About Sensitivity Labels - Microsoft Purview (Compliance) (2023)

  • Article
  • 18 minutes to read



If you're looking for information about sensitivity labels you see in your Office apps, seeApply sensitivity labels to your files and emails in Office.

The information on this page is intended for IT administrators who can create and configure these labels.

To get their jobs done, people in your organization collaborate with others inside and outside your organization. That means content no longer stays behind a firewall—it can roam anywhere, across devices, apps, and services. And you want roaming to be done in a safe and secure manner that conforms to your organization's business and compliance policies.

With Microsoft Purview Information Protection sensitivity labels, you can classify and protect your organization's data while ensuring that user productivity and their ability to collaborate are not hampered.

Example of available sensitivity labels in Excel from theAt homeTab on the ribbon. In this example, the applied label is displayed in the status bar:

About Sensitivity Labels - Microsoft Purview (Compliance) (1)

To apply sensitivity labels, users must be signed in with their Microsoft 365 work or school account.


For US government tenants, sensitivity labels are supported for all platforms.

If you are using the Azure Information Protection unified labeling client and scanner, read theAzure Information Protection Premium Government Service Description.

You can use sensitivity labels for the following:

  • Deploy protection settings that include encryption and essence marks.For example, apply a "Confidential" label to a document or email, and that label will encrypt the content and add a "Confidential" watermark. Essence marks include headers, footers, and watermarks, and encryption can also limit what authorized people can do with the content.

  • Protect content in Office apps across platforms and devices.Supported by Word, Excel, PowerPoint, and Outlook in the Office desktop apps and Office on the web. Supported on Windows, macOS, iOS and Android.

  • Protect content in third-party apps and servicesby using Microsoft Defender for cloud apps. With Defender for Cloud Apps, you can discover, classify, label, and protect content in third-party apps and services like SalesForce, Box, or DropBox, even if the third-party app or service doesn't read or support sensitivity labels.

  • protect containersThis includes Teams, Microsoft 365 Groups, and SharePoint sites. For example, set privacy settings, external user access and sharing, and access from unmanaged devices.

  • Protect meetings and chats(in preview) by naming (and optionally encrypting) meeting invites and all responses, and enforcing Teams-specific options for the meeting and chat.

  • Extend sensitivity labels to Power BI: Enabling this feature allows you to apply and view labels in Power BI and protect data when stored off-service.

    (Video) How to Implement & Manage Sensitivity Labels and Label Policies | Microsoft Purview | Microsoft365

  • Extend sensitivity labels to assets in Microsoft Purview Data Map: Enabling this feature, currently in preview, will allow you to apply your sensitivity labels to files and schematized data objects in Microsoft Purview Data Map. Schematized datasets include SQL, Azure SQL, Azure Synapse, Azure Cosmos DB, and AWS RDS.

  • Extend sensitivity labels to third-party apps and services.The Microsoft Information Protection SDK allows third-party apps to read sensitivity labels and apply protection settings.

  • Flag content without using protection settings.You can also simply apply a label identifying the sensitivity of the data. This gives users a visual attribution of your organization's data sensitivity and allows them to use the labels to generate usage reports and view activity data for data with different sensitivity levels. Based on this information, you can later apply protection settings at any time.

In all of these cases, Microsoft Purview sensitivity labels can help you take the right action on the right content. Sensitivity labels enable you to identify the sensitivity of data across your organization, and the label can enforce protection settings appropriate to the sensitivity of that data. This protection then remains with the content.

For more information on these and other scenarios supported by sensitivity labels, seeCommon scenarios for sensitivity labels. New features are constantly being developed that support sensitivity flags, so you might find it useful to review those as wellMicrosoft 365-Roadmap.


If you are not an E5 customer, you can try all premium features in Microsoft Purview for free. Use the Purview Solutions 90-day trial to learn how robust Purview features can help your organization meet data security and compliance requirements. Start now at theMicrosoft Purview Compliance Portal Trials Hub. Find out details aboutRegistration and test conditions.

What a sensitivity label is

When you assign a sensitivity label to content, it's like a stamp that's applied and means:

  • Customizable.Specific to your organization and business needs, you can create categories for different levels of sensitive content in your organization. For example, Personal, Public, General, Confidential, and Strictly Confidential.

  • plain text.Because a label is stored in plain text in the metadata for files and emails, third-party apps and services can read it and then apply their own protections when needed.

  • persistent.Because the label is stored in metadata for files and emails, the label stays with the content no matter where it is saved or stored. The unique label identification becomes the basis for applying and enforcing policies that you configure.

When viewed by users in your organization, a sensitivity label appears like a tag on apps they use and can be easily integrated into their existing workflows.

A single sensitivity label can be applied to any item that supports sensitivity labels. Documents and emails can have both a sensitivity label and astorage labelapplied to them.

About Sensitivity Labels - Microsoft Purview (Compliance) (2)

What sensitivity labels can do

After a sensitivity label is applied to an email, meeting invitation (in preview), or document, any configured protection settings for that label are enforced on the content. You can configure a sensitivity label for:

  • encryptE-mails, meeting invitations and documents to prevent unauthorized persons from accessing this data. You can also choose which users or groups have permissions to perform what actions and for how long. For example, you can allow everyone in your organization to modify a document, while a specific group in another organization can only view it. Alternatively, instead of administrator-defined permissions, you can allow your users to assign permissions to the content when they apply the label.

    For more information about theencryptionFor settings when creating or editing a sensitivity label, seeRestrict access to content by using encryption in sensitivity labels.

  • Mark the contentwhen you use Office apps by adding a watermark, header, or footer to email, meeting invitations, or documents that have the label applied. Watermarks can be applied to documents, but not emails or meeting invitations. Example header and watermark:

    About Sensitivity Labels - Microsoft Purview (Compliance) (3)

    Dynamic markings are also supported through the use of variables. For example, include label name or document name in header, footer or watermark. For more information, seeDynamic markers with variables.

    Need to check when essence marks are applied? SeeWhen Office apps apply content labeling and encryption.

    If you have templates or workflows based on specific documents, test those documents with your chosen essence marks before making the label available to users. Some string length limitations to be aware of:

    (Video) Microsoft Purview Sensitivity Labels

    Watermarks are limited to 255 characters. Headers and footers are limited to 1024 characters except in Excel. Excel has a total limit of 255 characters for headers and footers, but this limit includes characters that aren't visible, such as B. Formatting Codes. When this limit is reached, the entered string will not be displayed in Excel.

  • Protect content in containers like sites and groupswhen you enable the featureUse sensitivity labels with Microsoft Teams, Microsoft 365 Groups, and SharePoint sites.

    You cannot configure protection settings for groups and sites until you enable this feature. This label configuration does not result in documents or emails being automatically labeled, rather the label settings protect content by controlling access to the container where content can be stored. These settings include privacy settings, external user access and sharing, and access from unmanaged devices.

  • Automatically apply the label to files and emails or recommend a label.Choose how to identify sensitive information you want to label and the label can be applied automatically, or you can prompt users to apply the label you recommend. When you recommend a label, the prompt displays the text you chose. For example:

    About Sensitivity Labels - Microsoft Purview (Compliance) (4)

    For more information about theAuto labeling for files and emailsFor settings when creating or editing a sensitivity label, seeAutomatically apply a sensitivity label to contentfor office apps andLabeling in Microsoft Purview Data Map.

  • Set the default sharing link typefor SharePoint sites and individual documents. To prevent over-sharing by users, set theDefault scope and permissionswhen users share documents from SharePoint and OneDrive.

Label scopes

When you create a sensitivity label, you are prompted to configure the scope of the label, which determines two things:

  • Which label settings you can configure for this label
  • Where the label is visible to users

This scope configuration allows you to use sensitivity labels that only apply to items such as documents and emails and are not selectable for containers. And also sensitivity labels, which only apply to containers and cannot be selected for documents and emails. You can also select the scope for schematized datasets for Microsoft Purview Data Map:

About Sensitivity Labels - Microsoft Purview (Compliance) (5)

By default, theArticleScope (formerly namedFiles & Emails) is always selected. Optionally, you can include meetings with this scope for calendar events, teams meeting options, and team chat. The other areas are selected by default if the features are enabled for your tenant:

  • Groups & Sites: SeeEnable container sensitivity labels and sync labels

  • Schematized databases: SeeAutomatically label your content in Microsoft Purview Data Map

If you change the default settings so that all areas are not selected, you will see the first page of configuration settings for areas that you have not selected, but you will not be able to configure the settings. For example, if the Elements panel is not selected, you cannot select the options on the next page:

About Sensitivity Labels - Microsoft Purview (Compliance) (6)

Select for these pages with unavailable optionsNextkeep going. Or chooseThe backto change the scope of the label.

Label priority (order matters)

When you create your sensitivity labels in the Microsoft Purview Compliance Portal, they appear in a list on thesensitivitytab on thelabelsSide. In this list, the order of the labels is important because it reflects their priority. You want your most restrictive sensitivity label, e.g. B. "Strictly Confidential" appears belowbottomof the list and your least restrictive sensitivity designation, such asabove.

You can assign only one sensitivity label to an item such as a document, email, or container. If you set an option that requires your users to provide a reason for changing a label to a lower classification, the order of this list identifies the lower classifications. However, this option does not apply to child labels that share the priority of their parent label.

The order of the sublabels is usedautomatic labeling, although. When you configure auto-label policies, there may be multiple matches for more than one label. Then the last sensitive label is selected and then, if applicable, the last child label. If you configure sub-labels yourself (instead of auto-labeling policies) for automatic or recommended labeling, the behavior is slightly different when sub-labels share the same parent label. For example, a sublabel configured for automatic labeling is preferred over a sublabel configured for recommended labeling. For more information, seeHow multiple conditions are evaluated when they apply to more than one label.

About Sensitivity Labels - Microsoft Purview (Compliance) (7)

Sublabels (grouping labels)

Child labels allow you to group one or more labels under a parent label that a user sees in an Office app. For example, under Confidential, your organization may use several different labels for certain types of this classification. In this example, the parent label "Confidential" is simply a text label with no protection settings, and since it has child labels, it cannot be applied to content. Instead, users must select Confidential to see the sublabels, and then can select a sublabel to apply to the content.

Sublabels are simply a way of presenting labels to users in logical groups. Sublabels do not inherit any settings from their parent label, except for their label color. When you publish a sublabel for a user, that user can apply that sublabel to content and containers, but not just the parent label.

Don't select a parent label as the default label, and don't configure a parent label to be automatically applied (or recommended). Otherwise, the parent label cannot be applied.

(Video) Deploy MIP Sensitivity Labels

Example of showing sublabels to users:

About Sensitivity Labels - Microsoft Purview (Compliance) (8)

Edit or delete a sensitivity label

If you delete a sensitivity label from the admin portal, the label is not automatically removed from the content and all protection settings are still enforced on content that has that label applied.

When you edit a sensitivity label, the version of the label that was applied to content is enforced on that content.

What label guidelines can do

After you create your sensitivity labels, you must publish them to make them available to people and services in your organization. The sensitivity labels can then be applied to Office documents and emails and other items that support sensitivity labels.

Unlike retention labels, which are published to locations like all Exchange mailboxes, sensitivity labels are published to users or groups. Apps that support sensitivity labels can then show them to those users and groups as applied labels or as labels they can apply.

When you configure a label policy, you can:

  • Choose which users and groups see the labels.Labels can be applied to any specific user or mail-enabled security group, distribution group, or Microsoft 365 group (which maydynamic membership) in Azure AD.

  • Provide a default labelfor blank documents, emails and meeting invitations, new containers (if youEnabled sensitivity labels for Microsoft Teams, Microsoft 365 Groups, and SharePoint sites) and also a default name forPower BI content. You can specify the same label or different labels for all five item types. Users can change the default sensitivity label applied to better match the sensitivity of their content or container.


    Default labeling for existing documents is now supported for built-in labeling for Office apps. For more information on the rollout per app and minimum versions, see theskill tablefor Word, Excel and PowerPoint.

    Consider using a default label to set a baseline level of protection that you want to apply to all of your content. However, without user training and other controls, this setting can also result in inaccurate labeling. It's usually not a good idea to choose a label that applies encryption to documents as the default label. For example, many organizations need to send and share documents with external users who may not have apps that support encryption or who may not be using an account that can be authorized. For more information about this scenario, seeShare encrypted documents with external users.


    If you haveSublabels, be careful not to configure the parent label as the default label.

  • Request a justification for changing a label.If a user attempts to remove a label or replace it with a lower-numbered label, you can require that the user provide a reason for performing the action. Example: A user opens a document called Confidential (Order Number 3) and replaces that label with a document called Public (Order Number 1). For Office apps, this reason prompt is triggered once per app session when using built-in labeling and per file when using Azure Information Protection unified labeling client. Administrators can read in the justification reason along with the label changeActivity Explorer.

    About Sensitivity Labels - Microsoft Purview (Compliance) (9)

  • Prompt users to apply a labelfor the different types of items and containers that support confidentiality tags. Also known as mandatory labeling, these options ensure that a label must be applied before users can save documents and send email or meeting invitations, create new groups or sites, and use unlabeled content for Power BI.

    For documents and emails, a label can be assigned manually by the user, automatically as a result of a condition you configure, or assigned by default (the default label option described earlier). Example of a prompt when a user needs to assign a label:

    About Sensitivity Labels - Microsoft Purview (Compliance) (10)

    You can find more information on the labeling requirement for documents and e-mails atRequire users to label their emails and documents.

    Containers must be labeled at the time the group or site is created.

    (Video) How to create and use sensitivity labels in Microsoft 365

    For more information about mandatory labeling for Power BI, seeMandatory labeling policy for Power BI.

    Consider using this option to increase the coverage of your lettering. However, without user training, these settings can result in inaccurate labeling. Additionally, mandatory labeling can frustrate your users with frequent prompts unless you set a default label to match as well.

  • Provide a help link to a custom help page.If your users aren't sure what your sensitivity labels mean or how they should be used, you can provide a URL for more information that will appear at the bottom of thesensitivity labelMenu in the Office apps:

    About Sensitivity Labels - Microsoft Purview (Compliance) (11)

After you create a labeling policy that assigns new sensitivity labels to users and groups, users will see those labels in their Office apps. It can take up to 24 hours for the latest changes to be replicated across your organization.

There is no limit to the number of sensitivity labels you can create and publish, with one exception: if the label applies encryption that specifies the users and permissions, a maximum of 500 labels is supported with this configuration. However, as a best practice to reduce administrative overhead and complexity for your users, try to keep the number of labels to a minimum. Real deployments have been shown to be noticeably reduced when users have more than five major labels or more than five sub-labels per major label.

Label Policy Priority (Order Matters)

You make your sensitivity labels available to users by publishing them in a sensitivity label policy, which appears in a list on theLabel GuidelinesSide. Just like sensitivity labels (seeLabel priority (order matters)), the order of sensitivity label policies is important because it reflects their priority: the label policy with the lowest priority appears at the top of the listthe lowestOrder number, and the label policy with the highest priority is included at the end of the listhighestOrder number.

A label policy consists of:

  • A set of labels.
  • The users and groups to which the labeled policy will be assigned.
  • The scope of the policy and policy settings for that scope (e.g. default label for files and emails).

You can include a user in policies with multiple labels, and the user gets all sensitivity labels and settings from those policies. If there is a conflict in the settings of multiple policies, the settings of the policy with the highest priority (highest ordinal number) are applied. In other words, the highest priority wins for each setting.

If you're not seeing the behavior of the labeling policy setting for a user or group that you expect, check the order of the sensitivity labeling policies. You may need to move the policy down. To reorder the label policies, select a sensitivity label policy > select the action ellipsis for that entry >move downorMove up. For example:

About Sensitivity Labels - Microsoft Purview (Compliance) (12)

In our screenshot example showing three label policies, all users are assigned the default label policy, so it is appropriate that it has the lowest priority (lowest ordinal number 0). Only users in the IT department are assigned the second policy with ordinal number 1. For these users, if there are conflicting settings between their policy and the default policy, their policy's settings take precedence because they have a higher ordinal number.

Similarly for users in Legal who are assigned the third policy with different settings. It's likely that these users have stricter settings, so it's appropriate that their policy has the highest ordinal number. It is unlikely that a Legal user would belong to a group that is also assigned to the IT department policy. If this is the case, however, the ordinal number 2 (highest ordinal number) ensures that the settings of the legal department always have priority in the event of a conflict.


Remember, if there is a setting conflict for a user who has multiple policies assigned, the setting from the assigned policy with the highest ordinal number will be applied.

Sensitivity labels and Azure Information Protection

The sensitivity labels built into Microsoft 365 Apps on Windows, macOS, iOS, and Android look and behave very similar on those devices to give users a consistent labeling experience. However, on Windows computers, you can use the as wellAzure Information Protection (AIP)-Client. The AIP Office add-in component of this client is now integratedmaintenance modeand once installed is no longer the default labeling client for the latest Office apps.

If you're using the AIP add-in for labeling in Office apps, we recommend you switch to built-in labeling. For more information, seeMigrate the Azure Information Protection (AIP) add-in to built-in labeling for Office apps.

Azure Information Protection labels

Label management for Azure Information Protection labels in the Azure portal is deprecatedMarch 31, 2021. Learn more from the officerdepreciation note.

If your tenant is not already on theUnified labeling platform, you must first enable unified labeling before you can use sensitivity labels. See instructions belowHow to migrate Azure Information Protection labels to unified sensitivity labels.

Sensitivity labels and the Microsoft Information Protection SDK

Because a sensitivity label is stored in a document's metadata, third-party apps and services can read and write to that labeling metadata to supplement your labeling delivery. In addition, software developers can use theMicrosoft Information Protection-SDKFully support labeling and encryption capabilities across multiple platforms. For more information, seeAnnouncing general availability on the Tech Community Blog.

You can also find out about itPartner solutions integrated with Microsoft Purview Information Protection.

Deployment Guide

For deployment planning and guidance information that includes licensing information, entitlements, deployment strategy, a list of supported scenarios, and end-user documentation, seeStart with sensitivity labels.

(Video) Protect documents with sensitivity labels in Microsoft 365 Business Premium

For information on the use of sensitivity labels to comply with privacy regulations, seeProviding information protection for privacy regulations with Microsoft 365.


What are Microsoft sensitivity labels? ›

Sensitivity labels allow Teams admins to protect and regulate access to sensitive organizational content created during collaboration within teams. After you configure sensitivity labels with their associated policies in the Microsoft Purview compliance portal, these labels can be applied to teams in your organization.

How do I use sensitivity labels in purview? ›

Create new or apply existing sensitivity labels in the Microsoft Purview compliance portal. Creating sensitivity labels include autolabeling rules that tell us which label should be applied based on the classifications found in your data. Register and scan your asset in the Microsoft Purview Data Map.

Why use Microsoft sensitivity labels? ›

With sensitivity labels, you can identify the sensitivity of data across your organization, and the label can enforce protection settings that are appropriate for the sensitivity of that data. That protection then stays with the content.

What do sensitivity labels mean? ›

Sensitivity labels are used to add an additional layer of protection to your files or emails. They allow you to classify documents as confidential or highly confidential labels which once applied, determine what users can do with that file.

What are three capabilities of sensitivity labels? ›

With sensitivity labels you can classify and help protect your sensitive content. Protection options include labels, watermarks, and encryption.

Who can apply sensitivity labels? ›

Licensing Sensitivity Labels

Anyone with an Office 365 license can read documents or emails protected by labels. Users require Office 365 E3 or above to apply a label manually, while automatic policy-driven application of labels requires Office 365 E5 or the Microsoft 365 E5 compliance licenses.

What is the difference between AIP and sensitivity labels? ›

Azure Information Protection is a more advanced subscription with more capabilities than what exists using the Office 365 Security & Compliance center's “Sensitivity labels”—again, at least for now. The main difference to note is that AIP is better suited to hybrid environments.

What are sensitivity labels that one must apply to documents? ›

A sensitivity label is a kind of digital stamp added to your business document (like DOCX or XLSX) or email in order to secure it. You can set up many labels, depending on your company needs, for example: Create labels for the whole company, or for specific groups or users.

How do you implement sensitivity labels? ›

On the Choose sensitivity labels to publish page, select the Choose sensitivity labels to publish link. Select the labels that you want to make available in apps and to services, and then select Add. If you select a sublabel, make sure you also select its parent label.

What are the advantages of displaying labels? ›

It is a great way to increase sales and promote brand recognition for both new and existing customers in the market. Labels are the best advertising tool. When done correctly, they can effectively communicate what makes you different from competitors.

How do labels help with accessibility? ›

A label for a form control helps everyone better understand its purpose. In some cases, the purpose may be clear enough from the context when the content is rendered visually.

What are the sensitivity categories? ›

There are three types of sensitive categories: Standard, Restricted, and Under development.

What type of encryption is used with sensitivity labels? ›

By default, encryption for a sensitivity label uses the Azure Rights Management service from Azure Information Protection.

What are the 3 main types of labels? ›

There are four major types of labels that companies and small businesses are using for their products and operations: brand labels, informative labels, descriptive labels, and grade labels.

What are the 3 categories of labeling? ›

There are three kinds of labels: • Brand • Descriptive • Grade Labeling Marketing Essentials Chapter 31, Section 31.2 Page 40 The brand label * gives the brand name, trademark, or logo.

What are the four AIP sensitivity settings? ›

In AIP, a classification label is used to identify data based on its level of sensitivity and the impact to your business. Most common sensitivity levels are categorized as restricted, confidential, official use, and public. AIP can apply labels (classify) to documents and emails.

What colors are Microsoft sensitivity labels? ›

Microsoft makes ten label colors available for sensitivity labels in the Purview Compliance portal (Figure 1). The colors are charcoal, silver, beige, berry, lavender, light blue, light green, marigold, orange, and burgundy.

What is default sensitivity label policy? ›

The default sensitivity label policy makes the labels available for users to start labeling their documents and emails with sensitivity labels. It has the following configuration: Publish the default labels to all users in your tenant.

What are o365 sensitivity labels policies? ›

Sensitivity labels enable us to classify and protect sensitive data within the file and the file itself. It will stay persistent with that file regardless of the file location. This way, users can continue to collaborate and let the sensitivity label worry about the protection.

What is the information required on labels? ›

The label on a prepackaged product must include three key components: the “product identity declaration” (this is the product's common or generic name, or its function) the net quantity of the package contents. the dealer name and place of business.

What information required for labeling? ›

Generally speaking, labels for food products must advise consumers of the product ingredients (including potential allergens), the “best before” or “use by” date, country of origin, and nutrition information. The address of the manufacturer or distributor is also required.

What are the three importance of a label? ›

Packages and labels communicate how to use, transport, recycle or dispose of the package or product. Labelling is also used to exaggerate the product. Also, it is used for identification. This kind of labeling helps a viewer to differentiate the product from the rest in the shelves of the market.

What are 3 benefits of using labels to the client? ›

They not only influence how a personal identity is created but also allow for recognition that others have different qualities. They aid people in understanding differences in needs, culture, and personalities. Labels can also reflect positive characteristics, set useful expectations, and provide meaningful goals.

What is the purpose of labels? ›

A label is an essential feature of a product that aims to communicate information about your product to customers to convince them to buy your product. Product labels allow your customers to know the content of the product especially the presence of allergens and how to properly use it.

Why are labels important for identity? ›

Throughout our lives, people attach labels to us, and those labels reflect and affect how others think about our identities as well as how we think about ourselves. Labels are not always negative; they can reflect positive characteristics, set useful expectations, and provide meaningful goals in our lives.

What is the difference between label and accessible name? ›

These definitions are almost identical, but there is one important difference: "label" is presented to the user and "name" is presented to software. In other words, label is presented visually, and name is presented to assistive technologies, like screen readers and voice control software.

How does labeling data make it more accessible? ›

Label data directly

One way to reduce the cognitive burden on users it to directly label your data rather than using legends. This is especially useful for colorblind or visually impaired users who may have difficulty matching colors within the plot to those in the legend.

What are the three levels of sensitivity? ›

Designation levels for Sensitive Positions include Noncritical-sensitive, Critical-sensitive, and Special-sensitive.

What are the four classes of data sensitivity? ›

Data types with similar levels of risk sensitivity are grouped together into data classifications. Four data classifications are used by the university: Controlled Unclassified Information, Restricted, Controlled and Public.

What are two types of sensitivity? ›

In summary, there are two distinct types of sensitivity, one that revolves around sensing possible threats to the ego and one that involves depth of feeling. It is the second type of sensitivity that allows a person a keen awareness of other people's feelings as well as their own.

Should you encrypt sensitive information? ›

Many technology services encrypt and decrypt your data so it will be safe when they use it. Businesses should encrypt data that could damage their financial results if it were breached. Individuals should encrypt sensitive personal data like their medical histories and social security numbers.

Should sensitive data be encrypted? ›

Enable Data Encryption

Any organization operating with highly sensitive data should consider encryption to prevent unauthorized parties from accessing the data. Cryptographers code the data using complex algorithms and ciphers that protect data from being stolen or exposed.

Why should sensitive data be encrypted? ›

It helps protect private information, sensitive data, and can enhance the security of communication between client apps and servers. In essence, when your data is encrypted, even if an unauthorized person or entity gains access to it, they will not be able to read it.

What do Outlook sensitivity labels mean? ›

A sensitivity label is a Microsoft 365 feature that lets you apply a label to emails or files so they're compliant with your organization's security policies.

What can you specify in Microsoft 365 sensitivity labels? ›

You can use sensitivity labels to mark the content when you use Office apps, by adding watermarks, headers, or footers to documents that have the label applied. You can use sensitivity labels to mark the content when you use Office apps, by adding headers, or footers to email that have the label applied.

What does email sensitivity labels mean? ›

Sensitivity labels allow you to classify and protect your email message content. Sensitivity labels ensure that email messages labeled as "Restricted - Encrypted" are automatically encrypted and not shareable outside of the intended list of recipients.

What are sensitivity label capabilities in Outlook? ›

You can apply sensitivity labels to your files and emails to keep them compliant with your organization's information protection policies. The names of these labels, the descriptions you see when you hover over them, and when to use each label will be customized for you by your organization.

How do I assign a sensitivity label to a user? ›

Assign a label to an existing group in Azure portal

Select Groups. From the All groups page, select the group that you want to label. On the selected group's page, select Properties and select a sensitivity label from the list. Select Save to save your changes.

How is document sensitivity classified? ›

Data is classified according to its sensitivity level—high, medium, or low. High sensitivity data—if compromised or destroyed in an unauthorized transaction, would have a catastrophic impact on the organization or individuals. For example, financial records, intellectual property, authentication data.

What are the differences between Azure information protection labels and Office 365 sensitivity labels? ›

Azure Information Protection is a more advanced subscription with more capabilities than what exists using the Office 365 Security & Compliance center's “Sensitivity labels”—again, at least for now. The main difference to note is that AIP is better suited to hybrid environments.

How to assign permissions to specific users and groups sensitivity label? ›

On the Assign permissions pane, select Add specific email addresses or domains. In the text box, enter the email address of the first user (or group) to add, and then select Add. Select Choose permissions. On the Choose permissions pane, select the permissions for this user (or group), and then select Save.

Where are sensitivity labels? ›

Creating the labels

To create labels, navigate to the https://protection.office.com/ website and then click on the Classification section and then Sensitivity Labels, this will bring you to the area where you can create all your labels for use with Office.

What type of sensitive information that should never be emailed? ›

Examples of information you should never send via email include: Social Security numbers. Driver's License numbers. Passport numbers.

Does sensitivity label sends an alert whenever a user posts an inappropriate message? ›

It alerts them the file they uploaded (provides the name of the file) is too sensitive to the site and provides some suggestions to rectify the problem. IMPORTANT: Even if the user is a guest of the tenant, they will receive a notification.


1. MIP - Sensitivity Label Overview
(Doug Does Tech)
2. Sensitivity Labels in Microsoft 365 - Prevent Data Theft
(Jonathan Edwards)
3. Microsoft 365: Protecting sensitive emails with policy-driven compliance
(Microsoft 365)
4. Get Started with Microsoft Information Protection
(Andy Malone MVP)
5. Build your first Microsoft Purview DLP Policy
(Doug Does Tech)
6. SBD05 - Sensitivity Labels for Content - Part01 - Microsoft 365 Compliance
(M365 Compliance - Scenario Based Demos (SBD))


Top Articles
Latest Posts
Article information

Author: Gregorio Kreiger

Last Updated: 03/09/2023

Views: 6090

Rating: 4.7 / 5 (77 voted)

Reviews: 84% of readers found this page helpful

Author information

Name: Gregorio Kreiger

Birthday: 1994-12-18

Address: 89212 Tracey Ramp, Sunside, MT 08453-0951

Phone: +9014805370218

Job: Customer Designer

Hobby: Mountain biking, Orienteering, Hiking, Sewing, Backpacking, Mushroom hunting, Backpacking

Introduction: My name is Gregorio Kreiger, I am a tender, brainy, enthusiastic, combative, agreeable, gentle, gentle person who loves writing and wants to share my knowledge and understanding with you.