What can data sensitivity labels do? (Microsoft Guidance)

Back to FAQs homepage | Back to Data Sensitivity Labels category

After a sensitivity label is applied to content, for example in an email, meeting invite, document, or Loop page, any configured protection settings for that label are enforced on the content. You can configure a sensitivity label to:

• Control access to content, using encryption for emails, meeting invites, and documents to prevent unauthorized people from accessing this data. You can additionally choose which users or group have permissions to perform which actions and for how long. For example, you can choose to allow all users in your organization to modify a document while a specific group in another organization can only view it. Alternatively, instead of administrator-defined permissions, you can allow your users to assign permissions to the content when they apply the label. For more information about the encryption-based access control settings when you create or edit a sensitivity label, see Restrict access to content by using encryption in sensitivity labels.
  
• Mark the content when you use Office apps, by adding watermarks, headers, or footers to email, meeting invites, or documents that have the label applied. Watermarks can be applied to documents and Loop component and pages, but not email or meeting invites. Example header and watermark:
  
  
  
• Content markings also support variables. For example, insert the label name or document name into the header, footer, or watermark. For more information, see Content markings with variables.Need to check when content markings are applied? See When Office apps apply content marking and encryption.If you have templates or workflows that are based on specific documents, test those documents with your chosen content markings before you make the label available for users. Some string length restrictions to be aware of:Watermarks are limited to 255 characters. Headers and footers are limited to 1024 characters, except in Excel. Excel has a total limit of 255 characters for headers and footers but this limit includes characters that aren’t visible, such as formatting codes. If that limit is reached, the string you enter isn’t displayed in Excel.
  
• Protect content in containers such as sites and groups when you enable the capability to use sensitivity labels with Microsoft Teams, Microsoft 365 groups, and SharePoint sites.You can’t configure protection settings for groups and sites until you enable this capability. This label configuration doesn’t result in documents or emails being automatically labeled but instead, the label settings protect content by controlling access to the container where content can be stored. These settings include privacy settings, external user access and external sharing, access from unmanaged devices, private teams discoverability, and sharing controls for channels.
  
• Apply the label automatically to files and emails, or recommend a label. Choose how to identify sensitive information that you want labeled, and the label can be applied automatically, or you can prompt users to apply the label that you recommend with a policy tip. If you recommend a label, you can customize the prompt but the following example shows the automatically generated text:
  
  
  
  For more information about the Auto-labeling for files and emails settings when you create or edit a sensitivity label, see Automatically apply a sensitivity label to Microsoft 365 data for Office apps, and Labeling in Microsoft Purview Data Map.
  
• Set the default sharing link type for SharePoint sites and individual documents. To help prevent users oversharing, set the default scope and permissions for when users share documents from SharePoint and OneDrive.

For more label configurations, see Manage sensitivity labels for Office apps.