Purview labels: when is Business Premium enough?

“We need to label our contracts Confidential. Does everyone need E5?” A licence name alone cannot answer that. Manual labelling, encryption, automatic content detection, DLP rules and meeting protection are different capabilities. Start with the behaviour you need, not the most expensive plan.

A Microsoft Q&A question combines encryption, watermarks, DLP and Business Premium. The replies offer clues but mix file, email and meeting features. In a Reddit discussion, an administrator sees labels and DLP separately but cannot find the label-as-condition option. That is a different question from whether a user can label a document manually.

Start with what the label must do

A sensitivity label is a classification tag defined in Microsoft Purview and published to users. Depending on its settings and the supported app, it can mark a document or email, add visual markings or restrict access through encryption. A label called “Confidential” does not encrypt anything by itself. Microsoft describes encryption as an optional label setting.

It's useful to separate the three questions: who assigns the label, what the label enforces after it is assigned, and whether another rule responds to the label. Manually tagging a file is a different capability than auto-tagging based on sensitive data. A DLP policy that tracks email content is a different capability than a rule that uses a label as one of its conditions. And the label for a Teams meeting does not automatically take over the label license for the file.

This table is a task map, not a one-size-fits-all SKU price list. Microsoft's Purview Overview varies by function, data location, and user group that benefits from protection. Each line must be assigned to a specific scenario before ordering.

Manual labels do not require E5 by default

The current Purview sensitivity-labelling matrix lists manual labelling for Microsoft 365 Business Premium and E3, among other plans. A company that wants users to label documents and emails in supported apps does not automatically need to move everyone to E5. Verify the specific app, version, platform and policy publication to the right group. Microsoft’s getting-started guide covers creation, publication and testing.

There are two levels to encryption. The license must allow for appropriate protection of information; at the same time, the Control access option must be explicitly enabled for the label and the rights must be set. Encryption documentation also notes that Azure Rights Management is enabled and that changing the label configuration later may not automatically overwrite all already tagged data in the same way. Therefore, test a new document, an existing document, and sharing outside the organization in the pilot.

A watermark or header is a visual marking; it does not make a file inaccessible to an unauthorised person. Encryption is also not a complete workflow on its own. Recipients need the right permissions, their app must support the configuration, and the organisation needs an exception and recovery process. Begin with a short set such as Public, Internal and Confidential, then expand it after testing.

Automatic labelling needs separate rights

Suppose a user writes a contract containing personal identification numbers and Office should recommend or apply a label automatically. That is different from manual labelling. Microsoft distinguishes client-side automatic labelling in Office apps from service-side policies for SharePoint, OneDrive and Exchange. Its automatic labelling guidance describes separate setup paths. The Purview licensing matrix lists higher-tier rights, such as Microsoft 365 E5 or an eligible Purview add-on, for both client- and service-side automation. Business Premium or E3 alone does not grant this whole automation scope.

Separate the scenario by where the decision happens: should Office suggest a label while a person works, or should a service scan stored files and email? The different effects require different tests and sometimes different rights. Start automatic policies in simulation mode, as Microsoft recommends, and review the results before letting them change live content. Test both false positives and missed sensitive files.

DLP and labels have separate licensing

Purview DLP for Exchange Online, SharePoint and OneDrive is available in Business Premium and E3, among other plans. A policy can inspect sensitive content in email and files. This does not imply rights to Teams-message DLP, endpoint DLP, automatic labelling or every advanced condition. Microsoft lists separate requirements for those features.

If a DLP rule must respond to a particular sensitivity label, check the supported locations and condition behaviour, then the exact licensing entry in the current matrix. Do not conclude that every integration is covered simply because you have both labels and DLP. Describe the intended rule precisely, for example “block emails labelled Confidential from leaving the company”, and confirm entitlements for everyone whose content the policy processes.

A control may be visible in the portal even when not every affected user is licensed. Microsoft explains that each user who benefits from a feature needs the appropriate rights. Shared locations require a function-specific assessment of owners and members. One administrator E5 licence does not unlock an E5 feature for the entire tenant.

Assess Teams meeting labels separately

“Business Premium includes labels” does not answer a question about meetings. The Purview matrix distinguishes manual labelling of scheduled meetings from sensitivity labels for Teams online meetings. For the latter, it lists higher Purview rights together with Teams Premium. Define whether the label should affect the invitation, meeting controls or content before buying add-ons.

The topic is related to our overview of Teams Premium and Rooms, but the meeting room license and the meeting protection license are different questions.

Plan a licensing and technical pilot

1. Write down three to five scenarios. For example, label a Word contract, encrypt a proposal for outside counsel and block an email marked Confidential. Identify affected users.
2. Separate the capabilities. State whether each scenario needs manual labels, encryption, automatic labelling, DLP or meeting protection.
3. Check the current matrix and assigned SKUs. Business Premium or E3 may cover basic use; verify advanced functions separately. Resolve unclear entries with Product Terms or a licensing partner before purchasing.
4. Publish a small label taxonomy to a pilot group. Test documents, email, external recipients and supported clients. Avoid dozens of labels at the start.
5. Assess mistakes and user experience. Check whether people understand the labels, legitimate sharing remains possible and encryption enforces the intended rights. Simulate automation first.
6. Assign ownership. Decide who changes labels, approves exceptions and reviews effects on existing files.

Define the rule before buying

First define exactly what should happen to which content and for whom. Manual classification, encryption, automatic detection and DLP are separate layers. That distinction helps you choose licences without an unnecessary move to the highest tier while still covering the capabilities the pilot actually uses. Base the quote on Microsoft’s current matrix and approved scenarios, not on the controls visible in the portal.