The mmd.config definition for the policy label did not contain Microsoft. One of our big customers raised a concern between the name in documentation and the actual policy within the tenant.