As organizations increasingly adopt Microsoft Purview’s information data protection capabilities, sensitivity labels and encryption are becoming foundational elements of content security across Microsoft 365. These labels help control access (not only for users, but also for AI tools & agents such as Microsoft Copilot and SharePoint Agents – as explained in this Practical 365 article Securing Copilot for Microsoft 365), enforce data protection and maintain compliance with regulatory requirements.
However, until now, migrating content protected by sensitivity labels – especially those that apply encryption – was a significant challenge. Migration tools, both third party and native, couldn’t process protected content properly. Organizations had to either strip labels and remove encryption before migrating – posing serious security and compliance risks – or even exclude this content altogether, resulting in incomplete migrations.
With Quest On Demand Migration, that’s no longer the case.
We’re proud to announce full support for migrating content protected with sensitivity labels and encryption in Exchange Online (Mail), SharePoint Online (including content shared and managed within Microsoft Teams) and OneDrive for Business. This is a major step forward for secure, compliant, cloud-to-cloud migrations.
Why is this important?
Information protection in Microsoft 365 is no longer optional – it’s essential. But until now, securely migrating protected content was complicated, and often impossible, without making trade-offs.
The risks of traditional workarounds
- Removing labels and encryption from source
Removing protection before migration leaves sensitive data exposed – potentially violating internal governance policies and regulatory requirements like GDPR or HIPAA. It creates unnecessary risk during what should be a tightly controlled process.
- Losing labels on the target
When migrated without proper support, protected content may lose its sensitivity label entirely on the target. This strips away critical metadata used for classification and policy enforcement – undermining compliance and exposing content to unauthorized access.
- Excluding labeled/encrypted content
Choosing not to migrate protected files or emails results in incomplete migrations, broken workflows and missing records. This can delay transitions, create user frustration and lead to compliance gaps.
Why support for sensitivity labels matters for migrations
Quest On Demand Migration now offers secure and seamless migrations of content protected by Microsoft Purview sensitivity labels and encryption. Here's why this changes the game:
- Preserves security and compliance
- Encrypted emails and attachments, SharePoint and Microsoft Teams documents, and OneDrive files are migrated with labels and protections intact
- Maintains compliance posture throughout the migration process
- Eliminates the need to remove or weaken protection
- Complete migrations, no compromises
- Ensures nothing gets left behind – no more skipping encrypted emails or protected files
- Enables smooth transitions for users, with all content accessible post-migration as before
- Supports Microsoft’s Zero Trust principles
- Aligns with Microsoft’s security vision by maintaining end-to-end protection
- Enforces a least privilege, protection-first approach to data, even during migrations
- Streamlined, automated handling
- Quest handles the complexity of migrating protected content, so you don’t have to
- No need for manual decryption or relabeling – just a clean, secure transfer
How it works in Quest On Demand Migration
Getting started is easy. With our latest enhancements, migrating protected content in Exchange Online, SharePoint Online and OneDrive for Business is fully integrated into the standard migration workflow:
- Discover sensitivity labels prior to the migration
- Match/map all sensitivity labels from source to target
- Migrate protected emails and files with encryption and labels intact
- Verify successful migration, including label preservation and access retention
- Complete the transition with full auditability and compliance assurance
More technical guidance is available in our knowledge base article on Quest.com.
With this new capability, Quest On Demand Migration becomes one of the few solutions on the market that fully supports Microsoft Purview sensitivity labels and encryption in cloud-to-cloud migrations. This is a huge value add for organizations that care about security and compliance as much as efficiency.
Whether you're migrating for an M&A project, divestiture or tenant consolidation, you no longer need to choose between protection and progress.
Ready to start your secure migration?
Don’t let sensitivity labels slow you down. With Quest On Demand Migration, you can move fast without compromising security.
Ready to make your Microsoft 365 migration more secure and compliant? Try Quest On Demand and leverage the benefits of including sensitivity labels and encryption in your migration today!
For more details, check out our documentation or reach out to our support team.
