Januseal to Microsoft Sensitivity label migraiton

There is no single turnkey tool that automatically migrates labels from a third‑party solution such as Januseal into Microsoft Purview sensitivity labels. The migration is typically a two‑part effort:

1. Design and configure Purview sensitivity labels and DLP
   Use Microsoft Purview Information Protection to define the target labeling and DLP model:
   • Create sensitivity labels, label groups, and policies in the Microsoft Purview portal. Label groups can be used to organize labels and reduce deployment complexity, especially if moving to the modern label scheme. See the guidance for creating labels and label groups, including label priority and grouping behavior.
   • If parent labels are still in use, migrate them to the modern label scheme (label groups) using the Purview portal when the migration banner is available. This simplifies organization and avoids complex parent‑label behavior.
   • Configure DLP policies in Purview that enforce the required protections once content is labeled. If migrating from another DLP platform (for example, Symantec or Forcepoint), the Microsoft Purview DLP migration assistant can help with policy migration (see below), but it does not migrate third‑party labels on files.
2. Apply Microsoft sensitivity labels to existing data at scale
   For ~35 TB of data, labeling must be automated and policy‑driven:
   • Use the Microsoft Purview Information Protection capabilities
     Purview Information Protection supports:
     • Discovering and classifying sensitive information types (SITs).
     • Creating and applying sensitivity labels.
     • Discovering and labeling files at rest using the Microsoft Purview Information Protection scanner.
     • Automatically publishing labels using policies and auto‑labeling for files and emails.
   • Automatic labeling behavior
     Auto‑labeling policies can apply or upgrade labels based on content. Key behaviors:
     • Auto‑labeling will not remove a label so that content becomes unlabeled.
     • Auto‑labeling can replace a lower‑priority label that was automatically applied or set as a default, but not a higher‑priority label.
     • Manually applied labels are not overridden by default; for auto‑labeling policies, there is a configurable setting to override a manually applied lower‑priority label. This allows gradual rollout where existing Microsoft labels are preserved or upgraded while new policies label previously unlabeled content.
   • SharePoint/OneDrive and migration APIs
     If content is being moved into Microsoft 365 (SharePoint/OneDrive) as part of the migration:
     • The SharePoint Migration API cannot apply sensitivity labels to files and folders. There is no parameter in that API to set labels during migration.
     • To have labels on migrated content, use the Microsoft Information Protection (MIP) SDK to apply sensitivity labels to files either before or after migration.
     • If Azure Information Protection labels are in use, they must be migrated to unified sensitivity labels in the Purview compliance portal before using them with MIP SDK.
   • Microsoft Information Protection (MIP) SDK
     For large‑scale or custom automation scenarios (such as translating Januseal classifications into Purview labels), the MIP SDK is the primary extensibility option:
     • Configure the tenant and client environment for the MIP SDK.
     • Build or use tooling that reads existing metadata/classification from files and maps it to Purview sensitivity labels.
     • Apply labels programmatically to files at rest (on‑premises file shares, SharePoint, OneDrive, etc.).
3. DLP policy migration from other platforms (if applicable)
   If the existing environment uses Symantec or Forcepoint DLP (in addition to Januseal), the Microsoft Purview DLP migration assistant can help with policy migration:
   • It is a Windows‑based tool that ingests Symantec XML exports or Forcepoint backups, maps features, and creates equivalent Purview DLP policies via PowerShell.
   • It automatically creates custom Sensitive Information Types (SITs) in the tenant, including regexes and keywords, and generates rules with equivalent conditions and actions.
   • It can run policies in simulation mode so they do not affect live data while being validated.
   • After import, SITs and policies should be validated and fine‑tuned in the Purview portal. This tool accelerates DLP policy migration but does not migrate third‑party labels on content; labels still need to be applied via Purview labeling capabilities or the MIP SDK.
4. FastTrack guidance for large‑scale projects
   For large environments (like 35 TB), FastTrack can provide remote guidance on:
   • Activating and configuring the tenant for Purview Information Protection.
   • Data classification, SITs, and sensitivity labels.
   • Applying labels at scale (including scanner and auto‑labeling).
   • Installing and configuring the Purview DLP migration assistant.
   • Fine‑tuning migrated policies and monitoring protection.

In practice, a migration from Januseal to Microsoft Purview sensitivity labels typically combines:

• Design of a new Purview label and DLP model.
• Automated labeling of existing data using Purview auto‑labeling, the Information Protection scanner, and/or the MIP SDK.
• Optional use of the Purview DLP migration assistant if Symantec/Forcepoint DLP policies are part of the legacy environment.

References:

• Migrate parent sensitivity labels to label groups
• Create and configure sensitivity labels and their policies
• Automatically apply a sensitivity label to Microsoft 365 data
• Sensitivity Labels and the SharePoint Migration API
• Learn about the Microsoft Purview Data Loss Prevention migration assistant for Symantec and Forcepoint
• Use the Microsoft Purview Data Loss Prevention migration assistant for Symantec and Forcepoint
• Microsoft Purview