New in ShareGate: Simplify sensitivity label migration in Microsoft 365

Stop losing the security net on your most sensitive data during Microsoft 365 migrations. ShareGate’s new sensitivity‑label migration keeps every Microsoft Purview label—and its encryption, key, and permissions—right where it belongs.

Ensuring your data stays secure during a migration isn’t just a task for organizations in high-compliance industries like finance and legal. Anyone that’s moving data likely has some sensitive information—the company payroll, details on the last acquisition—that you don’t want Copilot surfacing in its answers to end-user queries.  

With ShareGate, you can move content in minutes—not days—close compliance gaps, and keep regulators (and your CISO) happy.

Read on to see why labels go missing in most tools, how ShareGate fixes it, and the exact five‑click workflow that turns a high‑risk chore into a drag‑and‑drop breeze

Why Microsoft Purview sensitivity labels matter

A Microsoft Purview sensitivity label is a digital “classified” stamp that travels with each file or email, carrying its encryption and access rules wherever that content lands — and every M365 service, from Copilot to DLP, respects it. Hybrid work, scattered tenants, and AI rollouts make losing that stamp in transit a growing liability, while regulators keep tightening the screws.

We recently surveyed 650 IT pros, and they consistently listed security (64%) and compliance (43%) as their top reasons for migrating Microsoft 365— yet many still burn hours manually re‑applying lost labels after each move.

Lose a label and you risk losing control of your data. Preserve them automatically and you stay secure, audit‑ready, and Copilot‑ready — minus the tedious rework. That’s the gap ShareGate’s new automated label‑migration feature closes.

What makes sensitivity label migration hard—and how ShareGate fixes it

Many migration tools still don’t have full API‑level support for Microsoft Information Protection (MIP). When those tools meet a file that’s been encrypted or tagged with a sensitivity label, they copy the file—but leave the label behind. That forces you to break out PowerShell or the MIP SDK afterward to re‑apply protections, adding risk and extra work. Neither choice is ideal:

• Compliance gaps. Encryption and permissions disappear in transit, opening the door to accidental oversharing and failed audits.

• Operational drag. Teams burn hours hunting unlabeled files and manually re‑applying protections—time that should be spent on higher‑value work.

• Business risk. Move encrypted files between tenants without breaking keys or forcing risky work‑arounds. One mis‑handled contract or patient record can trigger fines, lawsuits, or reputation damage that’s hard to shake.

That’s why we built ShareGate’s automated sensitivity label migration. ShareGate now integrates the MIP APIs up front to move both the file and its label in one pass, so nothing slips through the cracks.  

With a single checkbox, we preserve every Microsoft Purview label—along with the encryption keys and access rules behind it—no matter how complex your move:

• Tenant‑to‑tenant, within‑tenant, or both. We auto‑detect labels, map them for you, and let you tweak any edge cases in a simple drop‑down.

• Drag‑and‑drop simplicity with enterprise‑grade compliance. No scripts, no cleanup, no surprises.

• Instant Copilot readiness. Your data lands fully labeled, so AI can safely surface the right content without exposing the wrong stuff.

In short, we keep the security you’ve already put in place working exactly as intended—while you focus on bigger wins. Want to test it in your own environment? Start your 15-day free trial and see how ShareGate handles sensitivity labels automatically.

Step-by-step walkthrough of migrating sensitivity labels with ShareGate

Ready to turn label migration from an all‑day slog into a five‑click breeze? Here’s exactly what happens once you open ShareGate’s copy wizard—no PowerShell, no cleanup, just a checkbox and go.

1. Pick your source

From a whole tenant down to a single document library—ShareGate inventories every file, folder, and their attached Purview labels.

2. Choose your destination

Merge into a new tenant, consolidate sites, or reshuffle a team; the workflow is identical.

3. Check Preserve sensitivity labels

One checkbox activates ShareGate’s auto‑mapping engine:

1. We pull each label’s GUID, name, and encryption settings.

2. We look for an exact match in the destination first.

3. If the names differ but the GUIDs match (e.g., you renamed “Confidential” to “Internal ‑ HR”), we still map them 1‑to‑1.

4. Hierarchical labels? We match the nearest parent/child with the same protection level, so “Finance | Payroll” won’t slip to an “Internal Only” catch‑all.

4. Fine‑tune (if you want)

Need exceptions for a carve‑out or brand‑new taxonomy? Click Edit Mapping to:

1. Redirect any source label to a different destination label via a simple drop‑down.

2. Bulk‑remap dozens at once with search‑and‑select.

3. Preview changes before they go live—full audit trail included.

5. Hit Copy

ShareGate moves the content, re‑applies each label in‑flight, and logs the result. No orphaned permissions, no encryption mismatches, no clean‑up sprints.

Why your auditor cares

Your auditor’s going to ask questions. With ShareGate, you’ve got answers—backed clear reporting, reliable label handling, and no messy workarounds.

• Microsoft‑native logic – we honor Purview encryption keys, scope rules, and preserve DLP and eDiscovery settings, so labels behave identically post‑move.

• Edge‑case proof – Handle renamed labels, split hierarchies, or cross‑geo tenants without script gymnastics.

• Instant visibility – Exportable reports show every label’s before/after state for audit teams.

Bottom line: whether you accept the auto‑map or tweak a few outliers, the entire process stays drag‑and‑drop simple—yet enterprise‑grade compliant.

BONUS: Microsoft MVP Jasper Oosterveld reveals how Purview sensitivity labels—and ShareGate—keep Microsoft 365 secure, compliant, and Copilot‑ready in our webinar.

What’s next for worry‑free migrations

Security doesn’t end with the last file copied—and neither does ShareGate. Automated sensitivity‑label migration is just one step in our roadmap to safer, smarter moves: soon we’ll be releasing bulk label edits, Purview policy migration, and full on‑prem support next. Pair that with our proven migration engine and you get the fastest path to a cleaner, compliant, Copilot‑ready Microsoft 365.

Ready to migrate without losing sleep (or labels)? Book a ShareGate demo and see it how it works.

‍

‍