How do we get started with Microsoft sensitivity labels?

Key facts

• Fewer labels get used correctly; most organizations start with four or five.
• Manual labeling is included in Microsoft 365 Business Premium and E3.
• Automatic labeling generally needs E5 or an E5 Compliance add-on.
• Encryption labels change who can open a file, so test with external partners first.
• Container labels control privacy and sharing for Teams, groups and sites.

What sensitivity labels do

Sensitivity labels in Microsoft Purview Information Protection classify content and can apply protection that travels with it. A label can add a header, footer or watermark, apply encryption that limits who can open the file, and feed data loss prevention and Microsoft 365 Copilot, which respects label permissions.

Labels apply to files and emails, and container labels apply to Teams, Microsoft 365 groups and SharePoint sites. Labeling is built into Office apps on Windows, Mac, mobile and the web, so no separate client is needed.

Design a simple taxonomy

The most common failure is too many labels with names users do not understand. Keep the first version short and describe each label in plain words in the tooltip.

• Sublabels can split a label, for example Confidential for all employees and Confidential for a specific group.
• Label names show to users and to external recipients, so keep them neutral.

Set up the foundation

Before publishing, enable sensitivity labels for Office files in SharePoint and OneDrive. Without it, encrypted files cannot be co-authored, searched or processed by eDiscovery and DLP in the same way. Also consider enabling labels for PDFs and, if you will use container labels, enable labeling for groups and sites in Entra ID.

Create the labels in the Microsoft Purview portal, then publish them with a label policy scoped to a pilot group. The policy can set a default label, require justification to lower a label, and require users to label documents and emails.

Pilot, then roll out

Pilot with IT and one or two departments that handle sensitive data, such as HR or finance. Test opening encrypted files on mobile, sharing with an external partner, using the files in Teams, and using them with Copilot. Collect feedback on label names and tooltips.

Roll out to everyone with short training: what each label means, when to use it and what it does. A default label of General on new documents gives a baseline without forcing a choice on every file. Mandatory labeling can come later, once users are comfortable.

Add automation and containers

Once manual labeling is working, look at automation. Client-side recommended labeling and service-side auto-labeling policies for SharePoint, OneDrive and Exchange can apply labels based on sensitive information types or trainable classifiers. These generally need Microsoft 365 E5, E5 Compliance or E5 Information Protection. Run service-side policies in simulation mode first and review matches before turning them on.

Container labels set privacy, guest access, external sharing and unmanaged device access for teams and sites. Apply Highly Confidential to sites like HR and board, so the right sharing settings follow from the label instead of from memory.

How Accred Consulting approaches it

Accred Consulting delivers sensitivity label rollouts as a fixed-scope project. Discovery reviews licensing, data types, existing sharing and compliance drivers. The proposal sets a clear scope, fixed price and timeline. US-based specialists design the taxonomy with your stakeholders, enable labels for SharePoint and OneDrive, configure label policies, pilot with key departments, prepare user training material and add container labels and auto-labeling where licensed. Accred configures controls that support your compliance program; you and your assessor own compliance. Handover includes documentation and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions