About Sensitivity Labels - Microsoft Purview (Compliance) (2023)

.

To get their jobs done, people in your organization collaborate with others inside and outside your organization. That means content no longer stays behind a firewall—it can roam anywhere, across devices, apps, and services. And you want roaming to be done in a safe and secure manner that conforms to your organization's business and compliance policies.

With Microsoft Purview Information Protection sensitivity labels, you can classify and protect your organization's data while ensuring that user productivity and their ability to collaborate are not hampered.

Example of available sensitivity labels in Excel from theAt homeTab on the ribbon. In this example, the applied label is displayed in the status bar:

To apply sensitivity labels, users must be signed in with their Microsoft 365 work or school account.

You can use sensitivity labels for the following:

• Deploy protection settings that include encryption and essence marks.For example, apply a "Confidential" label to a document or email, and that label will encrypt the content and add a "Confidential" watermark. Essence marks include headers, footers, and watermarks, and encryption can also limit what authorized people can do with the content.

• Protect content in Office apps across platforms and devices.Supported by Word, Excel, PowerPoint, and Outlook in the Office desktop apps and Office on the web. Supported on Windows, macOS, iOS and Android.

• Protect content in third-party apps and servicesby using Microsoft Defender for cloud apps. With Defender for Cloud Apps, you can discover, classify, label, and protect content in third-party apps and services like SalesForce, Box, or DropBox, even if the third-party app or service doesn't read or support sensitivity labels.

• protect containersThis includes Teams, Microsoft 365 Groups, and SharePoint sites. For example, set privacy settings, external user access and sharing, and access from unmanaged devices.

• Protect meetings and chats(in preview) by naming (and optionally encrypting) meeting invites and all responses, and enforcing Teams-specific options for the meeting and chat.

• Extend sensitivity labels to Power BI: Enabling this feature allows you to apply and view labels in Power BI and protect data when stored off-service.

  (Video) How to Implement & Manage Sensitivity Labels and Label Policies | Microsoft Purview | Microsoft365

• Extend sensitivity labels to assets in Microsoft Purview Data Map: Enabling this feature, currently in preview, will allow you to apply your sensitivity labels to files and schematized data objects in Microsoft Purview Data Map. Schematized datasets include SQL, Azure SQL, Azure Synapse, Azure Cosmos DB, and AWS RDS.

• Extend sensitivity labels to third-party apps and services.The Microsoft Information Protection SDK allows third-party apps to read sensitivity labels and apply protection settings.

• Flag content without using protection settings.You can also simply apply a label identifying the sensitivity of the data. This gives users a visual attribution of your organization's data sensitivity and allows them to use the labels to generate usage reports and view activity data for data with different sensitivity levels. Based on this information, you can later apply protection settings at any time.

In all of these cases, Microsoft Purview sensitivity labels can help you take the right action on the right content. Sensitivity labels enable you to identify the sensitivity of data across your organization, and the label can enforce protection settings appropriate to the sensitivity of that data. This protection then remains with the content.

For more information on these and other scenarios supported by sensitivity labels, seeCommon scenarios for sensitivity labels. New features are constantly being developed that support sensitivity flags, so you might find it useful to review those as wellMicrosoft 365-Roadmap.

What a sensitivity label is

When you assign a sensitivity label to content, it's like a stamp that's applied and means:

• Customizable.Specific to your organization and business needs, you can create categories for different levels of sensitive content in your organization. For example, Personal, Public, General, Confidential, and Strictly Confidential.

• plain text.Because a label is stored in plain text in the metadata for files and emails, third-party apps and services can read it and then apply their own protections when needed.

• persistent.Because the label is stored in metadata for files and emails, the label stays with the content no matter where it is saved or stored. The unique label identification becomes the basis for applying and enforcing policies that you configure.

When viewed by users in your organization, a sensitivity label appears like a tag on apps they use and can be easily integrated into their existing workflows.

A single sensitivity label can be applied to any item that supports sensitivity labels. Documents and emails can have both a sensitivity label and astorage labelapplied to them.

What sensitivity labels can do

After a sensitivity label is applied to an email, meeting invitation (in preview), or document, any configured protection settings for that label are enforced on the content. You can configure a sensitivity label for:

• encryptE-mails, meeting invitations and documents to prevent unauthorized persons from accessing this data. You can also choose which users or groups have permissions to perform what actions and for how long. For example, you can allow everyone in your organization to modify a document, while a specific group in another organization can only view it. Alternatively, instead of administrator-defined permissions, you can allow your users to assign permissions to the content when they apply the label.

  For more information about theencryptionFor settings when creating or editing a sensitivity label, seeRestrict access to content by using encryption in sensitivity labels.

• Mark the contentwhen you use Office apps by adding a watermark, header, or footer to email, meeting invitations, or documents that have the label applied. Watermarks can be applied to documents, but not emails or meeting invitations. Example header and watermark:

  

  Dynamic markings are also supported through the use of variables. For example, include label name or document name in header, footer or watermark. For more information, seeDynamic markers with variables.

  Need to check when essence marks are applied? SeeWhen Office apps apply content labeling and encryption.

  If you have templates or workflows based on specific documents, test those documents with your chosen essence marks before making the label available to users. Some string length limitations to be aware of:

  (Video) Microsoft Purview Sensitivity Labels

  Watermarks are limited to 255 characters. Headers and footers are limited to 1024 characters except in Excel. Excel has a total limit of 255 characters for headers and footers, but this limit includes characters that aren't visible, such as B. Formatting Codes. When this limit is reached, the entered string will not be displayed in Excel.

• Protect content in containers like sites and groupswhen you enable the featureUse sensitivity labels with Microsoft Teams, Microsoft 365 Groups, and SharePoint sites.

  You cannot configure protection settings for groups and sites until you enable this feature. This label configuration does not result in documents or emails being automatically labeled, rather the label settings protect content by controlling access to the container where content can be stored. These settings include privacy settings, external user access and sharing, and access from unmanaged devices.

• Automatically apply the label to files and emails or recommend a label.Choose how to identify sensitive information you want to label and the label can be applied automatically, or you can prompt users to apply the label you recommend. When you recommend a label, the prompt displays the text you chose. For example:

  

  For more information about theAuto labeling for files and emailsFor settings when creating or editing a sensitivity label, seeAutomatically apply a sensitivity label to contentfor office apps andLabeling in Microsoft Purview Data Map.

• Set the default sharing link typefor SharePoint sites and individual documents. To prevent over-sharing by users, set theDefault scope and permissionswhen users share documents from SharePoint and OneDrive.

Label scopes

When you create a sensitivity label, you are prompted to configure the scope of the label, which determines two things:

• Which label settings you can configure for this label
• Where the label is visible to users

This scope configuration allows you to use sensitivity labels that only apply to items such as documents and emails and are not selectable for containers. And also sensitivity labels, which only apply to containers and cannot be selected for documents and emails. You can also select the scope for schematized datasets for Microsoft Purview Data Map:

By default, theArticleScope (formerly namedFiles & Emails) is always selected. Optionally, you can include meetings with this scope for calendar events, teams meeting options, and team chat. The other areas are selected by default if the features are enabled for your tenant:

• Groups & Sites: SeeEnable container sensitivity labels and sync labels

• Schematized databases: SeeAutomatically label your content in Microsoft Purview Data Map

If you change the default settings so that all areas are not selected, you will see the first page of configuration settings for areas that you have not selected, but you will not be able to configure the settings. For example, if the Elements panel is not selected, you cannot select the options on the next page:

Select for these pages with unavailable optionsNextkeep going. Or chooseThe backto change the scope of the label.

Label priority (order matters)

When you create your sensitivity labels in the Microsoft Purview Compliance Portal, they appear in a list on thesensitivitytab on thelabelsSide. In this list, the order of the labels is important because it reflects their priority. You want your most restrictive sensitivity label, e.g. B. "Strictly Confidential" appears belowbottomof the list and your least restrictive sensitivity designation, such asabove.

You can assign only one sensitivity label to an item such as a document, email, or container. If you set an option that requires your users to provide a reason for changing a label to a lower classification, the order of this list identifies the lower classifications. However, this option does not apply to child labels that share the priority of their parent label.

The order of the sublabels is usedautomatic labeling, although. When you configure auto-label policies, there may be multiple matches for more than one label. Then the last sensitive label is selected and then, if applicable, the last child label. If you configure sub-labels yourself (instead of auto-labeling policies) for automatic or recommended labeling, the behavior is slightly different when sub-labels share the same parent label. For example, a sublabel configured for automatic labeling is preferred over a sublabel configured for recommended labeling. For more information, seeHow multiple conditions are evaluated when they apply to more than one label.

Sublabels (grouping labels)

Child labels allow you to group one or more labels under a parent label that a user sees in an Office app. For example, under Confidential, your organization may use several different labels for certain types of this classification. In this example, the parent label "Confidential" is simply a text label with no protection settings, and since it has child labels, it cannot be applied to content. Instead, users must select Confidential to see the sublabels, and then can select a sublabel to apply to the content.

Sublabels are simply a way of presenting labels to users in logical groups. Sublabels do not inherit any settings from their parent label, except for their label color. When you publish a sublabel for a user, that user can apply that sublabel to content and containers, but not just the parent label.

Don't select a parent label as the default label, and don't configure a parent label to be automatically applied (or recommended). Otherwise, the parent label cannot be applied.

Example of showing sublabels to users:

Edit or delete a sensitivity label

If you delete a sensitivity label from the admin portal, the label is not automatically removed from the content and all protection settings are still enforced on content that has that label applied.

When you edit a sensitivity label, the version of the label that was applied to content is enforced on that content.

What label guidelines can do

After you create your sensitivity labels, you must publish them to make them available to people and services in your organization. The sensitivity labels can then be applied to Office documents and emails and other items that support sensitivity labels.

Unlike retention labels, which are published to locations like all Exchange mailboxes, sensitivity labels are published to users or groups. Apps that support sensitivity labels can then show them to those users and groups as applied labels or as labels they can apply.

When you configure a label policy, you can:

• Choose which users and groups see the labels.Labels can be applied to any specific user or mail-enabled security group, distribution group, or Microsoft 365 group (which maydynamic membership) in Azure AD.

• Provide a default labelfor blank documents, emails and meeting invitations, new containers (if youEnabled sensitivity labels for Microsoft Teams, Microsoft 365 Groups, and SharePoint sites) and also a default name forPower BI content. You can specify the same label or different labels for all five item types. Users can change the default sensitivity label applied to better match the sensitivity of their content or container.

  note

  Default labeling for existing documents is now supported for built-in labeling for Office apps. For more information on the rollout per app and minimum versions, see theskill tablefor Word, Excel and PowerPoint.

  Consider using a default label to set a baseline level of protection that you want to apply to all of your content. However, without user training and other controls, this setting can also result in inaccurate labeling. It's usually not a good idea to choose a label that applies encryption to documents as the default label. For example, many organizations need to send and share documents with external users who may not have apps that support encryption or who may not be using an account that can be authorized. For more information about this scenario, seeShare encrypted documents with external users.

  Important

  If you haveSublabels, be careful not to configure the parent label as the default label.

• Request a justification for changing a label.If a user attempts to remove a label or replace it with a lower-numbered label, you can require that the user provide a reason for performing the action. Example: A user opens a document called Confidential (Order Number 3) and replaces that label with a document called Public (Order Number 1). For Office apps, this reason prompt is triggered once per app session when using built-in labeling and per file when using Azure Information Protection unified labeling client. Administrators can read in the justification reason along with the label changeActivity Explorer.

  

• Prompt users to apply a labelfor the different types of items and containers that support confidentiality tags. Also known as mandatory labeling, these options ensure that a label must be applied before users can save documents and send email or meeting invitations, create new groups or sites, and use unlabeled content for Power BI.

  For documents and emails, a label can be assigned manually by the user, automatically as a result of a condition you configure, or assigned by default (the default label option described earlier). Example of a prompt when a user needs to assign a label:

  

  You can find more information on the labeling requirement for documents and e-mails atRequire users to label their emails and documents.

  Containers must be labeled at the time the group or site is created.

  (Video) How to create and use sensitivity labels in Microsoft 365

  For more information about mandatory labeling for Power BI, seeMandatory labeling policy for Power BI.

  Consider using this option to increase the coverage of your lettering. However, without user training, these settings can result in inaccurate labeling. Additionally, mandatory labeling can frustrate your users with frequent prompts unless you set a default label to match as well.

• Provide a help link to a custom help page.If your users aren't sure what your sensitivity labels mean or how they should be used, you can provide a URL for more information that will appear at the bottom of thesensitivity labelMenu in the Office apps:

  

After you create a labeling policy that assigns new sensitivity labels to users and groups, users will see those labels in their Office apps. It can take up to 24 hours for the latest changes to be replicated across your organization.

There is no limit to the number of sensitivity labels you can create and publish, with one exception: if the label applies encryption that specifies the users and permissions, a maximum of 500 labels is supported with this configuration. However, as a best practice to reduce administrative overhead and complexity for your users, try to keep the number of labels to a minimum. Real deployments have been shown to be noticeably reduced when users have more than five major labels or more than five sub-labels per major label.

Label Policy Priority (Order Matters)

You make your sensitivity labels available to users by publishing them in a sensitivity label policy, which appears in a list on theLabel GuidelinesSide. Just like sensitivity labels (seeLabel priority (order matters)), the order of sensitivity label policies is important because it reflects their priority: the label policy with the lowest priority appears at the top of the listthe lowestOrder number, and the label policy with the highest priority is included at the end of the listhighestOrder number.

A label policy consists of:

• A set of labels.
• The users and groups to which the labeled policy will be assigned.
• The scope of the policy and policy settings for that scope (e.g. default label for files and emails).

You can include a user in policies with multiple labels, and the user gets all sensitivity labels and settings from those policies. If there is a conflict in the settings of multiple policies, the settings of the policy with the highest priority (highest ordinal number) are applied. In other words, the highest priority wins for each setting.

If you're not seeing the behavior of the labeling policy setting for a user or group that you expect, check the order of the sensitivity labeling policies. You may need to move the policy down. To reorder the label policies, select a sensitivity label policy > select the action ellipsis for that entry >move downorMove up. For example:

In our screenshot example showing three label policies, all users are assigned the default label policy, so it is appropriate that it has the lowest priority (lowest ordinal number 0). Only users in the IT department are assigned the second policy with ordinal number 1. For these users, if there are conflicting settings between their policy and the default policy, their policy's settings take precedence because they have a higher ordinal number.

Similarly for users in Legal who are assigned the third policy with different settings. It's likely that these users have stricter settings, so it's appropriate that their policy has the highest ordinal number. It is unlikely that a Legal user would belong to a group that is also assigned to the IT department policy. If this is the case, however, the ordinal number 2 (highest ordinal number) ensures that the settings of the legal department always have priority in the event of a conflict.

Sensitivity labels and Azure Information Protection

The sensitivity labels built into Microsoft 365 Apps on Windows, macOS, iOS, and Android look and behave very similar on those devices to give users a consistent labeling experience. However, on Windows computers, you can use the as wellAzure Information Protection (AIP)-Client. The AIP Office add-in component of this client is now integratedmaintenance modeand once installed is no longer the default labeling client for the latest Office apps.

If you're using the AIP add-in for labeling in Office apps, we recommend you switch to built-in labeling. For more information, seeMigrate the Azure Information Protection (AIP) add-in to built-in labeling for Office apps.

Azure Information Protection labels

Label management for Azure Information Protection labels in the Azure portal is deprecatedMarch 31, 2021. Learn more from the officerdepreciation note.

If your tenant is not already on theUnified labeling platform, you must first enable unified labeling before you can use sensitivity labels. See instructions belowHow to migrate Azure Information Protection labels to unified sensitivity labels.

Sensitivity labels and the Microsoft Information Protection SDK

Because a sensitivity label is stored in a document's metadata, third-party apps and services can read and write to that labeling metadata to supplement your labeling delivery. In addition, software developers can use theMicrosoft Information Protection-SDKFully support labeling and encryption capabilities across multiple platforms. For more information, seeAnnouncing general availability on the Tech Community Blog.

You can also find out about itPartner solutions integrated with Microsoft Purview Information Protection.

Deployment Guide

For deployment planning and guidance information that includes licensing information, entitlements, deployment strategy, a list of supported scenarios, and end-user documentation, seeStart with sensitivity labels.

For information on the use of sensitivity labels to comply with privacy regulations, seeProviding information protection for privacy regulations with Microsoft 365.