SC-401 - Sensitivity Labels
Quick Navigation
Sensitivity Labels Overview
Sensitivity labels in Microsoft Purview mark and protect content based on its classification. Labels are created once and travel with the content - protecting documents in SharePoint, email in Exchange, Teams conversations, and even third-party apps via Defender for Cloud Apps.
The sensitivity label lifecycle:
- Create - define the label name, description, and protection settings in Purview
- Publish - deploy via a label policy to specific users/groups or all users
- Apply - users apply manually, auto-labeling applies automatically, or default label applies on creation
- Enforce - the label's protection settings (encryption, watermarks, DLP rules) are enforced
Creating Labels and Label Policies
Label Order and Hierarchy
Labels can be organized with parent labels and sub-labels. The label order in the Purview admin UI matters for user experience (labels are displayed in order) and for downgrade justification logic.
| Concept | Description |
|---|---|
| Parent label | Top-level label (e.g., "Confidential"). Can have its own protection settings or be a grouping header only. |
| Sub-label | Inherits the parent label name prefix. Users choose sub-labels, not parent labels, when sub-labels exist. |
| Label order | Higher position in the list = lower sensitivity. Label policy's "more sensitive label requires justification to downgrade" uses this order. |
Label Policies
A label policy deploys labels to users and sets behavioral rules:
| Policy Setting | Description |
|---|---|
| Default label | Automatically applies this label to unlabeled documents or emails when a user creates them |
| Require justification to downgrade | Forces users to enter a reason when changing to a lower-sensitivity label |
| Require labeling | Users must apply a label before saving or sending - cannot leave content unlabeled |
| Label bar visibility | Show or hide the sensitivity bar in Office apps |
| Scope | Target specific users, groups, or all users |
Label Protections and Settings
Each sensitivity label can configure one or more protection actions:
Encryption
Apply Azure Rights Management (Azure RMS) encryption directly through the label:
- Assign permissions now - define who can access labeled content and with what rights (view, edit, print, copy, etc.) at label creation time
- Let users assign permissions - users choose recipients and rights when applying the label (Do Not Forward or Encrypt-Only)
- Configure expiration - set a date after which decryption is no longer possible
- Offline access - control how long encrypted content can be opened without contacting the RMS service
Content Marking
| Marking Type | Where Applied |
|---|---|
| Header | Text inserted above content (Office documents, emails) |
| Footer | Text inserted below content (Office documents, emails) |
| Watermark | Diagonal text overlay on Word documents and PowerPoint slides (not Excel or email) |
Auto-marking vs Manual marking
Content marking from label settings is applied immediately when the label is applied. Markings can use dynamic variables: , , .
Auto-Labeling
Auto-labeling applies sensitivity labels automatically without user intervention. There are two distinct auto-labeling mechanisms in Purview:
| Mechanism | Where Configured | When Applied | Scope |
|---|---|---|---|
| Client-side auto-labeling | Label policy settings (Office apps) | When user is editing a document in Office apps - shows recommendation or applies automatically | Documents being edited in Word, Excel, PowerPoint, Outlook |
| Service-side auto-labeling | Separate Auto-labeling policy in Purview | Applied by the service to existing and new content at rest, even without user interaction | SharePoint Online, OneDrive, Exchange Online (email in transit and at rest) |
Service-Side Auto-Labeling Policy
- Create a new auto-labeling policy in Purview (Information Protection - Auto-labeling)
- Define conditions: SITs, trainable classifiers, or both
- Choose locations (Exchange, SharePoint, OneDrive)
- Run in simulation mode first to see what would be labeled without actually labeling
- Review simulation results and enable the policy to start labeling
Priority Rules When Multiple Labels Apply
If a document already has a label, auto-labeling only replaces it if the auto-labeling policy is configured to override existing labels, AND the new label is higher sensitivity. Lower-sensitivity auto-labels will not downgrade an existing manual label.
Container Labels
Container labels apply sensitivity to Microsoft 365 Groups, SharePoint sites, and Teams teams - controlling the container's privacy, external access, and unmanaged device access settings rather than encrypting individual files.
| Setting | Options | Effect |
|---|---|---|
| Privacy | Public, Private, None | Sets whether the Microsoft 365 Group (Team) is public or private |
| External user access | Allow/prevent guests | Controls whether external guests can be added to the Group/Team |
| External sharing (SharePoint) | Anyone, Existing guests, New/existing guests, Only org members | Sets the SharePoint site's external sharing level |
| Unmanaged device access | Full access, Web-only, Block access | Controls SharePoint/OD access from non-Intune-enrolled devices via Conditional Access |
Set-SPOTenant -EnableAIPIntegration $true). Container labels protect the container but do not encrypt the files inside - file-level labels are separate and can be configured independently.Defender for Cloud Apps Integration
Microsoft Defender for Cloud Apps (MDCA) extends Purview sensitivity label protection to third-party cloud apps (Salesforce, Box, Google Workspace, etc.) and provides session-level controls.
Key Integration Capabilities
| Capability | Description |
|---|---|
| File scan and labeling | MDCA can scan files in connected cloud apps and apply Purview sensitivity labels or trigger DLP alerts |
| Session controls | Block download of labeled files from sanctioned apps via Conditional Access App Control (requires Azure AD Premium P1) |
| Alert policies | Create alerts when high-sensitivity labeled files are shared publicly or downloaded in bulk |
| Governance actions | Auto-quarantine, change sharing permissions, or remove external collaborators on files with specific sensitivity labels |
Conditional Access App Control
When a user accesses a sanctioned app (e.g., Salesforce) through Azure AD Conditional Access, MDCA can proxy the session and enforce real-time controls:
- Block download of files labeled "Highly Confidential"
- Block upload of files containing sensitive information types
- Require step-up authentication before accessing sensitive labeled content
- Monitor and log all file access and sharing activities