Purview: Service-Side Auto-Labeling for data using custom Sensitive Info Type

Question

Purview: Service-Side Auto-Labeling for data using custom Sensitive Info Type

Sergio Londono 851

Hello Team,

I am in the process to enable Purview Service-Side Auto-Labeling.

I am located in location with custom PII, There is not OOB sensitive info type for our local ID.

for sure, in SPO and ODfB we have sensitive data that contain this local ID that needs to be protected by Purview Service-Side Auto-labeling.

So, I just create one scenario that I would like you help me to confirm if old data will be protected by Service-Side Auto

Scenario:

Jan 01 2020, It was created a 10 millions files in Sharepoint and OneDrive that contain the "LOCALID" which is PII for my location, from Jan 01 2025 to Dec 31 2025 there is not sensitive Info type able to detect this LOCALID.

2.In Jan 01 2025, an "data privacy officer" create a new custom "sensitive info type" to detect "LOCALID"

3.In March 01 2025, someone create file2 that contain "LOCALID" PII

4.In Apr 01 2025, The "data privacy officer" create a service-side Auto-labeling to apply the sensitivity label "Internal" to all data in sharepoint and OneDrive

Questions:
Will Data classification service will detect the data created between Jan 01 2025 to Dec 31 2025, will this data collected in Content Explorer?

Will service-side Auto-labeling apply the label "Internal" to files created between Jan 01 2025 to Dec 31 2025, the files are not being modified since 2024, meaning, the files are at REST without any modification?

If yes, how long it will take the Service-side Auto-labeling to protect the legacy data?

IF not, how can I force Data discovery service to re-scan the data between Jan 01 2025 to Dec 31 2025 to appear in the content explorer and be labeled by Service-side Auto-Labeling?

I believe this is an scenario very frequent, I need to protect legacy data in SPO, it is not feasible do it manually file by file.

Best regards,

Chandra Boorla 11,750 Microsoft External Staff

@Sergio Londono

Thank you for your detailed scenario concerning the implementation of service-side auto-labeling in Microsoft Purview. Your questions address critical aspects of data protection, especially when dealing with custom sensitive information types (SITs).

Below is a structured analysis of your questions and actionable steps to address your requirements for protecting legacy data in SharePoint Online (SPO) and OneDrive for Business (ODfB) using Microsoft Purview’s service-side auto-labeling:

Detection of Data in Content Explorer - Will the Data Classification Service detect files created between Jan 1, 2025, and Dec 31, 2025, and will they appear in Content Explorer?

Yes, files created after the custom Sensitive Information Type (SIT) "LOCALID" is defined (i.e., after Jan 1, 2025) will be detected by the Data Classification Service and will appear in Content Explorer, provided they match the criteria defined in the SIT.

Key Details:

Content Explorer reflects classifications based on active SITs at the time of file processing.
Purview automatically scans new or modified files in SPO/ODfB within 24–48 hours.
Files created before the SIT's definition (i.e., before Jan 1, 2025) will not be detected unless they are modified or explicitly rescanned.

Auto-Labeling for Unmodified Files (Jan 2025 – Dec 2025) - Will service-side auto-labeling apply the "Internal" label to unmodified files created in 2025?

No, service-side auto-labeling applies sensitivity labels to files when they are:

Created or modified after the auto-labeling policy is enabled (e.g., after Apr 1, 2025).

Explicitly rescanned via a full reindex of the SPO/ODfB site.

Implication - Files created between Jan 1, 2025, and Mar 31, 2025, that remain unmodified will not be automatically labeled unless a reindex is performed.

Timeline for Protecting Legacy Data - If Rescanned:

Detection in Content Explorer - Typically within 1–7 days post-reindex.

Label Application - Gradual process with no specific SLA; may take days to weeks depending on data volume.

Forcing a Rescan of Legacy Data - To retroactively label unmodified files (Jan 2025 – Dec 2025):

Step 1: Reindex SPO/ODfB Sites - Use PowerShell to trigger a full reindex:

Connect-SPOService -Url https://<tenant>-admin.sharepoint.com
Set-SPOSite -Identity <SiteURL> -NoCrawl:$false
# Trigger reindexing by modifying a property or using a reindexing method

Note: Replace <SiteURL> with the target site/library URL.

Step 2: Monitor Progress:

Content Explorer - Verify detection of "LOCALID" in legacy files.
Purview Activity Explorer - Track label application in near-real-time.

Step 3: Validate Results - Use audit logs:

Search-UnifiedAuditLog -Operations "SensitivityLabelApplied" -StartDate <Date> -EndDate <Date>

Critical Recommendations

Automate Rescans - Schedule periodic reindexing for critical sites.

Test Custom SIT - Validate "LOCALID" detection with sample data to avoid false positives/negatives.

Default Labels - Apply a default sensitivity label to document libraries to protect new content.

Monitor Exceptions - Check for excluded sites/libraries or conflicting labels.

Summary Table

Scenario	Detection in Content Explorer	Auto-Label Applied?	Action Required
New files (Apr 1, 2025, onward)	Yes (1–2 days)	Yes	None
Files created Jan–Mar 2025 (unmodified)	Yes (post-reindex)	Yes (post-reindex)	Reindex sites via PowerShell
Legacy files (2020–2024)	No	No	Not feasible without reindex

Conclusion:

Immediate Action - Begin reindexing high-priority sites.

Long-Term Strategy - Schedule quarterly rescans for critical data.

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.

Chandra Boorla 11,750 Reputation points Microsoft External Staff

2025-04-24T18:07:34.9066667+00:00

@Sergio Londono

Just checking in to see if the below suggestion helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Accepted answer

1 additional answer

Your answer

Chandra Boorla 11,750 Reputation points Microsoft External Staff

2025-04-24T18:07:34.9066667+00:00

@Sergio Londono

Just checking in to see if the below suggestion helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

@Sergio Londono

Thank you for calling that out, you are absolutely right.

Toggling -NoCrawl:$false via PowerShell does not trigger a reindex if the site is already set to allow crawling. It's a common misconception, and I appreciate you highlighting that nuance.

To ensure legacy content is picked up by the crawler and subsequently detected by the Data Classification Service, the recommended approach is to explicitly trigger a reindex using one of the following:

Best Practice - Use SharePoint UI

Go to Site Settings --> Search and Offline Availability --> Click Reindex Site

This action guarantees a full reprocessing of the site's content, independent of existing crawl settings.

For Automation - Use PnP PowerShell

Connect-PnPOnline -Url <SiteURL> -Interactive
Request-PnPReindexWeb -Force

This is a more reliable method than toggling crawl settings and works well for scripted or automated workflows.

Summary

Best Practice – Use the SharePoint UI Reindex Site button for simplicity and reliability.

Automation – Use Request-PnPReindexWeb if you need to integrate reindexing into a script or pipeline.

By reindexing via either method, legacy content will be rescanned, detected by Purview’s Data Classification Service, and labeled according to your service-side auto-labeling policies.

Thanks again for surfacing this - it's an important distinction that helps clarify how reindexing is actually triggered.

I hope this information helps. Please do let us know if you have any further queries.

Thank you.

Chandra Boorla 11,750 Reputation points Microsoft External Staff

2025-04-22T18:04:16.99+00:00

@Sergio Londono

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Sergio Londono 851 Reputation points

2025-04-23T14:10:46.5366667+00:00

hello @Chandra Boorla ,

Perfect, thanks for the update.

I will use the site reindex in the Sharepoint UI.

Best regards,
Chandra Boorla 11,750 Reputation points Microsoft External Staff

2025-04-23T15:32:56.09+00:00

@Sergio Londono

Glad to know that above suggestion helped.
If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Thank you.

Answer 2

Hello @Chandra Boorla

Crawling is allowed by default.

Content in the site is included in:
- Microsoft Search SharePoint Search
```
Copilot for Microsoft 365 (if licensed and enabled)
```

if the -NoCrawl is already false and then I do "Set-SPOSite -Identity <SiteURL> -NoCrawl:$false" This won't trigger reindex the site

I found this information related reindex a sharepoint site:

https://learn.microsoft.com/en-us/sharepoint/crawl-site-content

On the site, select Settings , and then select Site settings. If you don't see Site settings, select Site information, and then select View all site settings.
Under Search, select Search and offline availability.
In the Reindex site section, select Reindex site.

User's image

can you please confirm which approach is better from your point of view?

Share via

Purview: Service-Side Auto-Labeling for data using custom Sensitive Info Type

1 additional answer

Your answer