Update FAQ: label count limits and performance implications

- Clarify the 500-label hard limit applies to encrypted (protection) labels only
- Add performance warning for large label counts (policy generation time,
  sync time, memory usage)
- Call out elevated impact for service-based apps that cache policies for
  many users
- Add cross-reference to Purview Information Protection service limits doc

Fixes ADO #7333845

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: rybest

mip/develop/faqs-known-issues.md

@@ -4,7 +4,7 @@ description: Microsoft Information Protection (MIP) SDK FAQs and troubleshooting
 author: msmbaldwin
 ms.service: azure-information-protection
 ms.topic: troubleshooting
-ms.date: 04/10/2025
+ms.date: 05/05/2026
 ms.author: mbaldwin
 ---
 
@@ -15,7 +15,12 @@ This article provides answers to Frequently Asked Questions (FAQs), and troubles
 ## Frequently Asked Questions
 
 **Question** : How many labels are supported by MIP SDK?
-- MIP SDK can handle up to 500 protection labels, and there is no limit for labels without protection.
+- MIP SDK can handle up to 500 *encrypted* (protection) sensitivity labels. Labels that do not use encryption have no hard limit.
+
+  > [!IMPORTANT]
+  > The MIP SDK policy file includes **all labels in the tenant**, not only those scoped to the current user. As the total number of sensitivity labels in your tenant grows, performance may degrade even when you are below the 500-label hard limit. Large label counts increase policy generation time, policy fetch and sync time, and memory consumption. These effects are especially pronounced in **service-based applications** that initialize a policy engine for each user or that cache policies for a large number of users simultaneously.
+
+  For service-side limits that also apply to MIP SDK scenarios, see [Microsoft Purview Information Protection service limits](/purview/information-protection-limits).
 
 **Question** : Does MIP SDK support relabeling .pfile types with classification labels?
 - No, this is by design because pfiles are protected file types. Decrypt with the MPIP File Labeler before classification.