Microsoft Sensitivity Label Complete Design: 5-Tier Classification, Auto-labeling, Encryption, Container Labels

Sensitivity Labels are the core feature of Microsoft Purview Information Protection, providing a way to assign 'classification labels' to documents, emails, sites, and data across the organization. Applying a label automatically triggers encryption, watermarks, headers/footers, content marking, and DLP integration. The standard label hierarchy: 1) Personal, 2) Public, 3) Internal (employees only), 4) Confidential (specific groups only), 5) Highly Confidential (encryption + permission-restricted). Labels are applied uniformly across Microsoft 365 apps (Word, Excel, PowerPoint, Outlook, Teams, SharePoint, OneDrive), Power BI, Fabric, and Defender for Cloud Apps, serving as the foundation of an organization-wide data classification strategy.

The standard pattern recommended by Microsoft (customizable per organization). Personal: personal files and private data, outside the organization's protection scope. Public: already-public or to-be-published information (press releases, public materials, websites), no protection needed. Internal: employees-only viewing (internal memos, guidelines, standard documents), Notify when sent externally. Confidential: sensitive information (financial data, HR data, sales strategy), accessible only to specific internal groups, encryption applied, external sharing restricted. Highly Confidential: top secret (M&A information, patent applications, customer PII), only Owner + designated users, mandatory encryption, no print/copy/forward, watermarks, expiration dates. The hierarchy escalates sensitivity in the order Personal → Public → Internal → Confidential → Highly Confidential, and Sub Labels (Confidential\Finance, Confidential\HR) for departmental subdivision are also standard. In production, a combination of industry standards + organizational customization is optimal.

Auto-labeling automatically detects sensitive data and applies labels. Two modes: Client-side Auto-labeling: detects in the background when documents are saved in Microsoft 365 apps (Word, Outlook) → suggests labels (applied after user approval). Server-side Auto-labeling (Auto-labeling Policy): automatically scans SharePoint Online, OneDrive, and Exchange Email → detects sensitive data → automatically applies labels (no user action required). Detection criteria: 1) Sensitive Info Types (SIT, e.g., credit card numbers, SSNs), 2) SIT thresholds (apply when X or more matches), 3) Trainable Classifier (organization-specific classification based on machine learning), 4) contextual conditions (sender, recipient, location). Typical rules: 1) 'Detect 5+ credit card numbers → automatically apply Confidential\Finance label', 2) 'Detect employee SSN → Highly Confidential\HR'. Auto-labeling is essential for organization-wide rollout of Sensitivity Labels; relying on manual labeling has clear coverage limitations.

When encryption is configured on a Sensitivity Label, labeled files are encrypted with Microsoft 365 Rights Management (formerly Azure Rights Management), and only authorized users can decrypt them. User Assigned Permissions: specify fixed users/groups + permission levels (Owner, Co-Owner, Co-Author, Reviewer, Viewer, Custom) at label definition. User Defined Permissions: users specify them individually when creating the file (for external sharing). Encryption with Custom Permissions: detailed permission customization (per-action control over print, copy, forward, edit). Double Key Encryption (DKE): for top-secret data, dual encryption with Customer-managed Key + Microsoft Key — even Microsoft cannot decrypt. Even when encrypted files are sent outside the organization, the recipient cannot open them without Entra ID authentication + an authorized account. This is an essential feature for meeting Data Protection requirements of compliance regimes (GDPR, HIPAA, PCI DSS).

Container Labels apply labels at the container level — SharePoint Site, Teams, Microsoft 365 Group. While Document Labels protect individual files, Container Labels unify security settings for the entire container. Container Label configuration: 1) Privacy (Public, Private), 2) External User Access (Allow, Block), 3) Unmanaged Device Access (Allow, Block, Limited), 4) Authentication Context (requires a specific Conditional Access policy), 5) Default Document Label (label automatically applied to files inside the container). Typical scenarios: 1) SharePoint Site with 'Confidential\HR' label → External User Access Block + Unmanaged Device Block + Default Document Label applied, 2) 'Highly Confidential\M&A' Teams → only specific approved devices can access. Combining Container Labels with Document Labels achieves dual protection at both the container and file levels.

MIP Scanner is an agent that automatically applies Sensitivity Labels to documents on on-premises file servers (Windows file servers, NAS). Install MIP Scanner Service on Windows Server → configure target paths and SQL Server (metadata DB) → run periodic scans. Detection criteria are the same as Auto-labeling Policy (SIT, Trainable Classifier). Typical use cases: 1) retroactively labeling existing documents on on-prem file servers, 2) data classification before Azure migration, 3) continuous scanning to automatically label new files, 4) generating Discovery reports for compliance audits. Standard two-stage operation: Discovery mode (detect only, no labels applied) and Enforce mode (actually apply labels). It's often used in cloud migration projects as a Pre-migration analysis tool, and is an important feature for organizational data visibility.

Key practices: 1) 5-tier standard labels + departmental Sub Labels for organizational customization, 2) set Default Label to Internal (so users get labels applied without thinking), 3) automatically detect sensitive data with Auto-labeling Policy, 4) enforce Mandatory Labeling (no save without a label), 5) require Justification when Downgrading (Confidential → Internal), 6) configure label UI colors that are easy to see in Microsoft 365 apps, 7) user education content (Microsoft Viva Learning integration), 8) dual protection by combining Container Labels and Document Labels, 9) send Sensitivity Label events to Microsoft Sentinel, 10) quarterly review of label usage statistics (which labels are unused, where they're being bypassed). Labeling is 'organizational culture change' — success hinges on both wheels: technical configuration + ongoing Change Management.

SC-400 (Information Protection and Compliance Administrator Associate) is the flagship certification, with Sensitivity Labels heavily tested in Domain 1 (Information Protection, 30-35%). SC-100 (Cybersecurity Architect Expert) covers the Data pillar of zero-trust strategy, MS-102 (Microsoft 365 Administrator Expert) Domain 4 (Purview, 20-25%) covers enterprise-wide deployment, SC-200 (Security Operations Analyst) covers label-based DLP event operations, and AI-103 (GA 2026-06) covers label application to AI-generated data. As the core feature of Microsoft Purview Information Protection, it's an essential skill for data governance professionals.