Every business holds information that should not be shared freely: customer details, financial records, contracts, staff files. Sensitivity labels in Microsoft 365 let you classify that information and protect it automatically, wherever it travels. They were previously known as part of Azure Information Protection and are now part of Microsoft Purview Information Protection. Here is how they work and how to use them well.
What are sensitivity labels?
A sensitivity label is a tag applied to an email, document, Teams meeting, SharePoint site or Microsoft 365 group. The label can carry protection with it, such as encryption, visual markings and sharing restrictions. Because the label travels with the file, the protection stays in place even if the file is moved or emailed.
What labels can do
- Add headers, footers or watermarks so people can see how sensitive a document is.
- Encrypt content so only authorised people can open it.
- Restrict actions such as copying, printing, forwarding or editing.
- Control external sharing and guest access for Teams, groups and SharePoint sites.
- Apply a default level of protection to new content.
Ways to apply labels
- Manually. Users choose a label in Word, Excel, PowerPoint and Outlook.
- By default. New files and emails receive a baseline label automatically.
- Mandatory. Users must choose a label before saving or sending.
- Automatically. Content containing sensitive information, such as tax file numbers or credit card numbers, can be labelled by rules.
Licensing
Microsoft 365 Business Premium and many enterprise plans include the ability to create and apply sensitivity labels, including encryption. More advanced capabilities, such as broader automatic labelling, typically need higher licences like Microsoft 365 E5 or Purview add-ons. Check your licence before you design your rollout.
A simple label set
The biggest mistake is creating too many labels. A small, clear set is easier for staff to understand. A common example is:
| Label | Use |
|---|---|
| Public | Information approved for anyone, such as marketing material. |
| General | Everyday business information not meant for public release. |
| Confidential | Sensitive information shared only with those who need it. |
| Highly Confidential | The most sensitive data, with encryption and strict controls. |
SharePoint, OneDrive and Teams
Labels can be applied to files stored in SharePoint Online and OneDrive, and to containers such as Teams, groups and sites, which controls sharing and access at the site level. This lets you protect an entire workspace as well as individual files.
Common challenges
- Too many labels confuse staff and lead to inconsistent use.
- Encrypted files can be harder to share with external partners who lack the right access.
- Older apps and third-party tools may not understand encrypted files.
- Without training and a clear policy, people choose the wrong label or ignore the prompt.
Rolling out successfully
- Identify your most sensitive data and the rules that apply to it.
- Design a small label set with plain-English descriptions.
- Pilot with a small team and gather feedback.
- Train staff and publish a one-page guide.
- Monitor label usage and activity in Microsoft Purview.
- Add default labelling and then automatic labelling as confidence grows.
- Pair labels with data loss prevention for extra protection.
Key takeaways
- A sensitivity label is a tag applied to an email, document, Teams meeting, SharePoint site or Microsoft 365 group, and it can carry encryption and sharing restrictions with it.
- Because the label travels with the file, protection stays in place even if the file is moved or emailed.
- Keep the label set small and clear. The biggest mistake is creating too many labels.
- Check your licence before you design a rollout, because advanced automatic labelling typically needs higher licences.
Sensitivity labels: frequently asked questions
What are sensitivity labels?
A sensitivity label is a tag applied to an email, document, Teams meeting, SharePoint site or Microsoft 365 group. It can add markings, encrypt content and restrict actions such as copying, printing, forwarding or editing, and the protection travels with the file.
How can labels be applied?
Manually by users, by default as a baseline label on new files and emails, as mandatory so users must choose one before saving or sending, or automatically when content contains sensitive information such as tax file numbers or credit card numbers.
Which licences include sensitivity labels?
Microsoft 365 Business Premium and many enterprise plans can create and apply sensitivity labels, including encryption. More advanced capabilities, such as broader automatic labelling, typically need higher licences like Microsoft 365 E5 or Purview add-ons.
Related reading: Microsoft Purview consulting.
Total Solutions IT can design and roll out sensitivity labels for your organisation. Call 02 6061 4222 to find out more.
