Peeling Away the Layers to Find the Cheapest Auto-Label Option

Last week, I discussed how to use auto-label policies to apply sensitivity labels to old files in SharePoint Online sites to prevent their discovery and use by Microsoft 365 Copilot. The approach works but it’s only viable if a Microsoft 365 tenant has the necessary licenses to support auto-label policies.

Understanding Microsoft licensing is an art form and getting things right is important when a licensing decision might affect everyone in a tenant. In this instance, the requirements for information protection service-side automatic sensitivity labeling from the Purview service descriptions and license guidelines page seem pretty straightforward (Figure 1).

The same information is available in the Microsoft 365 Compliance Licensing Comparison Excel worksheet (also available as a PDF).

Licensing Trainable Classifiers

Purview extends over many different solutions. In my original article, I suggest using a trainable classifier to locate old files, so we need to check that licenses under consideration also cover trainable classifiers. The same page says:

“To auto-apply retention labels using a trainable classifier, the following licenses provide user rights:

• Microsoft 365 E5/A5/G5
• Microsoft 365 E5/A5/G5/F5 Compliance and F5 Security & Compliance
• Microsoft 365 E5/A5/F5/G5 Information Protection and Governance”

Licensing Costs

It seems clear then that the licensing requirement is met by having one of these SKUs (listed in order of cost):

• Microsoft 365 E5 (or Office 365 E5).
• The Microsoft E5 Compliance add-on ($12/user/month)
• The Microsoft E5 Information Protection and Governance add-on ($7/user/month).

Microsoft 365 E5 Information Protection and Governance add-on is a subset of the Microsoft 365 E5 Compliance product. According to this page, the Information Protection and Governance add-in is available for the following base licenses (Figure 2):

Interestingly, although Microsoft 365 Business Premium supports the E5 Security add-on, Microsoft still doesn’t support the E5 Compliance add-on for these customers – but Microsoft 365 Business Premium tenants can buy the Information Protection and Governance add-on. It’s an anomaly.

The takeaway is that if a tenant can restrict its licensing requirements to as tight a set as possible, it might be possible to reduce the overall cost for extra licenses quite considerably.

Who Needs the Licenses?

Microsoft’s general licensing guideline for Purview solutions is that anyone who benefits from a feature must be licensed for that feature. In practical terms, this means that anyone with access to a SharePoint Online site that’s processed by an auto-label policy requires a license. The same rule applies to other forms of auto-labeling, such as defining a default sensitivity label for a document library.

The DIY Option to Sensitivity Labeling

Let’s imagine that you don’t want to pay Microsoft any more licensing fees but still want to apply a sensitivity label to a bunch of old files. It’s possible to do this with a DIY app, but it will still cost because the Graph assignSensitivityLabel API is a metered API and costs $0.00185 each time the API applies a label to a file, or $185 per 100,000 files.

Sensitivity labels can’t process every type of file that’s found in SharePoint Online. The API can only deal with Office documents and PDF files. Older Office documents (.DOC, .XLS, and .PPT files) are unsupported, so some testing is needed to establish exactly what in the target content can be processed.

If you only plan to apply sensitivity labels to a set of known files and don’t need to use advanced capabilities like trainable classifiers to find items like invoices, customer orders, project plans, and so on, then the DIY option could be the right choice. The code to report the files in a SharePoint document library isn’t hard, and once you have a list of files, you can review and trim the set and then use it as input to an app to apply sensitivity labels.

Depending on how many files are to be processed, the DIY

approach can save a lot of money over licensing costs. Apart from having to pay to create, test, deploy, and support the code, the downside is that DIY labeling is a one-off mechanism without the benefits of ongoing automatic labeling or any of the other advanced processing built into Purview. You pay your money and make your choice!

Insight like this doesn’t come easily. You’ve got to know the technology and understand how to look behind the scenes. Benefit from the knowledge and experience of the Office 365 for IT Pros team by subscribing to the best eBook covering Office 365 and the wider Microsoft 365 ecosystem.