Sensitivity Labels Preparation Steps for SharePoint Sites Migrations

This article walks you through the preparation steps for the Delegate Permissions w/Sensitivity Label Support option. There are two scenarios, one for labels that don't encrypt and one for labels that do. Follow the one that matches your environment.

Terminology

• Sensitivity label. A tag, such as "Confidential," that your organization applies to files in Microsoft Purview. Some labels only mark the file. Others also encrypt it so that only specific people can open it.
• Label policy. Controls who can use a label. A label is only available to the users and accounts included in the policy that publishes it. You don't assign people to a label directly. You add the label to a policy and then choose who the policy applies to.
• Label scope. Defines where a label can be used, such as files, emails, or groups and sites. Because this migration moves files, every label needs the Files & other data assets scope.
• Service account. The account that signs in and grants consent to the MigrationWiz app and that MigrationWiz acts as during the migration. You need one service account on the source tenant and one on the destination tenant.

Before You Begin

These steps must be done on each tenant by someone who can manage sensitivity labels and label policies in Microsoft Purview. Microsoft supports the following role groups for creating and configuring labels and label policies:

• Information Protection
• Information Protection Admins
• Information Protection Analysts
• Information Protection Investigators
• Compliance Administrator
• Compliance Data Administrator
• Security Administrator
• A custom role group that includes the Sensitivity Label Administrator role

Review each role group's description in the Purview portal before you choose one. Microsoft recommends using the role with the fewest permissions needed and advises against using Global Administrator for this task.

• These roles are only needed to create and configure labels and label policies. They are not needed to apply labels.
• Start your preparation several days before the migration. Publishing labels usually takes 1 to 6 hours, but it can take up to 24 hours.
• MigrationWiz never copies a labeled file without its label. If a file's label can't be kept, the file is skipped and listed in the line item warnings. Fix the cause, then run the migration again.

Scenario 1. No Encrypted Files

Use these steps if your files carry sensitivity labels and none of those labels apply encryption.

1. List the labels in use. In Microsoft Purview on the source tenant, go to Solutions > Information Protection > Sensitivity labels. Write down the exact name of every label used on files in the sites you plan to migrate. For sub-labels, write down both the parent label and the sub-label (for example, "Confidential > Finance").
2. Create the same labels on the destination tenant. Create one label for each name on your list. Label names must match the source exactly as they appear in the Purview admin center, including capitalization. Sub-labels must sit under a parent label with the same name. Each label needs the Files & other data assets scope. MigrationWiz matches labels by name only, so other label settings can be different. See Appendix A for steps.
3. Assign a license. On both tenants, make sure the service account has a Microsoft Purview Information Protection license.
4. Add each service account to a label policy. On the source tenant, add the source service account to the label policies that publish all of the labels used by the files you are migrating. On the destination tenant, publish your new labels in a label policy that includes the destination service account. See Appendix B for steps.
5. Wait, then verify. Don't start the migration until the labels are available on the destination. Sign in as the destination service account and confirm you can see the labels. See Appendix D for steps.
6. Set up the MigrationWiz project.
   • Select Delegate Permissions w/Sensitivity Label Support on both the Source step and the Destination step, and enter the Tenant ID for each. This option must be selected for both tenants.
   • On the Summary step, click Delegate Consent for the source and the destination, and sign in with the service account for each tenant. The service account needs the Application Administrator role at this point. You can remove the role once consent succeeds.
   • When consent is complete, each side shows Status: Authorized.

Scenario 2. Some Files are Encrypted

Use these steps if any of the labels on your files apply encryption. This scenario includes everything from Scenario 1, plus the extra requirements for encrypted files.

1. List the labels in use. In Microsoft Purview on the source tenant, go to Solutions > Information Protection > Sensitivity labels. Write down the exact name of every label used on files in the sites you plan to migrate. For sub-labels, write down both the parent label and the sub-label (for example, "Confidential > Finance").
2. Identify which labels encrypt. Open each label on your list, check its encryption setting, and mark the ones that encrypt.
3. Create the same labels on the destination tenant. Create one label for each name on your list. Label names must match the source exactly as they appear in the Purview admin center, including capitalization. Sub-labels must sit under a parent label with the same name. Each label needs the Files & other data assets scope. See Appendix A for steps.
4. Turn on encryption for the matching destination labels. Every label that encrypts at the source must have a matching destination label that also encrypts. If the destination label doesn't encrypt, MigrationWiz skips the file so its protection isn't lost.
5. Confirm who can open the files at the destination. The destination label controls access:
   • If an admin defines the permissions on the label, make sure the label gives your destination users access.
   • If users choose the permissions when they label a file, every person in the file's permissions needs a matching user account at the destination. Set up your user mapping first. Files that include people with no match are skipped.
6. Assign a license. On both tenants, make sure the service account has a Microsoft Purview Information Protection license.
7. Add each service account to a label policy. On the source tenant, add the source service account to the label policies that publish all of the labels used by the files you are migrating. On the destination tenant, publish your new labels in a label policy that includes the destination service account. See Appendix B for steps.
8. Make the source service account a super user. On the source tenant, assign the service account the Azure Rights Management super user role. Without it, MigrationWiz can't decrypt files for transfer. Only the source tenant needs this, the destination service account does not. See Appendix C for steps.
9. Wait, then verify. Don't start the migration until the labels are available on the destination. Sign in as the destination service account and confirm you can see the labels. See Appendix D for steps.
10. Set up the MigrationWiz project.
    • Select Delegate Permissions w/Sensitivity Label Support on both the Source step and the Destination step and enter the Tenant ID for each. This option must be selected for both tenants.
    • On the Summary step, click Delegate Consent for the source and the destination, and sign in with the service account for each tenant. The service account needs the Application Administrator role at this point. You can remove the role once consent succeeds.
    • When consent is complete, each side shows Status: Authorized.

What Happens to Encrypted Files During Migration

MigrationWiz decrypts each encrypted file during transfer, uploads it, and applies the destination label. The destination tenant then protects the file again with its own keys, so destination users with access can open it.

Appendix A. Create a Label on the Destination Tenant

Sign in with an account that has one of the roles listed in Before You Start.

1. Sign in to the Microsoft Purview portal at purview.microsoft.com.
2. Go to Solutions > Information Protection > Sensitivity labels.
3. Select + Create a label.
4. Enter the label name. It must match the source label exactly as it appears in the Purview admin center, including capitalization.
   • For sub-labels: Create the parent label first, using the same name as the source parent. Then select the parent label, select the ... (more actions) menu under Actions, select Create sublabel, and enter the sub-label name.
5. On the Define the scope for this label page, select Files & other data assets. You can select other scopes too. A label without the files scope can't be used on files.
6. Follow the prompts to configure the label settings. For a label that must encrypt (Scenario 2), turn on encryption in the label's access control settings and choose who gets access. For details, see Microsoft's article Restrict access to content by using encryption in sensitivity labels.
7. Finish creating the label. A new label isn't available to anyone until it's added to a label policy (see Appendix B).

Get-Label | Format-Table -Property DisplayName, Name, Guid, ContentType

Appendix B. Add the Service Account to a Label Policy

A person or account sees a label when the label is in a label policy that applies to that account. The service account needs to be covered by at least one policy that contains each label used. If a label is in more than one policy, one policy is enough. 

Microsoft recommends assigning policies to a group instead of individual accounts. If you use a group, make sure the service account is a member. Supported group types in Microsoft Entra ID are:

• Email-enabled security groups
• Non-mail-enabled security groups
• Distribution groups
• Microsoft 365 groups

Option 1. Publish New Labels in a New Policy (Typically the Destination Tenant)

1. Sign in to the Microsoft Purview portal.
2. Go to Solutions > Information Protection > Publishing policies.
3. On the Label policies page, select Publish label to start the Create policy configuration.
4. On the Choose sensitivity labels to publish page, select the Choose sensitivity labels to publish link, select your labels, and then select Add. If your tenant uses the classic label scheme, also select the parent label whenever you select a sub-label.
5. For Assign admin units, keep Full directory unless your organization uses administrative units. If your account has administrative units assigned, you must select at least one.
6. When asked who the labels should be published to, select the service account or a group that contains it.
7. Follow the remaining prompts and finish. Finishing the configuration publishes the policy. There is no separate publish step.

Option 2. Add the Service Account to an Existing Policy (Typically the Source Tenant)

1. Go to Solutions > Information Protection > Publishing policies.
2. Select the policy that contains the labels used by the files you are migrating. If those labels are spread across several policies, the service account must be included in a policy for each label.
3. In the flyout pane, select Edit Policy. This opens the same configuration used in Option 1.
4. Leave the labels unchanged. On the page that sets who the policy applies to, add the service account or a group that contains it. Keep all existing users and groups in place.
5. Finish the configuration. Changes replicate to the selected users and services automatically.

Appendix C. Make the Source Service Account a Super User

This step is required for Scenario 2 only. It must be done in PowerShell by a Global Administrator of the source tenant, because there is no portal option for it.

1. Install the AIPService module (one time only):

   Install-Module -Name AIPService

2. Sign in to the source tenant:

   Connect-AipService

3. Confirm the service is active. The result should show Enabled.

   Get-AipService

4. Turn on the super user feature (it's off by default):

   Enable-AipServiceSuperUserFeature

5. Add the service account as a super user:

   Add-AipServiceSuperUser -EmailAddress "<service account email>"

6. Verify the result. The feature should show Enabled, and the service account should be listed.

   Get-AipServiceSuperUserFeature
   Get-AipServiceSuperUser

Appendix D. Verify the Labels Are Available

Complete these checks on the destination tenant after the labels are published and the waiting period has passed.

Option 1. Check as the Destination Service Account

Prerequisite 

Sensitivity labels must be enabled for files in SharePoint and OneDrive. This setting adds the Sensitivity button to Office for the web and allows SharePoint to process encrypted files. A Global Administrator can turn it on in either of these ways:

• In Purview, go to Solutions > Information Protection > Sensitivity labels and select Turn on now if the message appears.

• Run the following PowerShell command:

  Set-SPOTenant -EnableAIPIntegration $true

The setting takes about 15 minutes to apply.

Check as the Destination Service Account

1. Sign in to SharePoint on the destination tenant as the destination service account.
2. Open a document library and open a test Word, Excel, or PowerPoint file in Office for the web. Use a test file, not a production file.
3. On the ribbon, select Sensitivity.
4. Confirm that every label you created appears in the list. You can also select a file and view its Sensitivity setting in the library's details pane.
5. Close the file without applying a label.

Option 2. Check in PowerShell (Admin)

1. Install the Exchange Online Management module (one time only):

   Install-Module ExchangeOnlineManagement

2. Connect to Security & Compliance PowerShell:

   Connect-IPPSSession

3. List the labels and confirm that the names and scopes match the source:

   Get-Label | Format-Table -Property DisplayName, Name, Guid, ContentType

4. Check the label policy. The DistributionStatus value should show Success.

   Get-LabelPolicy -Identity "<policy name>" | Format-List

Additional Resources

• Microsoft Learn: Get started with sensitivity labels
• Microsoft Learn: Create and publish sensitivity labels
• Microsoft Learn: Enable sensitivity labels for files in SharePoint and OneDrive
• Microsoft Learn: Get-LabelPolicy