# Sensitivity label policies are published to users
Labels must be published by using label policies before users can apply them to items, such as files, emails, and meetings.
Source: https://maester.dev/docs/tests/ZTA.35004
:::note[Maester checks this too]
[CIS.M365.3.3.1](/docs/tests/CIS.M365.3.3.1) (Ensure Information Protection sensitivity label policies are published) checks the same setting. Running both reports it twice.
:::
## Overview
Labels must be published by using label policies before users can apply them to items, such as files, emails, and meetings. Label policies define which users receive which labels, set default labeling behavior, and other labeling requirements. Without published policies, sensitivity labels remain unavailable to users.
## Remediation
- [Create and configure sensitivity labels and their policies](https://learn.microsoft.com/purview/create-sensitivity-labels?tabs=classic-label-scheme&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#publish-sensitivity-labels-by-creating-a-label-policy)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Low |
| Effort to fix | Low |
| Impact on users | Medium |
| Pillar | Data, AI |
| Category | Sensitivity Labels |
| Product | [Purview](/docs/tests/products/purview) |
| Feature | Information protection |
| Area | Data protection |
| Licence | RMS_S_PREMIUM, Microsoft 365 E3 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.