diff --git a/main/models/label.py b/main/models/label.py
index 039dbe4d9cdd8a239b566f4415610cea5f737f56..abcaffdaeab2a86011ad48df3a10bdd65272cd97 100644
--- a/main/models/label.py
+++ b/main/models/label.py
@@ -21,7 +21,7 @@ import cachetools
 # NOC modules
 from noc.core.model.decorator import on_save, on_delete
 from noc.main.models.remotesystem import RemoteSystem
-from noc.models import get_model, is_document
+from noc.models import get_model, is_document, LABEL_MODELS
 
 
 MATCH_OPS = {"=", "<", ">", "&"}
@@ -132,12 +132,35 @@ class Label(Document):
     def on_save(self):
         if self.is_scoped and not self.is_wildcard and not self.is_matched:
             self._ensure_wildcards()
+        # Check if unset enable and label added to model
+        if hasattr(self, "_changed_fields"):
+            for model_id, setting in LABEL_MODELS.items():
+                if setting in self._changed_fields and not getattr(self, setting):
+                    r = self.check_label(model_id, self.name)
+                    if r:
+                        raise ValueError(f"Referred from model {model_id}: {r!r} (id={r.id})")
 
     def on_delete(self):
         if self.is_wildcard and any(Label.objects.filter(name__startswith=self.name[:-1])):
             raise ValueError("Cannot delete wildcard label with matched labels")
         if self.is_builtin and not self.is_matched:
             raise ValueError("Cannot delete builtin label")
+        # Check if label added to model
+        for model_id, setting in LABEL_MODELS.items():
+            if not getattr(self, setting):
+                continue
+            r = self.check_label(model_id, self.name)
+            if r:
+                raise ValueError(f"Referred from model {model_id}: {r!r} (id={r.id})")
+
+    @classmethod
+    def check_label(cls, model, label_name):
+        model_ins = get_model(model)
+        if is_document(model_ins):
+            label = label_name
+        else:
+            label = [label_name]
+        return model_ins.objects.filter(**{"labels__contains": label}).first()
 
     @staticmethod
     def get_wildcards(label: str) -> List[str]:
diff --git a/models.py b/models.py
index 5cc206e05cc8c46b6210ee61f2e9184252db7058..77d2a7e869abd09be5df13bc45d2539b4c61de3c 100644
--- a/models.py
+++ b/models.py
@@ -377,3 +377,57 @@ COLLECTIONS = [
     "bi.Dashboard",
     "cm.ConfDBQuery",
 ]
+
+# Model -> Setting
+LABEL_MODELS = {
+    "pm.Agent": "enable_agent",
+    "sa.Service": "enable_service",
+    "sa.ServiceProfile": "enable_serviceprofile",
+    "sa.ManagedObject": "enable_managedobject",
+    "sa.ManagedObjectProfile": "enable_managedobjectprofile",
+    "sa.AdministrativeDomain": "enable_administrativedomain",
+    "sa.AuthProfile": "enable_authprofile",
+    "sa.CommandSnippet": "enable_commandsnippet",
+    #
+    "inv.AllocationGroup": "enable_allocationgroup",
+    "inv.NetworkSegment": "enable_networksegment",
+    "inv.Object": "enable_object",
+    "inv.ObjectModel": "enable_objectmodel",
+    "inv.Platform": "enable_platform",
+    "inv.ResourceGroup": "enable_resourcegroup",
+    "inv.Sensor": "enable_sensor",
+    "inv.SensorProfile": "enable_sensorprofile",
+    #
+    "crm.Subscriber": "enable_subscriber",
+    "crm.SubscriberProfile": "enable_subscriberprofile",
+    "crm.Supplier": "enable_supplier",
+    "crm.SupplierProfile": "enable_supplierprofile",
+    #
+    "dns.DNSZone": "enable_dnszone",
+    "dns.DNSZoneRecord": "enable_dnszonerecord",
+    #
+    "gis.Division": "enable_division",
+    "kb.KBEntry": "enable_kbentry",
+    #
+    "ip.Address": "enable_ipaddress",
+    "ip.AddressProfile": "enable_addressprofile",
+    "ip.AddressRange": "enable_ipaddressrange",
+    "ip.Prefix": "enable_ipprefix",
+    "ip.PrefixProfile": "enable_prefixprofile",
+    "ip.VRF": "enable_vrf",
+    "ip.VRFGroup": "enable_vrfgroup",
+    #
+    "peer.AS": "enable_asn",
+    "peer.ASSet": "enable_assetpeer",
+    "peer.Peer": "enable_peer",
+    #
+    "vc.VC": "enable_vc",
+    "vc.VLAN": "enable_vlan",
+    "vc.VLANProfile": "enable_vlanprofile",
+    "vc.VPN": "enable_vpn",
+    "vc.VPNProfile": "enable_vpnprofile",
+    #
+    "sla.SLAProbe": "enable_slaprobe",
+    "sla.SLAProfile": "enable_slaprofile",
+    "fm.ActiveAlarm": "enable_alarm",
+}