Microsoft Purview: Sensitivity Labels & Automatic Classification

Table of Contents

What is Microsoft Purview?
Designing Your Label Taxonomy
Creating Sensitivity Labels
Publishing Labels via Label Policies
Auto-Labelling Policies
DLP Policy Integration
User Adoption & Rollout Tips

What is Microsoft Purview?

Microsoft Purview (formerly the Microsoft 365 Compliance Center) is the unified governance and compliance portal for Microsoft cloud services. Within it, sensitivity labels are the primary tool for classifying and protecting data — they travel with the document or email everywhere it goes, regardless of where it is stored or shared.

Sensitivity labels can apply:

Visual markings (headers, footers, watermarks)
Encryption via Azure Information Protection (AIP)
Access controls (who can read, edit, print, copy)
DLP policy triggers based on label value
Retention policy association

Sensitivity labels require Azure AD Premium P1 for publishing to users. Auto-labelling (server-side, without user interaction) requires Microsoft 365 E5 Compliance or the standalone Purview add-on. Manual labelling works with M365 E3.

Designing Your Label Taxonomy

The biggest mistake in sensitivity label deployments is creating too many labels. Users will not read 12 labels — they will pick whatever is easiest. The practical sweet spot is 4–6 labels.

A taxonomy that maps well to most organisations:

Public — Approved for external distribution (marketing materials, public reports)

Internal — Default for all internal communications; no external sharing

Confidential — Business-sensitive; encrypted; restricted sharing

Restricted — Highly sensitive (HR, legal, financial); encrypted; named-recipient only

You can add sub-labels under Confidential/Restricted for specific contexts (e.g. "Confidential / HR Only", "Confidential / Finance"). Keep sub-labels to ≤ 3 per parent label.

Align your label names to ISO 27001 information classification terminology if your organisation is certified or pursuing certification. This simplifies audit evidence collection significantly.

Creating Sensitivity Labels

Go to Microsoft Purview Compliance Portal → Information Protection → Labels → + Create a label.

Set the label name and display name. Name is the internal identifier (used in audit logs, PowerShell) — keep it consistent with your taxonomy naming. Display name is what users see in Office apps.

On the Scope page, select the applicable scopes: Files & emails, Groups & sites, Schematized data assets (for Purview Data Map integration).

For Confidential and above, enable encryption. Set the rights model: assign specific users/groups from your directory, or use a "Confidential — All Employees" template.

Configure content markings: add a header (e.g. CONFIDENTIAL), footer, or watermark. Use dynamic tokens like ${User.PrincipalName} for watermarks on restricted docs.

For the Groups & sites scope: configure the SharePoint external sharing setting (e.g. Confidential = No external sharing) and the Conditional Access authentication context if applicable.

Publishing Labels via Label Policies

Creating labels does not make them visible to users — you must publish them via a Label Policy. A label policy defines which users see which labels, and sets defaults and requirements.

Policy Setting	Recommended Configuration
Default label for documents	Internal (auto-apply this label to unlabelled docs)
Default label for emails	Internal
Require users to justify label downgrade	Yes — forces users to state why they're reducing classification
Require users to apply a label	Yes for sensitive groups; optional for general users during rollout
Policy scope	All users (after testing); pilot group initially

Auto-Labelling Policies

Auto-labelling policies scan content in SharePoint, OneDrive, and Exchange and automatically apply a label based on sensitive information types (SITs) — without any user interaction.

Two modes

Client-side (recommend label): In Office apps, prompts the user with a label recommendation when a SIT is detected. User can accept or dismiss. Available with M365 E3.
Server-side (auto-apply): Scans OneDrive, SharePoint, Exchange and applies the label automatically. Runs as a background service. Requires M365 E5 Compliance.

Common Sensitive Information Types to trigger Confidential

EU / US National Identification Numbers
Credit Card Numbers
IBAN / Bank Account Numbers
Medical / Health data (ICD codes, medication names)
Azure AD credentials, AWS keys (detect leaked credentials in documents)

Run auto-labelling policies in Simulation mode before enabling them. Simulation shows you exactly which documents would be labelled (and with what label) across your tenant without making any changes. Review the simulation report thoroughly — auto-labelling millions of files with the wrong label is painful to reverse.

DLP Policy Integration

Data Loss Prevention (DLP) policies in Purview can use the sensitivity label as a condition. This is the most powerful integration: instead of writing complex SIT conditions, you simply say "if this document is labelled Confidential, block external sharing."

Label	DLP Action	Scope
Public	Allow all	All workloads
Internal	Block sharing to external users	SharePoint, OneDrive, Teams
Confidential	Block external sharing, notify user, generate alert	All workloads + Exchange
Restricted	Block all sharing (internal: view-only for non-owners), block email to external, block print	All workloads

User Adoption & Rollout Tips

Technical configuration is 30% of the project. User adoption is the other 70%. A few field-tested practices:

Start with default labelling. Set a default label of "Internal" for all new documents. Most users never need to think about labels — they just work with the default.
Use policy tips instead of blocks initially. Show users a policy tip (notification) when they try to share a labelled document externally, rather than blocking outright. Educate before you enforce.
Translate the label names. "Restricted" means nothing to most users. Add a tooltip description: "Use this for HR records, salary information, legal contracts."
Monitor with Content Explorer. In Purview → Content Explorer, you can see the label distribution across your tenant — which files have no label, which are Confidential, etc. Use this to identify departments that need targeted training.
Set a "label required" policy only after 2–3 months. Forcing users to label every document on day one generates resistance. Let the default label do the work for 90% of documents, then enforce labelling for the remaining sensitive content.

A mature sensitivity label deployment reduces your DLP false-positive rate by 60–80% compared to SIT-only DLP policies, because label-based conditions are semantically precise. "This doc is labelled Confidential" is far more reliable than "this doc contains 16-digit numbers."

Badra Ali Diakite

Senior IT Consultant specialising in Microsoft 365, Intune, Zero Trust architecture and network infrastructure. 15+ years across 28+ countries in both military and enterprise environments.