Sensitivity Labels & Data Classification
Before you can protect data, you need to know what you have. Sensitivity labels are the tags that tell Microsoft 365 how important a document is — and data classification finds the data that needs tagging.
What are sensitivity labels?
Sensitivity labels are like security clearance stickers on documents.
In the physical world, a document stamped “TOP SECRET” is treated differently from one stamped “PUBLIC”. People know not to leave it on the printer, not to discuss it in the cafeteria, and not to take it home.
Sensitivity labels do the same thing digitally. When a file is labelled “Highly Confidential”, Microsoft 365 can automatically encrypt it, restrict who can open it, prevent it from being emailed externally, and watermark it — all without the user doing anything extra.
How sensitivity labels work
Label hierarchy (example)
| Label | Protection Actions | Example Content |
|---|---|---|
| Public | None — anyone can access | Marketing brochures, blog posts |
| Internal | Header/footer marking | Internal newsletters, meeting notes |
| Confidential | Encryption + restrict external sharing | Business plans, financial reports |
| Highly Confidential | Encryption + watermark + prevent copy/print + restrict to named users | Board papers, salary data, legal contracts |
Three ways to apply labels
| Method | How It Works | Best For |
|---|---|---|
| Manual | User selects the label from the ribbon in Word/Excel/Outlook | User knows the sensitivity |
| Recommended | Purview detects sensitive content and suggests a label — user confirms | Guiding users to label correctly |
| Automatic | Purview detects sensitive content and applies the label without user action | Enforcing labelling at scale |
Scenario: Northwave's labelling strategy
Priya (Compliance Officer) sets up labels for Northwave:
- All users see: Public, Internal, Confidential, Highly Confidential in their Office apps
- Auto-labelling rule: Any document containing credit card numbers → auto-labelled “Confidential”
- Recommendation rule: Documents with keywords like “salary”, “performance review” → user is prompted to label as “Highly Confidential”
- Default label: All new documents start as “Internal” (users can change it)
Result: 80% of documents are labelled within the first month — most without users doing anything.
Data classification — finding what needs labels
Before you label, you need to know what data you have. Purview’s data classification tools:
| Tool | What It Does |
|---|---|
| Sensitive information types (SITs) | Built-in patterns that detect data like credit cards, passport numbers, national IDs |
| Trainable classifiers | AI models trained to recognise content types (contracts, resumes, source code) |
| Content explorer | Browse to see exactly what sensitive data exists and where |
| Activity explorer | See what’s happening to labelled data — who’s sharing, downloading, printing |
Key exam concept: Sensitivity labels PROTECT data. Data classification DISCOVERS data. You need both — classification tells you what to label, labels enforce protection.
Labels on containers (Teams, Groups, Sites)
Labels can also be applied to containers — not just files:
- M365 Group / Team → label controls privacy (public/private), external sharing, and guest access
- SharePoint site → label controls sharing settings, access from unmanaged devices
This means labelling a Team as “Confidential” can automatically restrict guest access and limit sharing — at the container level, not per-file. Device-based restrictions (like requiring managed devices) are set through Conditional Access policies that complement the label.
🎬 Video walkthrough
🎬 Video coming soon
Sensitivity Labels & Classification — AB-900 Module 12
Sensitivity Labels & Classification — AB-900 Module 12
~10 minFlashcards
Knowledge Check
Clearfield Council needs all documents containing citizen ID numbers to be automatically encrypted and restricted from external sharing — without relying on users to remember to label them. What should Officer Patel configure?
Next up: Data Loss Prevention (DLP) — the policies that prevent sensitive data from leaving your organisation.