24 hours to propagate to all clients.

Auto-labeling conditions at the label level

If you want Outlook to recommend or apply a label based on content in the email body, not attachment metadata, but actual text patterns such as credit card numbers, health record identifiers, or custom keywords, that is configured at the individual label level, not the policy level. Edit a sensitivity label in Information Protection → Labels, advance to the Auto-labeling for files and emails step, and define the sensitive information types or trainable classifiers that should trigger that label.

Service-side auto-labeling: separate policy

Server-side auto-labeling for Exchange is configured under Information Protection → Auto-labeling in the compliance portal. You create a standalone auto-labeling policy, define the conditions (sensitive information types, regular expressions, trainable classifiers), specify which Exchange locations it applies to, and choose a label to apply. Before enabling enforcement, run the policy in simulation mode, this lets you see which messages would have been labeled and verify the conditions are matching what you expect, without actually modifying any mail. Simulation mode is the right way to validate a service-side auto-labeling policy before turning it on.

What each Outlook client actually supports

Client	Manual labeling	Recommended / automatic labeling	Attachment inheritance
Outlook for Windows	Full support	Full support	Supported
Outlook for Mac	Full support	Supported (built-in labeling, no AIP client required)	Supported
Outlook on the Web (OWA)	Full support	Supported	Supported
Outlook for iOS	Full support	Limited, mandatory labeling prompts work; content-based auto-labeling does not run client-side	Not supported client-side
Outlook for Android	Full support	Limited, same as iOS	Not supported client-side

The practical implication: mobile users in regulated environments should have mandatory labeling enabled in their policy (so Outlook prompts them to pick a label before sending), and service-side auto-labeling in Exchange Online should be configured as a backstop for anything that slips through.

Outlook for Mac uses Office's built-in sensitivity labeling, the Azure Information Protection unified labeling client is a Windows-only component and is not installed on Macs. Mac labeling is handled natively by the Outlook for Mac application and does not require any additional client-side agent.

The configuration mistakes we see most often

Policy published to the wrong group

Label policies must be published to the users or groups who need them. A policy published to a security group that users are not members of will not appear in their Outlook client. This is the single most common cause of "I configured everything and Outlook shows no labels." Verify group membership and allow up to 24 hours for propagation before concluding there is a policy problem.

Email mandatory labeling not enabled separately from document labeling

Mandatory labeling for email and mandatory labeling for documents are separate settings in the label policy wizard. Enabling one does not enable the other. An organization that wants to require labels on all outbound email needs to specifically enable the email mandatory labeling toggle, the document mandatory labeling setting does not cover Outlook.

Reply and forward not covered

By default, mandatory labeling applies to new messages only. If users are forwarding unlabeled external email or replying to unlabeled threads, those messages may leave without a label even with mandatory labeling enabled. There is a separate policy setting to require labeling on reply and forward. In environments handling healthcare data or financial records, this setting should be explicitly enabled rather than left at the default.

Attachment inheritance set to Recommend but users are dismissing the prompt

When attachment inheritance is set to Recommended, Outlook shows a bar at the top of the compose window suggesting a label. Users can dismiss this bar. If attachment-based classification is a compliance requirement rather than a suggestion, the policy setting should be Automatic, which applies the label without user interaction. That said, Automatic mode can surprise users who do not understand why their email was labeled, pairing this with user communication is important.

Service-side auto-labeling never taken out of simulation mode

Auto-labeling policies default to simulation mode when first created. Simulation is valuable, it shows you what would have been labeled without actually modifying mail. But policies left in simulation mode indefinitely provide no enforcement. After reviewing simulation results and confirming the policy is matching as expected, the policy must be explicitly switched to enforcement mode.

Verifying your configuration with PowerShell

The Security & Compliance PowerShell module is the right tool for auditing label policy configuration without clicking through the portal wizard. Connect using:

Connect-IPPSSession

To list all label policies and see which users and groups they are published to:

Get-LabelPolicy | Select-Object Name, ExchangeLocation, ModifiedBy, WhenModifiedUTC

To inspect the specific settings on a policy, including email-related configuration:

Get-LabelPolicy -Identity "Your Policy Name" | Format-List

To check the status of your service-side auto-labeling policies, including whether they are in simulation or enforcement mode:

Get-AutoSensitivityLabelPolicy | Select-Object Name, Mode, Workload, WhenModifiedUTC

The Mode field will show TestWithoutNotifications (simulation) or Enable (enforcement). Any policy still showing TestWithoutNotifications is not labeling production mail.

Frequently asked questions