Data Protection Issues

How to Apply Microsoft Purview Auto-Labeling to S/MIME Email

Rana Garcia Oct 10, 2026 868 views

Question details

The user needs to automatically apply a Microsoft Purview sensitivity label to incoming emails that use S/MIME encryption, specifically to restrict recipients from forwarding the message to third parties.

How to Apply Microsoft Purview Auto-Labeling to S/MIME Email

Product: Microsoft Purview
Device & OS: not provided
Scenario: Configuring enterprise email policies to prevent the unauthorized forwarding of securely encrypted S/MIME communications.
Observed behavior: The goal is to have the system automatically assign a restrictive sensitivity label when an S/MIME-encrypted email is received, enforcing policies without manual user intervention.

Before you start

Ensure you have Microsoft Purview administrator privileges and access to the Exchange Online PowerShell module before attempting to configure or modify sensitivity label policies.

Solution 1Recommended

Configure Auto-Labeling via Microsoft Purview Portal

Set up sensitivity labels and auto-labeling rules directly through the Microsoft Purview compliance portal to restrict forwarding on encrypted messages.

Using the Purview compliance portal is the safest and most visual method to manage your organization's data protection policies. Auto-labeling for S/MIME depends on your specific tenant configurations and supported encryption conditions.

Access the Compliance Portal

Navigate to Information Protection

Go to 'Solutions' in the left-hand menu, select 'Information protection', and then click on the 'Auto-labeling' tab.

Create a New Policy

Click 'Create auto-labeling policy' and select Exchange as the primary location for the policy deployment.

Define Conditions and Apply the Label

Set up advanced rules to detect S/MIME encryption characteristics, then map these conditions to your pre-configured sensitivity label that explicitly restricts the forwarding action.

Configure Auto-Labeling via Microsoft Purview Portal

Policy Application Time: New auto-labeling policies may initially run in simulation mode and can take up to 24 hours to fully propagate across all Exchange Online mailboxes once activated.

Solution 2

Enforce Label Policies Using Exchange Online PowerShell

Use the Set-LabelPolicy PowerShell cmdlet to adjust existing label policies for encrypted emails if portal configurations are insufficient.

Free Microsoft Office alternative

Secure Your Local Documents with WPS Office

While Microsoft Purview handles enterprise-level Exchange policies, WPS Office is an excellent, free alternative for your everyday document creation and local file protection. It offers a lightweight experience, built-in document security, and high compatibility with Microsoft Office files.

1. Download the Installer: Visit the official WPS Office website to download the free installation package for your operating system.
2. Install the Suite: Run the downloaded executable file and follow the simple on-screen instructions to complete the setup.
3. Encrypt Your Documents: Open WPS Office, create or open a document, navigate to the 'Protect' or 'Review' tab, and select 'Encrypt' to secure your sensitive data.

Fully compatible with Microsoft Office formats including .docx, .xlsx, and .pptx.Built-in document encryption lets you password-protect sensitive files locally.Lightweight installation ensures fast performance without consuming heavy system resources.Familiar user interface allows for a seamless, zero-learning-curve transition from Microsoft Office.

microsoft office alternative - wps office

Frequently Asked Questions

Can I automatically assign a sensitivity label to all incoming encrypted emails?

Yes, administrators can configure auto-labeling policies in Microsoft Purview to detect specific encryption attributes, such as S/MIME, and automatically apply a corresponding sensitivity label upon receipt.

Why isn't my sensitivity label blocking the forwarding of emails?

The sensitivity label itself must be explicitly configured to restrict permissions. You need to check the label's usage rights in the Purview portal and ensure that the 'Forward' permission has been removed for the intended recipients.

Does the Set-LabelPolicy PowerShell command take effect immediately?

No. Changes made to label policies, whether through PowerShell or the Microsoft Purview compliance portal, can take up to 24 hours to replicate and enforce across all users in the organization.

Microsoft Office Security Issues