Sensitivity labels explained

A Microsoft Purview sensitivity label is a tag stored in the metadata of a file or email that classifies it (for example Public, General, Confidential) and can enforce protection such as encryption and content markings that stay with the content wherever it goes. The decision rule: the label describes and protects the item itself, DLP controls where the item may go, and retention controls how long it lives. A label does nothing for users until it is published in a label policy.

The life of a label in five layers

Exam questions are easiest when the feature is seen as five layers, each of which can be the one that is broken.

1. The label: what it does. An admin creates the label in the Microsoft Purview portal and chooses its settings. Microsoft Learn lists what a label can do: encrypt content and define who may do what with it, add content markings (headers, footers, watermarks), protect containers such as Teams, Microsoft 365 groups and SharePoint sites, apply or recommend itself automatically, and set a default sharing link type. A label can also carry no protection at all and exist only to classify. Learn describes the label as customizable, stored in clear text in the metadata, and persistent, so it stays with the content.

2. The scope: what it can be applied to. Each label has a scope. Files and other data assets is selected by default, and normally Emails is selected with it. Meetings requires both of those. Groups and sites appears once the container capability is enabled, and it labels the container, not the items inside it. Scope decides which settings you can configure and where users can pick the label.

3. The policy: who sees it. Labels are published through label policies to users or groups. A policy chooses who gets which labels and sets the defaults: a default label, required justification when lowering a label, and mandatory labeling. Per Learn, if a user is in several policies, a conflicting setting is resolved by the policy with the highest order number, so the highest priority wins. Changes can take up to 24 hours to replicate.

4. The application: how it gets onto content. Manually by the user, as a default, by inheritance (for example from an attachment), or automatically through conditions or an auto-labeling policy. A recommended label prompts the user; an automatic one applies itself.

5. The enforcement: what travels with the file. Encryption restricts who can open the file and what they can do. Markings are visible. Both stay attached when the file leaves the tenant. Users from other organizations or guests cannot see your sensitivity labels in their apps.

Priority and sublabels

Label order sets priority. Learn says the most restrictive label (such as Highly Confidential) goes at the bottom of the list and the least restrictive (Public or Personal) at the top. One item can carry only one sensitivity label, though a document or email can carry both a sensitivity label and a retention label. Priority matters for three behaviors: the justification prompt when a user moves to a label that sits higher in the list, which is a lower sensitivity; the choice between several auto-labeling matches, where the last (most sensitive) label wins; and which label Copilot shows when an answer draws on several labeled items.

Labels can be grouped in two tiers, such as Confidential with sublabels All Employees and Trusted People. Sublabels inherit nothing from the parent except color. Microsoft is replacing parent labels with label groups, which can be named and colored but cannot be published or applied by themselves, only the labels inside them. Never make a parent label the default or an auto-applied label, because then it cannot be applied.

Worked example

Contoso wants three levels: Public, Internal and Confidential, with Confidential split into All Employees and Finance Only.

1. Create the labels in priority order from Public at the top to Confidential at the bottom. Finance Only encrypts content and grants permissions to the Finance group; All Employees applies a footer and encrypts for the whole tenant.
2. Scope the labels to Files and Emails. Create a separate Groups and sites label for the Finance team site that sets external sharing to off.
3. Publish all item labels to everyone in one policy, with Internal as the default for unlabeled content and justification required when lowering a label. Publish nothing else yet.
4. Add an auto-labeling policy that applies Finance Only to documents containing the company’s bank account format.

A week later a user reports the Finance Only label is not in Word. The label is created but the user’s group was left out of the policy. The label does not exist for that user until it is published to them. The default is also worth reviewing: Learn advises against a default label that applies encryption, because many external recipients cannot open encrypted documents.

Which exams test this

SC-401 goes deep on configuration. SC-900 and AB-900 expect you to know what a label is and when to use one. PL-300, DP-600 and DP-700 expect you to apply existing labels to Power BI and Fabric items, not to design them.

How the questions are built

Most items are a symptom plus a missing layer. Work down the five layers until one fails.

• “The label does not appear for users” means it has not been published to those users in a label policy.
• “A label on a Teams site does not label the files in it” is correct behavior: a container label governs the container settings (privacy, external access, sharing), not each item.
• “Content must be encrypted and restricted to named people” is a label with encryption, not DLP.
• “Block sharing of content that contains credit card numbers” is DLP, not a label. If the requirement is to apply the label automatically when such numbers appear, that is auto-labeling.
• “Keep for seven years and then delete” is retention. A label can sit next to a retention label but does not control lifetime.
• “Users must justify downgrading” is a policy setting that depends on the priority order.
• “Remove a label from a policy” stops users from selecting it but leaves it on content that already has it. Deleting a label is riskier: users no longer see its name, and for files in SharePoint or OneDrive with sensitivity labels enabled for Office files, the encryption it applied is removed. Elsewhere the encryption stays, through an archived protection template.
• “Guests or other tenants cannot see the label” is expected.

Practice questions

Go deeper

• Learn about sensitivity labels on Microsoft Learn
• Get started with sensitivity labels for licensing, permissions and deployment
• Automatically apply a sensitivity label for conditions and auto-labeling policies
• Related on this site: DLP explained, Zero Trust explained, how to read a skills outline