AB-900 lesson 5: labels and retention

A sensitivity label is a tag that classifies a file, email or container by how sensitive it is and can enforce protection on it, and the tag is stored in the item’s metadata so it stays with the content wherever it is saved. Retention is a different job: a retention policy or label decides how long content is kept or when it is deleted. Sensitivity labels answer “who may see this and how must it look”, retention answers “how long must we keep it”. Both belong to Microsoft Purview, and both can sit on the same document at the same time.

Classification comes first

Purview cannot protect what it cannot recognise. Classification is the step that identifies content, and it uses three kinds of detector:

• Sensitive information types match patterns such as card numbers or national ID numbers.
• Trainable classifiers recognise categories of document, such as contracts, learned from examples.
• Labels already applied, by a user or automatically, which later tools can filter on.

Classification is not protection by itself; labels, DLP and the explorers act on it. A label can be applied by a person who chooses it, by default for unlabelled items, by a recommendation prompt, or automatically when content matches a condition. The next lesson covers the tools that read this classification.

What a sensitivity label can do

A label is created and managed in the Microsoft Purview portal under Information Protection, then published to users or groups through a label policy. Published labels appear in Office apps, for example on the Sensitivity button of the Home tab. What the label does once applied depends on how it was configured:

Two details are worth remembering. A container label does not label the files inside the site; it controls access to the container. And an item can carry only one sensitivity label, and the order of labels in the label list reflects their priority, from least to most restrictive.

The figure above shows the two tracks. The upper track follows the content: created, classified, labelled, protected, and still protected after it is downloaded or emailed. The lower track is retention and runs independently of the label’s sensitivity.

Retention and Data Lifecycle Management

Data Lifecycle Management is the Purview solution for retention. It offers three outcomes: keep content for a period, delete it after a period, or keep it and then delete it. Two tools deliver them:

• A retention policy is applied to locations such as all Exchange mailboxes, SharePoint sites, OneDrive accounts or Teams messages. Users do nothing.
• A retention label is applied to individual items, manually or automatically, and is published to locations. Retention labels do not persist if the content leaves Microsoft 365, unlike sensitivity labels.

When content must be kept and a user deletes it, a copy is held in a hidden secure location until the period ends. For SharePoint and OneDrive this is the Preservation Hold library, which counts against storage. Teams messages do not support retention labels, so retaining them calls for a retention policy.

Worked example: a 200-person consultancy

A consultancy wants three things. Client proposals marked “Confidential” must only open for the delivery team, even if mailed to a client by mistake. Finance mail must be kept for seven years and then deleted. Every Teams site for a client engagement must block guest access by default.

The admin maps each need to a feature. Proposals get a sensitivity label with encryption limited to named groups and a header marking. The finance requirement is a retention policy on the finance mailboxes set to retain seven years and then delete. The client sites get a sensitivity label with container settings, published so that it is chosen when a team is created. No single feature covers all three.

Easy to confuse

• Sensitivity label versus retention label. One protects and marks, the other schedules keeping and deletion. A retention label has no encryption, and a sensitivity label has no deletion timer.
• Label versus DLP policy. A label travels with the item. A DLP policy watches activity at a location and acts when a rule matches, for example blocking an external share.
• Retention policy versus retention label. A policy covers a location broadly; a label targets specific items and can mark them as a record.
• Labelling a site versus labelling its files. The container label governs access to the site; items need their own labels.

Key points

• Sensitivity labels classify and can protect with encryption, content markings and container settings; the label sits in metadata and persists with the content.
• Classification (sensitive information types, trainable classifiers) identifies content; labels and policies act on it.
• Labels reach users through label policies published to users or groups.
• Retention policies apply to locations; retention labels apply to items and can be applied automatically.
• An item can have one sensitivity label and one retention label together, doing different jobs.
• Teams messages need a retention policy, because they do not support retention labels.

Check yourself

This lesson belongs to the data protection and governance domain of AB-900 (35-40% of the exam); the recap in AB-900 data protection and governance condenses it, and the topic pages on sensitivity labels, retention labels versus policies and data classification go further.