Microsoft Purview is expanding the way teams evaluate auto-labeling policies. In August 2026, Microsoft highlighted two views: the simulation overview before enforcement and the new Insights tab for active policies. This matters to organizations with 10 to 250 users when confidential files and emails should receive sensitivity labels automatically. A rule that is too broad can produce many inappropriate matches, while a rule that is too narrow can miss content that needs protection. Microsoft therefore explicitly recommends running a policy in simulation mode and reviewing the results before it labels content.
What Microsoft added in August 2026
The simulation overview shows which items an auto-labeling policy would label without changing those items. Microsoft documents metrics for status, duration, matches, rules, sources, and detected sensitive information types. The Insights tab summarizes this information directly in the policy details panel. Its content depends on the operating state: expected matches are central during simulation, while operational metrics describe actual labeling after enforcement. According to Microsoft, the Insights tab isn’t available for disabled policies.
Why simulation matters before enforcement
Auto-labeling operates on production data in Exchange, SharePoint, and OneDrive. A team should therefore look beyond the total match count and examine which rule, data source, and sensitive information type caused each result. Simulation does not apply labels, creating a controlled review point. This supports a structured Microsoft Purview rollout: test patterns and scopes first, review notable sample items, and only then decide whether to enforce the policy. Simulation does not replace business-led data classification, but it can expose configuration problems before a policy changes production content.
Which results teams should review
- Compare matches per rule to identify conditions that are too broad or too narrow.
- Review the distribution across Exchange, SharePoint, and OneDrive instead of relying on the total.
- Assess the most frequent sensitive information types and whether they are plausible for the business.
- Open supported sample items and inspect their context, location, and detected content.
Microsoft notes that the matched-item count is an estimate. During simulation, the service samples content across the configured locations, so the later enforcement count can differ slightly. Exchange match counts are also based on sampled data and need the same qualification. A single total should therefore not determine approval. The useful question is whether rules and samples reflect the intended protection model. Microsoft also provides a plain-language contextual summary explaining why a sample matched. This can support review with business owners who do not maintain the technical rule details.
Time windows, roles, and limitations
Microsoft does not specify a general retirement deadline or a mandatory enforcement date. However, two operational windows matter: simulation samples are retained for 30 days, and Insights for an enforced policy reports labeling metrics for the last 30 days. Viewing matched text in files also requires the Data Classification Content Viewer role. After enforcement, Insights metrics for labeled and failed files cover SharePoint and OneDrive only. Exchange email is excluded and must be monitored in Activity explorer. These boundaries belong in the review record so differences between dashboards are not mistaken for missing data.
Concrete next steps
- Document the purpose, sensitivity label, rules, and included locations for every policy.
- Start the policy in simulation mode, either with or without notifications.
- Review rules, sources, information types, and samples with accountable business owners.
- Adjust implausible conditions and repeat simulation before approval.
- After enforcement, monitor 30-day metrics and persistent failures; use Activity explorer for Exchange.
The review should align with Data Loss Prevention and the organization’s existing sensitivity scheme. The boundary is important: auto-labeling classifies content according to configured conditions; it does not replace data ownership or legal assessment. ReByteIT supports technical configuration and testing in Microsoft 365, not an assessment of regulatory applicability. Changes to production rules should be traceable and tied to a clear approval point.
Official Microsoft sources
- Microsoft Learn: What’s new in Microsoft Purview
- Microsoft Learn: Review simulation results for auto-labeling policies
- Microsoft Learn: Use the Insights tab to analyze auto-labeling policies
If you are introducing automatic sensitivity labels or reviewing existing rules, we can assess policies, roles, test matches, and operational metrics in a structured way. Talk to us before an untested policy starts labeling production data.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
