Microsoft Purview Sensitivity Labels

Introduction

In today's data-driven world, organizations face the constant challenge of protecting sensitive information while ensuring its accessibility and usability for legitimate purposes. Microsoft Purview Sensitivity Labels provide a robust and integrated solution within the Microsoft 365 ecosystem to classify, protect, and govern data across various applications and services. These labels are more than just metadata tags; they embed persistent protection, such as encryption and visual markings, directly into the content itself, regardless of where it's stored or shared.

This article delves into the technical intricacies of Microsoft Purview Sensitivity Labels, offering practical guidance for their implementation and management. It's intended for cloud architects, security engineers, compliance officers, and IT administrators responsible for data governance and protection within their Microsoft 365 environments. Whether you're looking to meet regulatory compliance requirements, mitigate data leakage risks, or simply enhance your organization's data security posture, understanding and leveraging sensitivity labels is paramount.

Why this matters

The proper implementation of Microsoft Purview Sensitivity Labels yields significant business and technical advantages. From a compliance perspective, they are instrumental in meeting regulatory obligations such as GDPR, HIPAA, and CCPA by ensuring that sensitive data is classified and protected according to organizational policies. This proactive approach significantly reduces the risk of non-compliance fines and reputational damage.

Cost efficiencies can also be realized by streamlining data protection efforts. Instead of implementing disparate security solutions for different data types, sensitivity labels offer a unified approach across Microsoft 365, Azure, Power Platform, and even on-premises environments. This reduces complexity and administrative overhead. Furthermore, by proactively preventing data breaches and insider threats, organizations can avoid the substantial financial and reputational costs associated with such incidents. Sensitivity labels enhance data governance by providing clear visibility into where sensitive data resides and how it's being used, enabling more informed decision-making and reducing overall risk. For productivity, while security measures can sometimes be perceived as a hindrance, sensitivity labels aim to be as unintrusive as possible. Once applied, protection follows the data, allowing users to collaborate securely without having to manually apply complex security settings.

Key concepts

• Sensitivity Label: A customizable tag that you apply to content (files, emails, sites, teams, database columns) to classify it and, optionally, enforce protection actions.
• Label Policies: Define which sensitivity labels are published to users and groups, and configure settings like default labeling, mandatory labeling, and user justification for label changes.
• Auto-labeling: Uses trainable classifiers, sensitive info types (SITs), and keywords to automatically apply labels to content at rest (SharePoint, OneDrive) or in transit (Exchange Online).
• Client-side labeling: Labels applied by users directly in applications like Word, Excel, PowerPoint, Outlook, and Adobe Acrobat.
• Service-side labeling: Labels applied automatically by services like Exchange Online (via mail flow rules), SharePoint, and OneDrive (via auto-labeling policies).
• Containers: Sensitivity labels can be extended beyond files and emails to protect Microsoft Teams, Microsoft 365 Groups, and SharePoint sites by controlling external sharing, guest access, and unmanaged device access.
• Protection actions: Configurable actions associated with labels, including encryption (with granular permissions), visual markings (headers, footers, watermarks), and content marking.
• Sensitive Information Types (SITs): Patterns – such as credit card numbers or passport IDs – that Microsoft Purview can detect in content to assist with classification and auto-labeling. You can use built-in SITs or create custom ones.
• Microsoft Information Protection (MIP) SDK: Allows developers to integrate sensitivity label functionality into custom applications and services.

Step-by-step implementation

Implementing Microsoft Purview Sensitivity Labels involves a systematic approach, typically starting from the Microsoft Purview compliance portal.

1. Enable sensitivity labels: Ensure the feature is enabled in your Microsoft 365 tenant. This is usually on by default for eligible subscriptions.
2. Define your labeling strategy: Identify what data is sensitive, who owns it, where it resides, and what protection is required.
3. Create your sensitivity labels:

Navigate to the [Microsoft Purview compliance portal](https://compliance.microsoft.com/). In the left navigation, go to Information protection > Labels. Click + Create a label. Configure the label name, display name, and description. Define protection settings: Encryption: Whether to encrypt files and emails. If so, configure user permissions (e.g., specific users/groups, full control, viewer, custom). Visual marking: Add headers, footers, or watermarks. Content marking: (For Office apps) Define protection settings for containers (Sites & Teams): Private or Public group privacy. External users access. Unmanaged device access.

1. Create a label policy:

In the Purview portal, go to Information protection > Label policies. Click Publish labels. Select the labels you want to publish. Choose users and groups to whom the policy applies. Configure policy settings like: "Apply this label by default to documents and emails." "Require users to apply a label to their emails and documents." "Require users to provide justification for removing a label or lowering its classification." * Review and publish the policy.

1. Test the labels: Verify that labels apply correctly in Office apps, Outlook, SharePoint, and Teams.
2. Consider auto-labeling policies: For data at rest (SharePoint/OneDrive) or in transit (Exchange Online).

In the Purview portal, go to Information protection > Auto-labeling. Create a new policy, defining locations (SharePoint sites, OneDrive accounts, Exchange mailboxes). Specify conditions using sensitive information types or trainable classifiers. Choose the sensitivity label to apply.

1. Monitor and refine: Use Purview activity explorer and label analytics to track label usage and make necessary adjustments.

Here's an example PowerShell command to create a basic sensitivity label without protection:

Connect-IPPSSession

New-Label -Name "Internal" -DisplayName "Internal" -Comment "For internal communication and documents." -Active $true -Priority 10 -Tooltip "Content classified as Internal."

Example configuration

This JSON snippet illustrates a granular permission setting for an encrypted sensitivity label, granting specific users different levels of access. This would typically be configured through the Purview compliance portal GUI, but it represents the underlying policy definition logic.

{
  "LabelName": "Confidential - Project Alpha",
  "ProtectionSettings": {
    "AllowFullControl": [
      {
        "Type": "User",
        "Identity": "alice@yourorganization.com"
      },
      {
        "Type": "Group",
        "Identity": "ProjectAlphaAdmins@yourorganization.com"
      }
    ],
    "AllowCoAuthor": [
      {
        "Type": "Group",
        "Identity": "ProjectAlphaTeam@yourorganization.com"
      }
    ],
    "AllowViewer": [
      {
        "Type": "User",
        "Identity": "bob@yourorganization.com"
      }
    ],
    "AllowPrint": true,
    "AllowCopy": false,
    "AllowScreenshot": false,
    "ExpirationDate": "2025-12-31T23:59:59Z",
    "OfflineAccessDays": 7
  },
  "VisualMarkings": {
    "Header": {
      "Text": "CONFIDENTIAL - PROJECT ALPHA",
      "FontName": "Arial",
      "FontSize": 12,
      "FontColor": "#CC0000"
    },
    "Watermark": {
      "Text": "CONFIDENTIAL",
      "FontName": "Arial",
      "FontSize": 80,
      "FontColor": "#CC0000",
      "Opacity": 0.3
    }
  },
  "ContainerSettings": {
    "GroupPrivacy": "Private",
    "AllowExternalUsers": false,
    "BlockUnmanagedDevices": true
  }
}

Common pitfalls

• Over-labeling or under-labeling: Creating too many labels can confuse users, leading to misclassification. Too few labels might not address all data sensitivity needs.
• Neglecting user adoption: Without proper communication, training, and simple policies, users may bypass labels or apply them incorrectly, undermining the system's effectiveness.
• Ignoring existing data: Focusing solely on new data and neglecting to classify and protect existing content in SharePoint, OneDrive, and Exchange can leave significant security gaps.
• Over-reliance on auto-labeling: While powerful, auto-labeling isn't foolproof. It requires careful tuning and monitoring, especially with custom sensitive information types, to avoid false positives or negatives.
• Inconsistent policy enforcement: Not aligning label policies across different workloads (e.g., desktop clients, mobile apps, cloud services) can lead to data exposure.
• Lack of periodic review: Data sensitivity and compliance requirements evolve. Labels, policies, and SITs need to be reviewed and updated regularly to remain effective.

Best practices

• Start small and iterate: Begin with a small set of clearly defined labels for your most critical data, gather feedback, and gradually expand. This aligns with the "Iterate" principle from the Microsoft Cloud Adoption Framework.
• Establish a clear classification taxonomy: Define a concise, understandable labeling scheme that resonates with your users. Leverage the Zero Trust principle of "assume breach" by categorizing data based on its impact if compromised.
• Invest in user training and communication: Educate users on what each label means, why it's important, and how to apply it correctly. Make it easy for them to do the right thing.
• Automate where possible, but monitor closely: Utilize auto-labeling for high-volume content, especially for data at rest. However, implement robust monitoring and auditing to ensure accuracy and address any misclassifications.
• Extend protection to containers: Don't just protect individual files. Apply sensitivity labels to Microsoft 365 Groups, Teams, and SharePoint sites to control access to the collaboration environment itself. This forms a crucial layer in your Zero Trust architecture.
• Integrate with Data Loss Prevention (DLP): Combine sensitivity labels with Microsoft Purview DLP policies to prevent sensitive labeled content from being shared inappropriately, both internally and externally.
• Regularly audit and refine policies: Use the analytics and reporting available in the Purview compliance portal to monitor label usage, identify gaps, and refine your policies and labels over time, adhering to aspects of the Well-Architected Framework's operational excellence pillar.

Further reading

• Learn about sensitivity labels
• Get started with sensitivity labels
• Use sensitivity labels to protect data in Microsoft Teams, Microsoft 365 groups, and SharePoint sites
• Automatically apply a sensitivity label to content
• Scenarios for sensitivity labels