Microsoft Purview sensitivity labels: how to classify and protect business data

A commercial lines producer at a 30-person independent insurance agency gave notice on a Friday in March and started at a competing agency the following Monday. Over the next three weeks, four of her larger accounts got calls from the new agency, and every one of them had a renewal coming up within 90 days.

The agency’s IT provider went back through her last month in the Microsoft 365 audit log. On the Saturday before she resigned, she’d downloaded the renewal list from SharePoint on a connection outside the office. It had every commercial account the agency wrote, with renewal dates, premiums, and the name and phone number of the person who signs off on each policy. The log showed the download but nothing about where the file went next.

The agency’s lawyer took up her non-solicitation agreement, and the owner asked the IT provider something narrower. If someone leaves with a copy of a file like that, can the copy stop opening once they no longer work there?

Mostly, yes. A sensitivity label that encrypts a file can make a copy stop opening soon after the person’s account is turned off, as long as somebody else applied the label. Setting it up takes some decisions about your data and a few hours in the Microsoft Purview portal. Here’s what sensitivity labels are, how to design a small set your staff will use, how to create and publish them, what they do in Word, Excel, Outlook, Teams, and SharePoint, and which parts need a bigger license.

Sensitivity labels at a glance

Question	Answer
What is a sensitivity label?	A tag on a document or email, like Internal or Confidential, that can also encrypt it or stamp it with a header, footer, or watermark.
Does the label stay with the file?	Yes. It’s saved inside the file, so it goes wherever the file goes, and any encryption goes with it.
Which plans include labels?	Business Premium and the E3 and E5 plans. Business Basic and Business Standard don’t.
Can labels be applied automatically?	Yes, with Microsoft 365 E5 or the Purview add-on for Business Premium. On Business Premium alone, people choose labels themselves, starting from a default.
How many labels should a small business have?	Three or four. Microsoft has found labeling works noticeably worse once people have more than five to choose from.
Can clients open a labeled file?	Yes, unless the label encrypts it for your staff only. Decide how sensitive files go to outsiders before you turn encryption on.
How long does setup take?	Usually two to four weeks alongside other work. The longest part is agreeing on what belongs under each label.

What a sensitivity label is

A sensitivity label is a tag your business defines and your staff put on documents and emails. Word, Excel, and PowerPoint show it beside the file name at the top of the window, and Outlook shows it on the subject line. The label is saved in the file’s metadata, so it’s still there after the file is copied to a laptop, attached to an email, or uploaded somewhere else. An item carries one sensitivity label at a time.

Microsoft’s name for this part of Purview is Information Protection. Older guides call it Microsoft Information Protection or Azure Information Protection, and the old Azure Information Protection add-in for Office has been retired in favor of the labeling built into the Office apps. If you’re new to Purview, what Microsoft Purview is and what it can do covers where labels fit next to data loss prevention, audit, and retention.

A label can do any of these, alone or together:

• Classify. With no protection settings, the label is a visible tag. People can see how a file should be handled, and other tools, like data loss prevention and eDiscovery searches, can act on it.
• Mark. It adds a header, a footer, or a watermark to documents, and a header or footer to email.
• Encrypt. Only the people the label names can open the item, and the label can limit what they do with it, like editing, printing, copying, or forwarding.
• Protect a team or site. Put on a team in Microsoft Teams or on a SharePoint site, a label can make it private, keep guests out, and limit sharing outside the business.

Outlook has had a Sensitivity setting for years, with options like Personal, Private, and Confidential. It only tells the recipient what the sender thinks of the message and doesn’t protect anything. Retention labels are a separate part of Purview that decide how long an item is kept, and a document can carry one of each.

What your Microsoft 365 plan includes

Business Premium covers labels people apply themselves, including encryption and markings. For labels applied automatically, you need Microsoft 365 E5 or the Purview add-on for Business Premium, at a list price of $10 per user per month.

Capability	Business Premium or E3	Microsoft 365 E5
Labels people apply in Office apps on desktop, web, and mobile	Yes	Yes
A default label, and requiring a label before saving or sending	Yes	Yes
Encryption, headers, footers, and watermarks	Yes	Yes
Labels on teams, Microsoft 365 groups, and SharePoint sites	Yes	Yes
Labels recommended or applied automatically while someone works in Office	No	Yes
Auto-labeling policies for files already in SharePoint and OneDrive, and for email	No	Yes
A default label for a whole SharePoint document library	No	Yes
Labels on calendar invites and meetings	No	Yes, though Teams meeting options also need Teams Premium
Watermarks that show the email address of the person viewing the file	No	Yes
Content explorer and activity explorer reports	No	Yes

The Purview add-on brings automatic labeling to Business Premium. If you want it for any of the other E5 rows, check Microsoft’s current service description before you buy. Business Basic and Business Standard don’t include sensitivity labels at all, and our licensing guide compares the plans in more detail.

Design the labels before you open the portal

The portal work fits in an afternoon, but agreeing on what each label means usually takes a couple of meetings with the people who handle the files.

Start with what the business holds

Sit down with the owner and whoever runs operations, and list the kinds of documents the business keeps: client files, employee records, contracts, financial statements, pricing, marketing material. For each one, write down who inside the business needs it and who outside gets copies, like clients, vendors, auditors, or a payroll service. Build your labels from that list, and drop any label nobody can name a real document for.

Labels work on top of your sharing settings, so check those too. If nobody has looked at external sharing or guest access in a while, the data and sharing section of our Microsoft 365 security audit checklist walks through both.

Four labels cover most small businesses

Label	What goes in it	What the label does	Who can open it
Public	Anything approved for anyone, like brochures, published price lists, and job postings	Nothing beyond the tag	Anyone
Internal	Everyday work that isn’t secret but isn’t for publishing, like procedures, internal memos, and most email	Adds an optional “Internal” footer	Anyone it’s sent to
Confidential	Client and employee records, contracts, financials, and anything with personal information	Encrypts the file and adds a “Confidential” footer	Everyone in the business
Highly confidential	Payroll, HR investigations, the business’s own bank and tax records, and anything about selling the business or buying another one	Encrypts the file and adds a watermark	A named group, like the owners and HR

Three can be enough. The tax firm in the Purview overview published Public, Internal, and Client confidential, and nothing else.

A few rules for names and descriptions:

• Use the words your staff already use. At an accounting firm, “Client confidential” says more than “Restricted”.
• Write the description for the person choosing. It appears when someone hovers over the label, so give two or three examples from your own business, like “Tax returns, engagement letters, anything with a Social Security number.”
• Put the labels in order. In the portal, the least sensitive label goes at the top of the list and the most sensitive at the bottom. Purview uses that order to tell when a change lowers a label.
• Leave out sublabels at first. Purview can group labels in two levels, like Confidential with “All staff” and “Owners only” underneath. That suits a large organization, but it doubles the choices on everyone’s menu.

Decide how sensitive files go to people outside the business

A Confidential label that encrypts files for your staff also locks out the client you email the file to. Settle how files leave before encryption goes on, or people will start removing labels to get their work done.

Most small businesses use one or more of these:

• An email label for outsiders. A label scoped to email, using the Encrypt-Only or Do Not Forward option, encrypts the message for whoever it’s addressed to. Recipients on Gmail, Yahoo, or another outside service read it in Microsoft’s secure viewer after signing in with Google or entering a one-time code.
• A sharing link from SharePoint or OneDrive that goes to one named person and expires, set up the way the guest access guide describes.
• A client portal, if your tax, accounting, or practice management software already has one.

A file labeled Confidential keeps its own encryption when it’s attached to an encrypted email, so the client still can’t open it. Someone has to lower its label first, and only the person who applied that label, or someone the label gives the Owner permission, can do it. The label policy can ask them for a reason when they do.

Attachments on an Encrypt-Only email need one more decision. By default, an unencrypted Word, Excel, or PowerPoint attachment picks up the email’s encryption and keeps it after the client downloads it, and a client on Gmail may not be able to open it in Word. An Exchange Online setting, DecryptAttachmentForEncryptOnly, delivers those attachments without encryption once the recipient has signed in to read the message. Whichever you choose, test it before rollout. Send a message with your email label and an unencrypted attachment to a personal Gmail address and open both, then try a Confidential attachment and confirm it won’t open.

Create the labels in the Purview portal

You’ll need an admin account with the right Purview role, such as Global Administrator or Information Protection Administrator. Sign in at purview.microsoft.com and go to Solutions, then Information Protection.

1. See whether labels already exist. Microsoft creates a starter set for some newer tenants: Personal, Public, General, Confidential, and Highly Confidential, with sublabels under the last three. A default policy publishes them to everyone and puts General \ All Employees (unrestricted) on unlabeled documents, email, and meetings. On tenants licensed for automatic labeling, Microsoft also sets up auto-labeling policies for credit card numbers that run in simulation and turn themselves on after a set number of days unless someone edits them. If your tenant has any of this, edit it to match your plan, and don’t add a second set of labels alongside.
2. Turn on labels for SharePoint and OneDrive. If the Information Protection pages show a banner with a Turn on now button, select it while signed in as a Global Administrator. Until you do, SharePoint and OneDrive can’t read inside encrypted files, so those files don’t show up in search, can’t be opened in a browser or edited by two people at once, and aren’t checked by data loss prevention.
3. Create each label. On the Sensitivity labels page, select Create a label. (Tenants on Microsoft’s newer label layout show Create, then Label.) Give it a name, the description people will see, and a color. For the scope, choose Files & other data assets and Emails. Labeling meetings needs E5, and the Groups & sites option only appears after labels for teams and sites are switched on.
4. Set the protection. For Confidential, turn on encryption, choose to assign permissions now, add all users and groups in your organization with the Editor permission (called Co-Author in older guides), and set offline access. Then add the footer text under content marking.
5. Put the labels in order, least sensitive at the top.
6. Turn on co-authoring for encrypted files. It’s under Settings, Solution settings, Information Protection, Co-authoring for files with sensitivity labels. Without it, two people can’t work in the same encrypted spreadsheet at once in the desktop apps, and AutoSave stays off for those files. It changes where Office stores label information, so check first that nothing else in your setup reads labels the old way. Once it’s on, only PowerShell can turn it off, and Microsoft warns that doing so loses label information.

Choosing the encryption settings

When a label encrypts, you decide who can open the item and what they can do with it, in one of two ways.

• Assign permissions now. The label decides. “All users and groups in your organization” with the Editor permission is the usual choice for Confidential. For Highly confidential, name a group, like the owners and HR, so nobody else in the business can open those files. You can also add a partner company’s email domain. One label can give different people different levels, so an office manager or an owner can have the Owner permission, which lets them lower or remove the label on files other people labeled.
• Let users assign permissions. The person applying the label decides. In Outlook, that means Do Not Forward, where recipients can’t forward, print, or copy the message, or Encrypt-Only, where the message stays encrypted but recipients can otherwise do what they like with it. In Word, Excel, and PowerPoint, people are asked who should be able to open the file.

Next come the time settings. Leave access expiry at Never unless a document has a genuine end date. SharePoint can’t open, search, or scan files under a label that expires, and co-authoring stops working for them too.

Offline access decides how long someone can keep opening an encrypted file without checking back with Microsoft. With Always, a person who has opened a file can keep opening it for up to 30 days, which is how long the license their computer saved stays valid by default. Microsoft recommends 7 days for sensitive business data like contracts and sales figures, and Never for employee and customer information and anything else that would do real damage if it got out. With Never, the file checks in on every open, so it won’t open without an internet connection.

After an employee leaves, disable their account and sign them out of every session, and they can’t check in anymore. A copy of a file under a Never label stops opening almost at once, and one under a 7-day label stops within a week of the last time they opened it while they still worked there.

Files the person labeled themselves are the exception. Whoever applies an encrypting label becomes the file’s Rights Management issuer, keeps full control of it, can keep opening it offline whatever the label says, and could take the label off before leaving. For a file like the renewal list, that means the label should be applied by someone other than the people who might walk out with it.

The Editor permission includes copying and printing, so while someone still works for you they can copy a Confidential file into a new spreadsheet or print it, and nothing stops them photographing the screen. The Restricted Editor permission leaves out Copy and Print, which blocks both in Office apps. It also stops Copilot from summarizing the file for that person and stops them filtering data in Excel, so save it for files where that trade-off is acceptable.

Headers, footers, and watermarks

Content marking adds text to the file itself. Headers and footers work in Word, Excel, PowerPoint, and Outlook. Watermarks work on documents but not on email. The text can include the label name, the file name, or the name of the person who applied the label, and you can set different text for each app.

Test markings against your templates before rollout. A header can sit on top of a letterhead, and Excel allows only 255 characters across its header and footer, formatting codes included. Anyone who can edit a file can also delete a marking, so treat it as a reminder for the reader. Watermarks that show the email address of whoever is viewing the file, which can’t be removed without removing the label, need E5.

Labels for teams and SharePoint sites

The same label, or a separate one made only for sites, can protect a whole team or SharePoint site. A site label controls:

• Whether the team or site is private or public
• Whether owners can add guests
• How far sharing outside the business can go, from anyone with a link down to only people in your organization
• Access from computers your business doesn’t manage, which works together with Conditional Access

A site label doesn’t label the files inside. A spreadsheet saved to a team labeled Confidential stays unlabeled until someone, or an auto-labeling policy, labels it. When someone uploads a file whose label is higher than the site’s, SharePoint emails them and the site owners.

Switching on labels for teams and sites is a one-time job for an admin, done in Microsoft Entra and Security & Compliance PowerShell. Test a site label with a few people before everyone gets it. If you ever retire one, take it out of the label policy before you delete it, because deleting a site label that’s still published can make new teams and sites fail to create.

Publish the labels to your staff

Nobody sees a label until it’s in a label policy. In Information Protection, open Publishing policies and select Publish label. A policy has three parts: the labels, the people who get them, and the settings.

Most small businesses need one policy for everyone. Add a second only when a group needs something different, like Highly confidential published only to the owners and HR. When someone is in two policies and the settings clash, the policy lower in the list wins.

These are the settings to decide:

• A default label for documents. Internal is the usual choice. Current versions of Word, Excel, and PowerPoint also apply it to unlabeled files when they’re opened, so a report exported from another system picks up Internal the first time someone opens it. Microsoft advises against a default label that encrypts, because people would lock outsiders out of everyday documents without noticing.
• A default label for email. Current versions of Outlook let you set it separately. Internal works, and so does no default.
• Requiring a label. People can’t save a document or send an email without one. Pair it with a default label, or people get a prompt on every new file.
• Asking for a reason when someone removes a label or lowers it. Turn this on.
• Email inheriting a label from attachments. Outlook can give a message the highest label among its attachments.
• A help link. Point it at a one-page explanation of your labels, with examples. It shows up in the Sensitivity menu.

Allow up to 24 hours for new labels and policy changes to reach everyone. Publish to three or four people first, wait at least a day, try a labeled file in Word, Outlook, and SharePoint, and then add everyone else. That also gives SharePoint time to pick up a new encrypting label before the first files with it arrive.

Then spend 20 minutes at a staff meeting on it. Go through each label with two examples, show how to send a client a file safely, and say who to ask when nobody’s sure.

Manual, default, and automatic labeling

Manual labeling

People choose a label from the Sensitivity button on the Home tab, or from the sensitivity bar at the top of the window in Word, Excel, and PowerPoint and on the subject line in Outlook. It works on Windows, Mac, the web, iPhone, iPad, and Android, as long as they’re signed in with their work account. Once labeling is on for SharePoint and OneDrive, a file can also be labeled from its details pane without opening it, including from the Files tab in Teams. On Windows, Microsoft’s Purview Information Protection client adds labeling to File Explorer for files that aren’t Office documents.

Default labeling

The default label from the policy does most of the work on Business Premium. Everything starts as Internal, and people move a file up to Confidential when it holds client or employee data. That covers new work well, but it won’t move an old client file up to Confidential, and a file nobody opens stays unlabeled.

Automatic labeling

With E5 or the Purview add-on, labels can be applied for people in two ways:

• In Office apps, a label is recommended or applied while someone works, when the file contains information Purview recognizes, like credit card or Social Security numbers. A recommendation appears as a prompt the person can accept.
• Auto-labeling policies label files already stored in SharePoint and OneDrive, and email passing through Exchange. Each one runs in simulation first, so you can review what it would label before it labels anything.

Automatic labeling won’t replace a label someone chose by hand, though it can replace a default label. E5 also lets a SharePoint document library carry a default label, so files saved there pick it up.

It’s worth paying for when years of client files already sit in SharePoint and nobody’s going to label them by hand, when files keep arriving from other systems unlabeled, or when an auditor expects sensitive files to be labeled without relying on people to remember. Without it, data loss prevention on Business Premium can still find Social Security and credit card numbers in files and email that carry no label at all.

How labels behave in each app

Word, Excel, and PowerPoint. Saving or exporting to PDF from these apps keeps the label, and on Windows it keeps the encryption too. Encrypted PDFs open in Microsoft Edge. In Office for the web, an encrypted document can be opened and edited by the people the label allows, but it can’t be printed, downloaded, or saved as a copy from there.

Outlook. An Office attachment that isn’t encrypted picks up the email’s protection, and one with its own encrypting label keeps that label’s permissions. Encrypted email to outside addresses is read in Microsoft’s secure viewer.

Teams. A label on a team sets its privacy and guest settings, and Teams applies the same label to the team’s SharePoint site and Microsoft 365 group. Files shared in channels and chats are stored in SharePoint and OneDrive, so they carry their own labels. Ordinary chat messages can’t carry a label, and labeling Teams meetings needs E5 and Teams Premium.

SharePoint and OneDrive. With labeling turned on, a Sensitivity column shows each file’s label, and encrypted Word, Excel, PowerPoint, and PDF files can be searched, opened in the browser, and checked by data loss prevention. PDF support is a separate switch. Files that were labeled and encrypted before you turned labeling on need to be edited, or downloaded and uploaded again, before SharePoint can read them.

Copilot. Microsoft 365 Copilot shows the label of the files an answer drew on. From an encrypted file, it only summarizes content the person has the right to copy. Under a label that lets someone view a file but not copy from it, Copilot can only give them a link to the file.

A worked example

The agency from the start is a composite, and the figures are illustrative.

The licenses. Thirty people on Business Premium. Nothing new was bought.

The inventory. The owner and the office manager spent an afternoon listing what the agency holds: quotes, applications, and policy documents, the weekly renewal list, client lists exported from the agency management system, commission statements, carrier contracts, employee files, and marketing pieces. The personal lines side also held driver’s license numbers and dates of birth for every auto policy.

The labels. The agency published five, though most staff see three in Word and four in Outlook.

• Public, for marketing.
• Internal, the default for documents and email, with no encryption and a small footer.
• Client confidential, encrypted for everyone in the agency with the Editor permission, and the Owner permission for the office manager. Offline access is set to 7 days, and it adds a footer. Microsoft suggests Never for customer information, but the agency wanted staff to be able to open client files during a storm closure.
• Owners only, encrypted for a group of the two owners and the office manager, offline access set to Never, with a watermark. A second policy publishes it to those three people only.
• Encrypted email, scoped to email only and using Encrypt-Only, for sending documents to clients and carriers.

What goes where. Quotes, applications, and policy documents travel to clients and carriers, so they stay Internal and go out with the Encrypted email label. Client confidential is for what stays inside: the renewal list, client lists and other exports, account notes, and anything with driver’s license numbers that isn’t headed out. Commission statements and employee files went under Owners only.

The renewal list. The office manager builds it every Monday, labels it Client confidential, and saves it to the Renewals folder. Labeling is a written step in her procedure, and because she applies the label, a producer who downloads the list can’t take it off. Two staff members spent a morning labeling client lists and account files for policies renewing in the next six months.

SharePoint and Teams. Labeling was turned on for SharePoint and OneDrive, and so was co-authoring for encrypted files. The producers’ team in Teams got a label that keeps it private and keeps guests out.

Sharing. When a Client confidential file does have to leave, the person who labeled it or the office manager changes it to Internal and types the reason.

Offboarding. The agency changed the order of its offboarding checklist. The account is now disabled, and signed out of every session, during the exit meeting instead of at the end of the week.

The rollout. Three people used the labels for a week, then everyone got them, with a 20-minute walkthrough at the Monday staff meeting. Setup took about 16 hours of the IT provider’s time, the owner’s afternoon on the inventory, and about four hours of the office manager’s.

What it doesn’t cover. Client confidential gives everyone the Editor permission, so a producer who still works there can copy the renewal list into a new spreadsheet or print it. Files people labeled themselves stay open to them after they leave, which is one reason the office manager labels the renewal list. Purview’s insider risk management, which needs E5 or the add-on, looks for patterns like a burst of downloads around a resignation, and the owner put it on the list to revisit next year.

In August, another producer left for a competing agency. The IT provider disabled her account and signed her out of every session while she was still in the exit meeting. Any copy of the renewal list she had at home would stop opening within seven days of the last time she’d opened it before she left.

Sensitivity labels for Tampa Bay businesses

Sequentur is headquartered in Clearwater, Florida, with a team in Tampa. Hurricane season affects one encryption setting in particular, and Florida’s breach law gives encryption some extra weight.

Set offline access with hurricane season in mind

Encrypted files check in with Microsoft when they’re opened, and the offline access setting decides how often. After a storm, an office can stay closed for days, and people end up working wherever there’s power, sometimes with no internet at all. A file under a Never label won’t open there, and one under a 7-day label only opens if the person opened it in the week before.

Keep Never for your most sensitive label only, and publish that label to the few people who work with those files. Before the season starts on June 1, open a labeled file on a laptop with Wi-Fi turned off, so you know what staff will see. It also helps to know that Office on Windows can apply an encrypting label without a connection, while Mac, iPhone, iPad, and Android need one. Put the test result and that difference in the storm plan, alongside the rest of what happens to your data if your office floods.

Encrypted files and Florida’s breach law

Florida’s breach statute, section 501.171, leaves information that’s encrypted, secured, or modified so it can’t be used out of its definition of personal information. If a laptop goes missing, your lawyer will want to know which files on it were encrypted, and whether the laptop itself was, since someone who gets past its sign-in can still open a Client confidential file its owner opened that week. Save a copy of each label’s settings with the date you changed them, so you can show what protection a file carried on a given day. The Purview overview covers the statute’s 30-day notice deadline, and how it applies to a real incident is a question for counsel.

Common mistakes

1. Making the default label encrypt. Every quote, letter, and spreadsheet becomes unreadable to the people you send it to, and staff learn to strip labels to get around it.
2. Publishing too many labels. Given a long menu of labels and sublabels, most people stop reading and choose whatever sits at the top.
3. Leaving labeling off in SharePoint and OneDrive. Encrypted files there disappear from search and from data loss prevention checks, and can’t be opened in a browser.
4. Deleting a label you no longer want. Remove it from the label policy instead. A deleted label that was on files in SharePoint or OneDrive no longer protects them, and they download with no label or encryption at all.
5. Publishing to everyone on day one. Labels take up to a day to show up everywhere, and any mistake hits the whole business at once.
6. Assuming labels cover files that don’t have one. A fresh export, a scanned document, or a file someone saved from an email starts out unlabeled, or with only the default label.
7. Disabling a departing employee’s account days later. Encryption only shuts someone out once their account can’t sign in, so disable the account and end its sessions before they leave the building.

What is next in this series

The next article covers data loss prevention policies in Microsoft Purview: how to find and block sensitive information like Social Security and credit card numbers in email, SharePoint, OneDrive, and Teams, how to start a policy in simulation mode, and how policy tips warn people before anything gets blocked. After that comes Compliance Manager.

How Sequentur can help

If you’d like help designing labels or turning on encryption without locking out your clients, schedule a call. If you’re in Tampa or Clearwater, we can run the planning session at your office.