---
name: Purview Label Coverage
description: Scans SharePoint libraries for the proportion of documents carrying a Purview sensitivity label and flags libraries with unlabelled sensitive content.
---

# Purview Label Coverage

> **TL;DR:** This skill scans SharePoint document libraries and reports the proportion of documents carrying a Microsoft Purview sensitivity label, flagging libraries with high concentrations of unlabelled sensitive content such as contracts, invoices, and HR records.

## How does the Purview Label Coverage skill measure sensitivity labelling?

This skill scans the document libraries in the sites in scope and reports the proportion of documents that carry a Microsoft Purview sensitivity label versus those that do not. It examines metadata only, calculates coverage per library, and identifies libraries with high concentrations of unlabelled sensitive content — contracts, invoices, HR records, and financial spreadsheets — that should carry a label but currently do not. It supports Essential Eight ML2 evidence relating to data classification controls.

## When should you run this skill?

- "Check Purview label coverage"
- "Where are our unlabelled documents?"
- "Run a sensitivity label gap report"

## How this skill works, step by step

1. Enumerate document libraries in the sites in scope
2. For each library, count: total documents, labelled documents, unlabelled documents
3. Within unlabelled, flag content types that strongly suggest sensitivity: contracts, invoices, HR records, financial spreadsheets
4. Calculate coverage % per library
5. Rank libraries with coverage below 70% as priority for remediation

## Output format

| Site | Library | Total | Labelled | Unlabelled | Coverage % | Priority |

Followed by a summary:

- Average label coverage: N%
- Libraries below 70%: N
- Estimated sensitive-content gaps: N

## Scope and safety

Read-only — metadata only. This skill does NOT:

- Apply sensitivity labels (read-only — remediate with Microsoft Purview auto-labelling policies)
- Open or read document contents (metadata only)
- Make Purview admin centre changes

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Purview sensitivity labels applied to SharePoint and Office files | Microsoft 365 E3 (manual and default labelling) |
| Automatic and recommended labelling for remediation | Microsoft 365 E5 or E5 Compliance |

### Least-privilege roles

- Global Reader — read-only visibility of SharePoint sites and document metadata
- Compliance Data Administrator — read access to Purview sensitivity label configuration where label policy detail is required

### Microsoft Graph permissions (read-only)

- `Sites.Read.All` — enumerates SharePoint document libraries and reads file metadata, including the applied sensitivity label
- `InformationProtectionPolicy.Read.All` — reads the organisation sensitivity label definitions so coverage can be reported against the published labels

Sensitivity label configuration is administered in the Microsoft Purview portal; this skill only reads label state on files via Microsoft Graph and does not change any Purview settings.

## Sources and compliance

- Supports E8 ML2 evidence relating to data classification controls
- Pair with Microsoft Purview label policies for automated remediation
- Reference: [https://learn.microsoft.com/en-us/purview/sensitivity-labels](https://learn.microsoft.com/en-us/purview/sensitivity-labels)
- Output in Australian English