SharePoint Sites Sensitivity Labels and Encryption Frequently Asked Questions and Troubleshooting

November 11, 2026 15:46

Note

Links to additional Frequently Asked Questions (FAQs) can be found at the end of this guide.

This article answers common questions about how SharePoint Sites migrations handle Sensitivity Labels and Encryption. It also helps you troubleshoot common issues, so you can find out why something did not migrate as expected and how to fix it.

SharePoint Sites Sensitivity Labels and Encryption FAQs

This section answers common questions about how sensitivity labels and encryption are handled during SharePoint site migrations. For information outlining setup requirements review Sensitivity Labels Preparation Steps for SharePoint Sites Migrations.

Why were my labelled files skipped? It worked before.

Before, labelled files were copied without their label, and encrypted files couldn't be opened at the destination. They are now skipped unless the project uses Delegate Permissions w/Sensitivity Label Support.

Do I need my own Azure app?

No. The option uses a MigrationWiz app (select Delegate Permissions w/Sensitivity Label Support when configuring your source and destination endpoints. Review the requirements in the Using Delegated Permissions for OneDrive, SharePoint, SharePoint Sites, and Teams migrations article under Permission Requirements for SharePoint Sites.

Which extra permissions does it ask for?

Azure Rights Management Services user_impersonation and Microsoft Information Protection Sync Service UnifiedPolicy.User.Read, both delegated, on top of the normal Delegated permissions. These are added to the MigrationWiz app when using the Delegate Permissions w/Sensitivity Label Support option.

Do the source and destination both need it?

Yes. Delegate Permissions w/Sensitivity Label Support must be used for both the source and destination tenants.

Do labels with different names map automatically?

No. The destination label must have exactly the same name, including capitals. Sub-labels must use the same Parent Label>Sub-label path and and be the same names as well.

Are site or group labels migrated?

No. Only labels on library files.

Will destination users be able to open encrypted files?

Yes, if the destination label has the encrypts rule when you create it and grants them access. The file is protected by the destination tenant, not the source.

Do I need to do anything if I do not use labels?

No. Files without a label migrate as before. Files that do carry a label are skipped and listed as warnings.

SharePoint Sites Sensitivity Labels and Encryption Troubleshooting

This section helps you troubleshoot issues with sensitivity labels and encryption during SharePoint site migrations and explains how to resolve them.

Symptom	Cause	Resolution
Labelled files skipped with …the project is not consented for label operations…	The project uses Application or Delegated Permission	Switch to Delegate Permissions w/Sensitivity Label Support, give consent on both sides, run again
Sensitivity label "<name>" was not found at the destination tenant…	No destination label with exactly that name, or it isn't published to the migration account yet	Create or rename the label, publish it to the migration account, wait for it to appear, run again
Skipped: sensitivity label permissions are not provided on tenant <tenant id>…	Consent for the label permissions is missing on that tenant	Click Delegate Consent (or Delegate Re-Consent) on the Summary step with a Global Administrator, run again
The migration account does not have rights to decrypt this file…	The source migration account can't remove the encryption	Make it an Azure Rights Management super user on the source tenant, run again
This file (sensitivity label "<name>") could not be decrypted…	The source Rights Management service refused (for example a customer-managed key or license issue)	Check the source tenant's Rights Management setup; escalate if it persists
This file's permissions include "<user>", who has no matching user at the destination…	A person in a user-defined label has no destination account	Create or map the user (user mapping), run again
…could not be mapped to destination users, because the user mapping is not available yet…	User mapping wasn't ready for this file	Run the migration again
Source file was rights-protected but destination label "<name>" does not encrypt…	The destination label is less protective than the source	Make the destination label encrypt, or choose a matching label, then run again
…the label engine could not be started… — skipped and not uploaded…	The migration account couldn't sign in to the label service	Check its Purview Information Protection license and the consent, run again
Files arrived without their labels, no warnings	The label service couldn't start for the run (logs only)	Check the label policy and license for the migration account; escalate with the line item details
"Status: Pending Authorization" after switching option	Switching to or from this option resets consent	Give consent again on the Summary step
Labels not preserved on migrated files	The standard connector was used, or consent was not granted	Switch to the label connector, have an admin grant consent, re-run.
Consent prompt blocked for the migration account	UnifiedPolicy.User.Read or user_impersonation is not admin consented	Have a tenant admin grant admin consent for the connector app, then re-run.

Messages You May See

This section lists the messages you may see during migration and explains what each one means and how to respond.

Message	Meaning and action
The sensitivity label could not be processed (<error>)	Contact support with the file name and the error

Still need help?

Contact support and include:

the project name and the line item that shows the problem.
the exact message you see, copied as written.
the date and time of the run or pass.
a screenshot of the line item or screen.