Inconsistent sensitivity label deployment across pilot users — some see labels in Outlook only, others see none at all (4+ days, no propagation)

Use a per-symptom, per-user checklist that focuses on three areas: subscription/licensing, label publishing scope, and client configuration for built‑in labeling.

1. Baseline checks for all pilot users (Groups A and B)

For every user in the pilot group, verify the following:

1. Microsoft 365 subscription and licenses
   • Confirm the signed‑in account in Office/Outlook is a Microsoft 365 subscriber account.
   • Confirm the appropriate security/compliance licenses are assigned to each affected user per the Microsoft 365 security & compliance licensing guidance.
   • If a user is not a subscriber or lacks the required license, the Sensitivity button and labels will not appear.
   Relevant guidance:
   • Outlook: causes include non‑subscriber account and missing label publishing.
   • Other Office apps: causes include non‑subscriber account, no valid subscription, and missing licenses.
2. Label publishing policy scope and workload coverage
   • In Microsoft Purview, confirm that the sensitivity labels are actually published via a label policy that includes all pilot users.
   • For each label policy, run in Exchange Online PowerShell:

          Get-LabelPolicy -Identity "Label_policy_name" | fl
     

     Check:
     • Workload contains Exchange (for Outlook).
     • Mode is Enforce.
     • One of the following is set and includes the pilot users:
       • ExchangeLocation
       • ExchangeLocationException
       • ModernGroupLocation
       • ModernGroupLocationException
   • If ExchangeLocation or ModernGroupLocation is a group, verify each pilot user is a member of that group.
3. Label configuration for email vs. files
   • For each label that should appear in Outlook and Office apps, run:

          Get-Label -Identity "Label_name" | fl
     

     Confirm:
     • ContentType contains both File and Email (so labels can appear in Word/Excel/PowerPoint and Outlook).
     • Disabled is False.

If any of these checks fail for a user, correct the configuration using Set-Label / Set-LabelPolicy or by updating the label policies in Purview, then allow time for re‑distribution.

2. Focused troubleshooting for Group A

Symptom: Labels appear in Outlook but not in Word/Excel/PowerPoint.

For these users, Outlook is receiving label policy, but Office apps are not applying or showing built‑in labels.

Perform these steps on an affected user’s device:

1. Confirm Office apps meet version requirements
   • Verify the Office app version meets the requirements listed under “Sensitivity label capabilities in Word, Excel, and PowerPoint.”
   • Older or unsupported builds may not show built‑in labels.
2. Check built‑in labeling registry keys for Office apps
   • On the client, check:
     • HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Security\Labels
     • HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Common\Security\Labels
   • If these keys exist and UseOfficeForLabelling is set to 0, Office apps are prevented from using built‑in labeling.
   • Set UseOfficeForLabelling to 1 so Word/Excel/PowerPoint use built‑in sensitivity labels.
3. Validate subscription and file type support
   • Confirm the signed‑in Office account is the licensed Microsoft 365 account.
   • Confirm the file types being tested are supported for built‑in labeling.
4. Check for known issues
   • Review the list of known issues that affect sensitivity labels in Office apps to see if the behavior matches a documented issue.

3. Focused troubleshooting for Group B

Symptom: No labels in Outlook or any Office app.

For these users, treat it as a full distribution/visibility failure.

1. Outlook‑specific checks
   • Confirm the Outlook version supports built‑in labeling as per “Sensitivity label capabilities in Outlook.”
   • Verify label policy distribution:

          Get-LabelPolicy -Identity "Label_policy_name" | fl
     

     • Confirm DistributionStatus : Success.
   • On the client, check:
     • HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Common\Security\Labels
     • If present and UseOfficeForLabelling is 0, Outlook is using the AIP client instead of built‑in labels. Set UseOfficeForLabelling to **1` to switch to built‑in labels.
2. Reset built‑in labeling cache for Outlook
   • Exit Outlook and all other Office apps.
   • Navigate to %localappdata%\Microsoft\Office\CLP.
   • In this folder, locate the *.policy.xml file (contains label policy for the user) and rename the CLP folder (for example, to CLP_old).
   • Restart Outlook so it reconnects to Microsoft Purview Information Protection services and re‑downloads labels and policies.
3. Office apps (Word/Excel/PowerPoint) checks
   • Repeat the Group A Office‑app checks for these users:
     • Confirm Microsoft 365 subscription and license.
     • Confirm label publishing includes these users.
     • Confirm Office version supports sensitivity labels.
     • Confirm UseOfficeForLabelling is 1 in the relevant registry keys.

4. Cross‑user comparison to isolate differences

To systematically diagnose across the pilot group:

1. Pick one working user (labels everywhere) and one user from Group A and Group B.
2. For each of the three users, compare:
   • Assigned licenses.
   • Group memberships used in label policies.
   • Get-Label and Get-LabelPolicy outputs.
   • Outlook and Office versions.
   • Registry values for UseOfficeForLabelling.
3. Any difference found between the working user and an affected user is a likely root cause.

Once configuration is aligned (labels enabled for both File and Email, policies include all pilot users, built‑in labeling enabled in clients, supported versions and licenses in place), sensitivity labels should appear consistently across Outlook and Office apps.

References:

• Sensitivity labels are missing in Outlook, Outlook on the web, and other Office apps
• Known issues with sensitivity labels in Office