Your auto-labeling policy is not labelling anything

You build an auto-labeling policy, point it at SharePoint, run simulation, and it matches almost nothing. Or it matches plenty in simulation and still labels nothing once it is on.

The instinct is to go back and loosen the conditions. Usually that is the wrong end of the problem. Auto-labeling has a set of eligibility rules that live on the label, not the policy, and when a label fails them Purview does not warn you. In one case it quietly turns the setting off on your behalf.

This is the one that catches experienced people, because the label demonstrably works. It applies on email, so the label must be fine, so the problem must be the policy.

If your policy covers SharePoint or OneDrive and the label applies encryption, the label has to be set to assign permissions now, and user access to content must never expire. Both conditions, not one.

If your policy is Exchange only, the rules relax. The label can assign permissions now, or it can let users assign them, which covers Do Not Forward and Encrypt-Only.

So a label configured with Do Not Forward, or with access that expires after 30 days, will label email all day long and never touch a single file in SharePoint. Nothing in the policy wizard points this out.

Regardless of location, these are excluded:

A parent label that has sublabels. Purview cannot apply a parent label to content, so selecting one in a policy produces a policy that can never do anything. Select the sublabel instead, and publish both.

A label that applies S/MIME protection. Excluded from auto-labeling outright.

Conditions using only EDM classifiers. This is the sneakiest one: if the only sensitive information types on the label are exact data match, Purview turns the auto-labeling setting off by itself. The fix is to include at least one non-EDM information type alongside it.

Conditions using only trainable classifiers. The option to create the auto-labeling policy simply never appears. If you mix trainable classifiers with sensitive info types, you get a policy built for the info types only, and the classifier part is quietly dropped.

Once the label is eligible, the policy still has to get through these:

Simulation is mandatory and slow. You cannot turn a policy on until it has run at least one simulation, and a run can take around 12 hours.

There is a ceiling of 4,000,000 matched files. Go over it and you are blocked from turning the policy on at all. You have to narrow the scope and run simulation again.

It can switch itself on. If you leave the option ticked and then do not edit the policy for 7 days, it goes live on its own.

Sensitive information types are not retrospective. A SIT only matches content created or modified *after* that information type existed. Testing a brand new custom SIT against last year's documents will find nothing, and the policy is behaving correctly.

Some files are skipped. Anything open or checked out at the time the policy runs is passed over, which includes every file in a library that requires check-out.

Visual markings do not come with the label. Headers, footers, and watermarks are not applied by auto-labeling, even though the label carries them.

For SharePoint and OneDrive, sensitivity labels must be enabled for Office files in those services before anything can be labelled there.

The auto-labeling wizard does not verify this. It will let you build the policy, include every SharePoint site, run a simulation, and turn it on, and nothing will be labelled. Check it first.

Then check what happens to content that already has a label. Auto-labeling replaces a lower-priority label that was applied automatically, but never replaces a higher-priority one. A manually applied label is left alone by default, and only overridden if you explicitly choose that setting and the new label has higher priority.