# Mandatory labeling is enabled in sensitivity label policies
The policy setting Require users to apply a label ensures a sensitivity label must be applied before users can save files and send emails or meeting…
Source: https://maester.dev/docs/tests/ZTA.35016
## Overview
The policy setting **Require users to apply a label** ensures a sensitivity label must be applied before users can save files and send emails or meeting invites, create new groups or sites, and use Power BI content. This setting also prevents users from completely removing a sensitivity label. Unlabeled items create security and compliance risks. For example, threat actors can exfiltrate sensitive data that could be prevented by protection solutions that trigger based on label detection.
## Remediation
- [Publish sensitivity labels by creating a label policy](https://learn.microsoft.com/purview/create-sensitivity-labels?tabs=modern-label-scheme&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#publish-sensitivity-labels-by-creating-a-label-policy)
- [Require users to apply a label to their email and documents](https://learn.microsoft.com/purview/sensitivity-labels-office-apps?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#require-users-to-apply-a-label-to-their-email-and-documents)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Medium |
| Impact on users | High |
| Pillar | Data, AI |
| Category | Information Protection |
| Product | [Purview](/docs/tests/products/purview) |
| Feature | Information protection |
| Area | Data protection |
| Licence | RMS_S_PREMIUM, Microsoft 365 E3 |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.