Getting started with sensitivity labels

A sensitivity label is a tag stored in the file or email that Microsoft 365 apps understand. Depending on how you configure it, a label can add a header, footer or watermark, apply encryption so only named people can open the content, restrict printing or forwarding, and control sharing settings for Teams, Microsoft 365 groups and SharePoint sites. Microsoft Learn's "Learn about sensitivity labels" is the reference for every setting.

Labels differ from retention labels. Sensitivity labels are about who can see and do what; retention labels are about how long content is kept. An item can carry one of each. Only one sensitivity label can be applied to an item at a time.

Most small and mid-sized organizations need four or five labels, not twenty. Order matters: Microsoft treats the list as a priority order, with the least restrictive label at the top and the most restrictive at the bottom.

• Microsoft's default label set, created automatically for many new tenants with eligible licences, uses names like Public, General, Confidential and Highly Confidential, with sublabels such as "All Employees" and "Specific People". Adopting it saves design time.
• Write a one-line description users see when they hover: what goes in this label, in plain words.

Encryption is the strongest part of labelling and the easiest to get wrong. You can assign permissions when you create the label (for example, all staff can co-author) or let users assign permissions when they apply it, which suits ad-hoc sharing with an outside party.

Encrypted files behave differently. Several people editing at the same time requires Office for the web or enabling co-authoring for files encrypted with sensitivity labels, and AutoSave is disabled for encrypted files until co-authoring is enabled. External recipients need an identity Microsoft can authenticate. Search, eDiscovery and some third-party tools may need extra configuration to read encrypted content.

1. 01

   Publish to a pilot group

   IT and two or three business users label real work for two weeks and report friction.

2. 02

   Explain the why

   A five-minute briefing with examples of each label beats a policy document.

3. 03

   Turn on justification

   Microsoft lets you require a reason when a user lowers or removes a label, which creates an audit trail without blocking work.

4. 04

   Expand by department

   Start where sensitive data concentrates: finance, HR, legal, leadership.

5. 05

   Apply labels to containers

   Once file labels are stable, use labels on Teams and SharePoint sites to control guest access and sharing at the site level.

A label policy can set a default label for new documents and emails, and can require users to apply a label before saving or sending. A default of General or Internal is common; it nudges behaviour without making people stop and think about every message.

Auto-labelling comes later. Client-side auto-labelling recommends or applies a label in Office apps when content matches sensitive information types, such as Canadian Social Insurance Numbers or credit card numbers. Service-side auto-labelling scans content at rest in SharePoint, OneDrive and Exchange. Run auto-labelling in simulation first and review false positives before you enforce it. Licence requirements differ by feature; check Microsoft's current service description before you plan on a capability.

Microsoft 365 Copilot respects sensitivity labels and encryption. Microsoft's guidance is that if a label applies encryption that grants a user the VIEW right but not the EXTRACT right, Copilot cannot summarize that content for them while it is at rest. That makes labels one of the few direct controls over what Copilot can surface.

Before a Copilot rollout, label your most sensitive sites and libraries, check oversharing (permissions matter more than labels), and decide whether Highly Confidential content should allow EXTRACT at all. Copilot output can also inherit the label of its source material, so labelled sources tend to produce labelled results.

• Starting with too many labels. Users pick the wrong one, or always the lowest, when faced with a long list.
• Encrypting everything marked Confidential on day one, before testing scanners, integrations and external recipients.
• Labelling files but leaving the SharePoint sites that hold them open to the whole company or to Anyone links.
• No owner for the label scheme. Someone needs to approve new labels and changes, or the list grows without control.
• Forgetting mobile and Mac users when testing; label behaviour differs slightly across apps and platforms.