The policy saved fine. It even said “on.” What it didn’t do was cover the sites I actually cared about, and it took me longer than I’d like to admit to work out why: I’d walked into a scope ceiling. Roadmap item 570445 surfaced this week, and it’s aimed squarely at that ceiling — bigger SharePoint scopes, friendlier policy management, and better visibility into what the thing is doing. Before we get to what changed, let me explain what auto-labeling is, because the fix only makes sense once the mechanism does.
The night-shift librarian
Picture a librarian who works after closing. Every night they walk the stacks, open books, and stamp a classification on the inside cover — “Public,” “Confidential,” “Highly Confidential.” They don’t write the book. They don’t judge whether it’s any good. They read what’s already on the page and apply the rule you gave them: if you see something that looks like a credit card number, stamp it Confidential.
That’s auto-labeling in Purview. A sensitivity label is the stamp. An auto-labeling policy is the librarian’s instruction sheet: which conditions to look for (sensitive info types, trainable classifiers, keywords) and which stamp to apply when they match. In SharePoint and OneDrive it runs service-side — no client, no user action — scanning documents already sitting at rest and labeling the ones that qualify. Users never see the librarian. They just notice the stamp appeared.
Two things make this genuinely useful. It’s retroactive — it labels content that was created long before anyone wrote a policy. And it’s tireless — nobody has to remember to classify a file. That’s also the trap. A tireless process pointed at the wrong shelves does a lot of nothing, very reliably.
What a “scope” is, and why size was the problem
The librarian can’t walk every room every night in a building the size of a large tenant. So the instruction sheet has a scope: the specific list of SharePoint sites and OneDrive accounts this policy is allowed to visit. You either say “all sites” or you hand over a defined set.
Here’s where enterprise tenants hit the wall. When you scope a policy to specific sites, that list isn’t infinite. In a tenant with hundreds of thousands of sites — every Team creates one, every project spins one up — a curated scope can blow past the number of locations a single policy will accept. The librarian’s route sheet only has so many lines on it. Add site 501 (or wherever your particular ceiling sits) and it won’t fit.
The blunt version: at real enterprise scale, you couldn’t always express the coverage you needed in one policy. You worked around it by splitting policies, scoping to “all,” or accepting gaps. None of those are great. “All sites” is a sledgehammer; splitting policies multiplies the things you have to reason about; gaps are how a Confidential document ends up unlabeled in a site nobody remembered.
The roadmap item does not, as published, hand out a shiny new number. Don’t quote “500K sites” at anyone — I can’t confirm the exact new limit, and neither should you until it’s in the docs. What 570445 states is that the supported SharePoint scope is being expanded for large-scale deployments. Treat the specific figure as TBD and verify it in your own tenant once it lands.
The other two thirds: management and visibility
Scale is the headline, but two quieter improvements matter more day to day.
Policy management flexibility. When you run several auto-labeling policies, they can disagree. Two policies, two different labels, one document — who wins? Historically this has been opaque enough that admins resort to trial and error. The roadmap frames this as improved policy management and visibility for organizations running policies at scale. Read that as better handling of the multi-policy reality: clearer priority, clearer sense of which policy would act on a given location. I’d caution against assuming it introduces “multiple policies per label” or per-site delegation as brand-new concepts — the roadmap language is about managing what you already have more legibly, not rewriting the model. Confirm the specifics before you redesign anything.
One thing it is not: a change to how the librarian reads. The classification engine — the sensitive info types, the trainable classifiers, the match accuracy — is untouched. This is about which rooms the librarian can reach and how you keep track of the route, not about giving them better eyesight.
Richer reporting. The place to watch is Purview portal → Data classification → Activity explorer, plus the per-policy simulation and overview pages under Information protection → Auto-labeling. Activity explorer is your CCTV of the labeling process: it records label-applied, label-changed, and label-removed events, and lets you filter by location, label, and whether the action was automatic or user-driven. If the roadmap’s “richer reporting” delivers, expect more coverage-oriented metrics there — what got labeled, what was skipped, where policies overlap — rather than a new portal. Turn simulation on before you ever enforce; it shows you exactly what would be stamped without stamping anything.
Licensing and who gets it
Auto-labeling for data at rest in SharePoint and OneDrive is not a low-SKU feature. It requires the information protection premium tier — practically, that’s Microsoft 365 E5, E5 Compliance, or E5 Information Protection as a per-user license. 570445 is an enhancement to an existing E5-class capability; it doesn’t drop the price of admission. If you’re on E3, this conversation is still theoretical.
On timing: the roadmap item carries its own status and rollout window. I’m not going to invent a month for you — check the status field on the roadmap card and Message Center for the notification tied to this feature ID. Enhancements like this typically arrive as a phased, standard-release rollout rather than an opt-in preview, but let the card and your Message Center posts be the source of truth, not me.
Checking what your tenant actually has
Reporting features you’ll confirm in the portal. Scope limits you confirm by reading your current policies and their location counts, then watching whether a scope that previously wouldn’t save now does. Auto-labeling policies live in Security & Compliance PowerShell, so connect with Connect-IPPSSession — not the retired AzureAD or MSOnline modules.
That’s your baseline. When you want to change a scope — say, add a batch of reviewed site URLs pulled from a file you’ve eyeballed, never straight from a live query — dry-run it first:
If a scope that used to error on save now accepts your full list, you’ve got the expanded limit. That’s the real test — not a version string, but the ceiling quietly moving.
Auto-labeling doesn’t replace people classifying their own work; it catches the mountain of documents nobody ever will. The librarian was always good at their job. 570445 just gives them a longer route and a logbook you can actually read. Turn on simulation, watch Activity explorer for a week, and only then let the stamps land.
