Sensitivity labels: a rollout that protects data without paralysing users
Microsoft Purview sensitivity labels classify documents and emails and attach protection that travels with them. On paper it is simple. In practice, an overly detailed taxonomy or poorly anticipated encryption is enough to derail the project.
A short, understandable taxonomy
The first mistake is to replicate a twenty-level classification policy. Users should be able to pick a label in two seconds. Four or five top-level labels are usually enough, for example:
- Public: information meant for publication.
- General: everyday internal use, no technical protection.
- Confidential: restricted distribution, possibly with visual marking.
- Highly confidential: encryption and access limited to named people.
Sublabels can refine a level (for example "Confidential – Internal" and "Confidential – Partners"), but every addition should answer a real need.
Encryption and its side effects
A label can apply encryption based on Azure Rights Management. Protection then travels with the file, even outside Microsoft 365. That is powerful, but not free of consequences:
- co-authoring of encrypted files must be explicitly enabled in the tenant, and not every client supports it equally;
- some third-party applications, older Office clients or archiving tools cannot open encrypted content;
- external recipients must be able to authenticate, which depends on their own environment;
- services that inspect content (search, eDiscovery, DLP, Copilot) depend on the usage rights the label grants.
Reserve encryption for the highest levels and test it against your real scenarios before rolling it out widely.
Default and automatic labelling
A label policy can apply a default label to new documents and emails, and require a justification when users lower a label. A default "General" label ensures no content stays unclassified.
Auto-labelling, either client-side (a recommendation in the app) or service-side (applied to files already stored in SharePoint, OneDrive or Exchange), relies on sensitive information types. These capabilities depend on your licence level and evolve regularly: check what your subscription covers and start in simulation mode.
Container labels
Once support is enabled for groups and sites, labels can be applied to a Teams team, a Microsoft 365 group or a SharePoint site. They do not classify the files inside; they drive the container's settings: public or private privacy, guest access, external sharing, access from unmanaged devices. It is an effective way to enforce consistent governance from the moment a team is created.
Train, then measure
No technology replaces user understanding. A short training session, concrete examples per business unit and clear tooltips in each label's description do more for adoption than any automatic rule. Then track usage in Activity explorer: which labels are applied, which are downgraded, and by whom.
Tip. Roll out labels without encryption to a pilot group first, then add protection level by level. A classification label is easy to fix; thousands of encrypted files that a business process can no longer read are much harder to recover from.
What an audit checks
- The number of published labels and the clarity of their descriptions.
- Whether a default label and downgrade justification are configured.
- Encryption settings and the usage rights granted.
- Whether labels are enabled for groups and sites, and how they are configured.