Sensitivity Labels and Information Protection

Sensitivity labels are metadata tags that classify and optionally protect data based on its sensitivity level. They are part of Microsoft Purview Information Protection (formerly Microsoft 365 Information Protection). The purpose is to enable organizations to:

On the SC-900 exam, you must know that sensitivity labels are the evolution of Azure Information Protection (AIP) labels. AIP labels (unified labeling) are now integrated into Microsoft 365 Compliance Center. The exam tests the difference between sensitivity labels and retention labels: sensitivity labels protect data (encryption, rights management), while retention labels manage data lifecycle (retention, deletion).

Sensitivity labels work by embedding metadata into files and emails. The metadata includes:

When a label is applied, the Microsoft 365 client (Office apps, Outlook, SharePoint Online) writes the metadata into the file's custom properties (for Office documents) or into the email header (for Exchange Online). The metadata is stored in a way that persists even if the file is renamed, copied, or moved (except for plain text files where metadata may be lost).

For protection, the label triggers Azure Rights Management (Azure RMS) to encrypt the file. Azure RMS uses a symmetric key encryption (AES-256) and a policy that defines which users or groups can decrypt, forward, copy, or print. The encryption is applied at the file level, not the container level (like an encrypted ZIP). This means the file remains encrypted even when stored in an unencrypted location (e.g., personal OneDrive).

Label Priority: Labels have an order (priority). The highest priority label is the most sensitive (e.g., Highly Confidential). The exam may ask: "Which label takes precedence?" Answer: The highest priority label (lowest number in the list).

Default Label: You can set a default label for documents and emails. If no label is applied manually, the default label is applied automatically. However, users can change it unless the label is marked as mandatory.

Mandatory Labeling: When enabled, users must apply a label to all documents and emails before saving or sending. The exam tests that mandatory labeling is configured in the labeling policy, not in the label itself.

Encryption Template: Each label that uses encryption references an Azure RMS template. The template defines:

The offline access period is a key exam point: default is 7 days. It can be configured between 1 and 999 days, or set to never expire.

Visual Markings: Labels can add headers, footers, and watermarks. For example, a "Confidential" label might add a footer "CONFIDENTIAL" and a watermark "CONFIDENTIAL". These markings are added when the label is applied, and they are dynamic (can change if the label changes).

Auto-labeling: There are two methods: 1. Client-side auto-labeling: Based on sensitive info types (e.g., credit card numbers) or trainable classifiers (e.g., "Offensive Language"). This runs in Office apps. 2. Server-side auto-labeling: For data at rest in SharePoint Online and OneDrive for Business, or data in transit in Exchange Online (via transport rules). This is configured in the Microsoft Purview compliance portal under "Auto-labeling policies".

Sensitivity labels are managed in the Microsoft Purview compliance portal (compliance.microsoft.com) under Information Protection > Labels. To create a label: 1. Go to Microsoft Purview > Information Protection > Labels. 2. Click "Create a label". 3. Define name, display name, description. 4. Configure protection settings: encryption, content marking, auto-labeling. 5. Publish the label via a label policy (assign to users/groups).

For PowerShell (Exchange Online Protection Management module):

# Get all sensitivity labels
Get-Label | Format-Table Name, Priority, DisplayName

# Get label details
Get-Label -Identity "Confidential" | Format-List

# Create a new label (using New-Label cmdlet)
New-Label -Name "HighlyConfidential" -DisplayName "Highly Confidential" -Tooltip "Use for highly sensitive data" -EncryptionEnabled $true

For verifying label application on a file, use the Azure Information Protection unified labeling client (now built into Office). You can also check the file properties: right-click > Properties > Details > look for "Sensitivity" field.

Microsoft Purview Data Loss Prevention (DLP): DLP policies can detect sensitivity labels and block or warn when labeled content is shared externally. For example, a DLP rule: "If document has sensitivity label 'Confidential', block external sharing and notify admin."

Microsoft Defender for Cloud Apps (formerly Cloud App Security): Defender for Cloud Apps can apply sensitivity labels to files in third-party cloud apps (e.g., Dropbox, Google Drive) using its DLP engine. It can also detect and revoke access to files that have been shared inappropriately.

Microsoft 365 Groups and Teams: Sensitivity labels can be applied to containers (teams, groups, sites). This is separate from item-level labels. Container labels control guest access, external sharing, and privacy settings. The exam tests that container labels and item-level labels are different but can be used together.

Microsoft Purview Compliance Manager: Sensitivity labels contribute to compliance scores for regulations like GDPR, HIPAA, etc. by demonstrating that data is classified and protected.

A common exam question: "Which type of label should you use to ensure that a document is deleted after 5 years?" Answer: Retention label, not sensitivity label. Sensitivity labels protect data; retention labels manage lifecycle. Another trap: "Sensitivity labels can be used to prevent users from deleting a file." False. Sensitivity labels do not control deletion; they control access and encryption.

Auto-labeling can be applied to files in SharePoint, OneDrive, and Exchange (in transit). It cannot be applied to files in on-premises file servers unless you use Azure Information Protection scanner (legacy). The exam may ask: "Which workloads support auto-labeling?" Answer: SharePoint Online, OneDrive for Business, Exchange Online.

Sensitivity labels can enforce:

They cannot enforce:

Scenario 1: Healthcare Organization Classifying Patient Records A hospital uses sensitivity labels to classify patient data. They create labels: 'Public', 'Internal', 'Confidential Medical Records', and 'Highly Confidential - HIPAA'. The 'Confidential Medical Records' label enforces encryption and allows only doctors and nurses with a specific security group to view. It also adds a footer 'CONFIDENTIAL - HIPAA PROTECTED' and a watermark 'PATIENT CONFIDENTIAL'. The label is published to all users with mandatory labeling. Auto-labeling scans SharePoint libraries for documents containing patient names and SSNs, applying 'Confidential Medical Records' automatically. DLP policies block external sharing of any document with that label. Misconfiguration: The offline access period was left at default 7 days, causing doctors on flights to lose access after a week. They increased it to 30 days to match their typical trip duration.

Scenario 2: Financial Firm Protecting Merger Documents A bank working on a merger creates a label 'Merger - Highly Confidential'. This label encrypts files and restricts access to only the merger team (a security group). It sets expiration to 90 days (after merger closes). Visual markings include a header 'HIGHLY CONFIDENTIAL - DO NOT FORWARD'. The label is published only to the merger team. Auto-labeling is not used because the team applies the label manually. A user accidentally shares a document externally; Defender for Cloud Apps detects the label and revokes access automatically. Performance: With thousands of files, label application is instantaneous via Office client. The main challenge is ensuring users remember to apply the label; mandatory labeling solves this.

Scenario 3: Government Agency Using Container Labels A government department uses sensitivity labels for both items and containers. They have a container label 'Secret' applied to a SharePoint site. This restricts external sharing and guest access. Within the site, documents get item-level labels like 'Secret - Personnel' that encrypt and restrict access to specific groups. Misconfiguration: A site owner changed the container label to 'Internal' thinking it would allow broader collaboration, but this inadvertently allowed external users to see the site's metadata. The incident was detected via audit logs. The lesson: container labels and item labels are independent; changing one does not affect the other.