# Sensitivity labels are published for files used by Microsoft 365 Copilot

Ensure Microsoft Purview sensitivity labels are published to users and at least one published label is scoped to files, so Microsoft 365 Copilot honors…

Source: https://maester.dev/docs/tests/MT.1173

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/ofirgavish" title="Ofir Gavish · Original author"><img src="https://github.com/OfirGavish.png" alt="Ofir Gavish" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/ofirgavish">Ofir Gavish</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/maester">Maester</a> · Purview · Information protection · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId MT.1173
```

## Overview

Ensure Microsoft Purview sensitivity labels are published to users and at least one published label is scoped to **files**, so Microsoft 365 Copilot honors and inherits labels onto AI-generated content.

Microsoft 365 Copilot only:

- **Honors** sensitivity labels (respecting encryption and usage rights from labelled source files).
- **Inherits** the most restrictive label from the source files used to generate a response onto the new generated content.

…**when** sensitivity labels are actually published to users in your tenant. If no label policy is published, or no published label is scoped to files (SharePoint, OneDrive, Office documents), Copilot has no labelling signal to apply, and DSPM for AI cannot report on label-based oversharing risks.

The test passes when **all** of the following are true:

- At least one **label policy** is published / enforced (`Get-LabelPolicy` with `Mode = Enforce`).
- At least one **label** has the `File` scope (`Get-Label` where `ContentType` includes `File`).
- That file-scoped label is **included in a published label policy** (a file-scoped label that exists but isn't in any published policy does not count as compliant).

#### Remediation action

1. Open the [Microsoft Purview portal — Information Protection — Labels](https://purview.microsoft.com/informationprotection/labels).
2. Create or edit a sensitivity label and ensure **Files** is selected under "Define the scope for this label".
3. Open **Label policies** and publish the label to the relevant users or groups.
4. Verify with PowerShell after a few minutes:

   ```powershell
   Connect-IPPSSession
   Get-LabelPolicy | Where-Object { $_.Mode -eq 'Enforce' }
   Get-Label | Where-Object { $_.ContentType -match 'File' }
   ```

#### Related links

- [Microsoft Learn — Sensitivity labels overview](https://learn.microsoft.com/purview/sensitivity-labels)
- [Microsoft Learn — Microsoft 365 Copilot data protection and sensitivity labels](https://learn.microsoft.com/copilot/microsoft-365/microsoft-365-copilot-privacy)
- [Microsoft Learn — How Copilot inherits sensitivity labels](https://learn.microsoft.com/purview/sensitivity-labels-coauthoring)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | MT.1173 |
| Severity | Low |
| Suite | Maester |
| Product | Purview |
| Feature | Information protection |
| Area | Data protection |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | None |
| Supports controls | nist-800-53-r5:AC-16 |
| PowerShell test | [Test-MtPurviewAiSensitivityLabelsForFiles](https://github.com/maester365/maester/blob/main/tests/maester/purview/Test.MT.1173.ps1) |
| Services | SecurityCompliance |

</details>

## Source

- Test: [`tests/maester/purview/Test.MT.1173.ps1`](https://github.com/maester365/maester/blob/main/tests/maester/purview/Test.MT.1173.ps1)
- Documentation: [`tests/maester/purview/Test.MT.1173.md`](https://github.com/maester365/maester/blob/main/tests/maester/purview/Test.MT.1173.md)