# Globally published sensitivity labels don't exceed the recommended maximum

Publishing too many labels globally creates confusion and decision paralysis for users, reducing adoption and increasing misclassification.

Source: https://maester.dev/docs/tests/ZTA.35015

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

## Overview

Publishing too many labels globally creates confusion and decision paralysis for users, reducing adoption and increasing misclassification. When users face more than 25 labels, they struggle to identify the appropriate classification, leading to incorrect labels or avoiding the feature entirely.

Microsoft recommends no more than 25 labels in global policies, ideally organized as five main labels with up to five sublabels each. Use scoped policies to publish specialized labels only to specific users, groups, or departments, keeping the global label set focused on common scenarios.

## Remediation

- [Sensitivity label limitations per tenant](https://learn.microsoft.com/purview/sensitivity-labels?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#sensitivity-label-limitations-per-tenant)
- [Create and publish sensitivity labels](https://learn.microsoft.com/microsoft-365/compliance/create-sensitivity-labels?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)

## Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```

Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.

<details>
<summary>About this check</summary>

| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | High |
| Pillar | Data, AI |
| Category | sensitivity-labels |
| Product | [Purview](/docs/tests/products/purview) |
| Feature | Information protection |
| Area | Data protection |
| Licence | RMS_S_PREMIUM, Microsoft 365 E3 |
| Tenant | Workforce |

Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.

</details>

<p class="mt-ms-note not-content"><svg class="mt-ms-note__logo" viewBox="0 0 21 21" aria-hidden="true"><rect width="10" height="10" fill="#f25022"/><rect x="11" width="10" height="10" fill="#7fba00"/><rect y="11" width="10" height="10" fill="#00a4ef"/><rect x="11" y="11" width="10" height="10" fill="#ffb900"/></svg><span>A Microsoft check, part of the <a href="/docs/tests/packs/zero-trust-assessment">Zero Trust Assessment</a> pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, <a href="/docs/tests/packs/zero-trust-assessment#licence">MIT licence</a>.</span></p>
