Sensitivity labels and encryption
Sensitivity labels classify and protect files, emails, meetings, sites and groups. The label travels with the content, so protection follows the data wherever it goes.
Creating a label
In the Microsoft Purview portal go to Information Protection > Sensitivity labels. A label has a name, a display name, a tooltip and a scope:
| Scope | Protects |
|---|---|
| Items | Files, emails, meetings |
| Groups and sites | Teams, Microsoft 365 groups, SharePoint sites |
| Schematized data assets | Data in Purview Data Map sources such as SQL |
Protection settings
- Control access (encryption): choose who gets access and which permissions, using Azure Rights Management. You can assign permissions now or let the user choose. Set expiry and offline access limits.
- Content marking: header, footer and watermark.
- Auto-labeling for Office apps: recommend or apply a label when a sensitive info type is found.
- Site and group settings: privacy, external user access, sharing and unmanaged device access.
Users who need to remove a label that encrypts must have the Export or Full Control usage right.
Publishing with a label policy
A label does nothing until a label policy publishes it. The policy decides:
- which users or groups see the label
- a default label
- whether a justification is needed to lower a label
- whether labeling is mandatory before saving files or sending email
If only a group should use a label, publish it in a policy scoped to that group.
Label priority
Labels are listed in order. A label lower in the list has higher priority and is treated as more restrictive. Sublabels group related labels, but users apply the sublabel, not the parent.
Encrypting email without labels
You can also encrypt mail in Exchange Online with a mail flow rule. Use the action Apply Office 365 Message Encryption and rights protection with a template such as Do Not Forward, or an RMS template. This suits a condition like recipients at a given domain. Message expiry (for example seven days) is set in a Purview Message Encryption branding or template setting, not in the rule condition.
Exam traps
- A label policy publishes labels. The label itself is not visible to anyone until it is published.
- Sensitivity labels classify and protect. Retention labels keep or delete. They are separate.
- To prevent removal of a label, use encryption (access control) and limit usage rights, not just mandatory labeling.
- To use labels on Office files in SharePoint and OneDrive (co-authoring, search, DLP on encrypted files), enable labels for those services in the tenant.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. Users must not be able to remove a label from files and emails once it is applied. What helps most?
Show answer
Answer: C.Only users with Export or Full Control usage rights can remove a label that applies encryption, so access control prevents removal by normal users.
2. Which scope must a sensitivity label include to control privacy and external sharing of a SharePoint site?
Show answer
Answer: B.Groups and sites labels control privacy, external sharing and access for Microsoft 365 groups, Teams and SharePoint sites.
3. A document is labeled Confidential. How many sensitivity labels can an item have, and how is priority decided?
Show answer
Answer: B.An item has one sensitivity label. Labels are ordered, and a label lower in the list has a higher priority and is more sensitive.
4. A label should be available only to members of the Leadership group. What do you do?
Show answer
Answer: B.Labels are only visible to the users and groups targeted by the label policy that publishes them.