Read time: 10 minutes
In a highly collaborative environment, chances of data leak and compliance violation increases exponentially. Therefore, it becomes important to understand how to safeguard your data in a way that meets your organization’s compliance policies. To do that effectively without compromising the user productivity and their ability to collaborate, Microsoft has a feature called Sensitivity Labels. These labels allow you to classify and protect all the data shared within the organization. In this blog, we will discuss sensitivity labels, how to set them up, and how it works.
What are Sensitivity Labels in Microsoft 365?
Sensitivity labels in Office 365 are like a digital stamp added to your business document or email to secure it. These labels are managed through Microsoft Purview and allow organizations to identify and secure Microsoft 365 data like emails, documents, PII information like Social Security numbers, govt. identification numbers, protected healthcare information, and intellectual property data.
Depending on how they’re configured, these labels can be used to encrypt data, restrict access, or classify protection without applying additional protection. A sensitivity label appears to users like a tag applied to a document or email, and it is:
- Customizable – Based on your organization or business needs, you can create different level categories of sensitive content such as Personal, Public, General, Confidential, and Highly Confidential.
- Clear Text – Labels are stored in the clear text format in the metadata for emails and files. So that third-party applications and services can read them and, if required, apply their protective actions.
- Persistent – No matter where the label is saved or stored, it stays with the content because it is stored in the metadata for emails and files. Unique label identification becomes the way to apply and enforce your configured policies.
For What Purposes Can We Use Sensitivity Labels in Office 365?
As we have already discussed, sensitivity labels appear like a tag on documents and emails that can be easily integrated into users’ workflows. Moreover, documents and emails can have both sensitivity labels as well as retention labels applied to them. We can use sensitivity labels to:
- Enforce protection settings such as encryption and content markings. For example, users can apply a Confidential Label to an email or document, and that label encrypts the content and puts on a Confidential Watermark. Headers, footers, and watermarks are included in content markings.
- Protect Office apps on different platforms and devices. It is supported by Excel, PowerPoint, Word, and Outlook on Windows, Mac, iOS, and Android.
- Protect content in third-party apps and services using Microsoft Defender for Cloud Apps. It allows you to detect, classify, and protect content in third-party apps and services like Salesforce, Box, or DropBox. You can apply it on third-party apps or services that don’t read or support sensitivity labels.
- Protect containers that include Microsoft 365 groups, SharePoint sites, and Teams for properties such as privacy settings, unmanaged devices access, and external user access or sharing.
- Extend sensitivity labels to third-party apps. You can read sensitivity labels and apply protection settings using the Microsoft Information Protection SDK.
- Extend sensitivity labels to Power BI. Turn on this capability to apply and view sensitivity labels in Power BI and protect the data saved outside the service.
- Classify content without using any protection settings. You can also assign labels to classify the content and use these labels to generate usage reports and watch activity data for your sensitive content. You can choose to apply protection settings later based on this information.
Permissions Required to Create and Manage Sensitivity Labels
Administrators require proper Role-Based Access Control (RBAC) permissions from the Microsoft Purview Portal to create and manage sensitivity labels in Microsoft 365. Microsoft recommends assigning specific roles to different users instead of giving Global Administrator Access to all employees in the organization. Here are the relevant permissions required:
- Global Admin Access: You must have access to one of the admin centers (Microsoft 365 Security Center, Microsoft 365 Compliance Center, Security & Compliance Center) to create and manage sensitivity labels. The Global Administrator has access to admin centers and can grant non-admin access to compliance officers and other non-users.
- Information Protection Roles: These roles include Information Protection Admins, Analysts, Investigators, Readers, etc. These roles provide the ability to create and manage sensitivity labels and the policies related to them based on the roles assigned.
- Individual Role Groups: There are also different role groups used for specific actions like Sensitivity Label Admin, Sensitivity Label Reader, Compliance Admin/Compliance Data Admin, Security Admin, and many more.
How to Create Sensitivity Labels in Microsoft 365?
Once we have enabled unified sensitivity labels and assigned the required roles and permissions, it’s time to create and publish a few sensitivity labels and see them in action. The whole process to create sensitivity labels in Office 365 is divided into 3 parts. The steps to create a sensitivity level are as follows:
Part 1: Create a Sensitivity Label
- Open Microsoft Purview Portal and select Solutions > Information Protection > Sensitivity labels.
- Click on the Plus icon to create a label.
- Provide your details like Name, Display Name, Label Priority, Display for users, Display for admins, etc.
- Determine the scope of the label and select what type of data will this sensitivity label protect. The defined scope will also determine which settings will be available for admins and where the label can be used.
Part 2: Configure the Protection Settings and Create the Label
- Choose Control access to restrict who can access and view the labeled items. You can choose to assign permissions either now or later to let users access labeled data.
- Click on the Assign permissions option to assign control access permissions to specific users.
- If required, select Apply content marking to apply markings like custom headers, footers, and watermarks to the labeled items.
- Wherever required, you can also configure Automatic labeling to identify large files and emails as per specific conditions.
- If the sensitivity label applies to groups and sites too, you can define protection settings for these items too. However, these settings only apply to group or site itself, not on the files stored in it.
- Review the details provided and if correct, click on Create Label to finally create a new sensitivity label.
Part 3: Publish the Newly Created Sensitivity Label
- In Microsoft Purview portal, go to Solutions > Information Protection > Publishing policies. Now select the Publish Label option on the Label policies page.
- Select the Choose sensitivity labels to publish option, choose the newly created label, and then click on Add.
- Select the users or the groups who you want to assign the labels to.
- Verify the available settings and configure them to your organization’s settings appropriately.
- If the policy offers default-label settings, select the appropriate defaults for all the supported content item types like documents, emails, meetings, or Power BI content, wherever applicable.
- If a default-label setting is left as None, no default label is assigned through that setting. However, this doesn’t mean that it disables the encryption, or it overrides the other labelling requirements.
- Give a name to this policy, verify all the selected labels, and check whether the assigned users or groups are correct or not. Also check the policy settings of the created label.
- Finally click on Submit to publish the label. Wait for some time to allow the labels and policy settings to propagate throughout the organization. Microsoft recommends giving up to 24 hours to change or replicate any settings in the created label.
How to Remove a Label?
To remove a sensitivity label or lower its classification, you might have to provide a justification. They need to specify why they are changing or removing a label. It basically depends on your organization’s labelling policy. Follow these steps to remove a label:
- Open the labelled document and go to Sensitivity.
- Click on the name of the currently applied label.
- Now, the justification required pop-up will appear, pick an appropriate option, and click on Change.
Finally, the label should be removed at this point.
Grouping Sensitivity Labels and Label Priority
All the created labels will appear in a list on the Sensitivity tab of the Labels page. The order of the label in this list is important because it indicates their priority. You want your least restrictive sensitivity label, such as Public or Personal, to come at the top of the list and the most restrictive label, highly confidential, to appear at the bottom.
Using sub-labels, you can also group multiple labels below a parent label (users see it in an Office app). But sub-labels don’ inherit any features or settings from their parent label. While publishing a sub-label, users can apply the sub label, but they can’t just apply the parent label to the content. If you select a parent label as the default label or configure it to apply automatically or recommended, it won’t apply to the content.
Wrapping Up
Sensitivity labels in Microsoft 365 work most effectively when their role classification and protection settings match with your organization’s security and compliance requirements. Before applying them to the whole organization, make sure that you test all the labels and the publishing policies with a test group. Verify that they work as required and provide the appropriate amount of protection without affecting employees’ collaboration and productivity.
Frequently Asked Questions
A. Sensitivity labels classify content according to its sensitivity and can apply protection settings, such as encryption and access restrictions. Retention labels, on the other hand, manage how long content should be kept and whether it should be deleted or treated as an archive. A document or email can have both types of labels because they serve different purposes.
A. No. A sensitivity label encrypts files only when encryption is configured in its protection settings. Other labels may classify content or apply markings, such as headers, footers, or watermarks, without encrypting it. Check the label’s configuration to determine what protection it provides.
A. Yes. Microsoft Purview supports automatic labeling for eligible files and emails based on configured conditions, such as the detection of sensitive information. Depending on the setup, labeling can happen automatically, or the app can recommend a label for the user to apply. Availability depends on the supported apps, configuration, and applicable licensing requirements.
