🔐 Purview Course · Module 3 of 6
Sensitivity Labels
SC-400 Exam Alignment
SC-400
Skill: Create and manage sensitivity labels — Design a sensitivity label taxonomy, configure label settings (encryption, visual markings, site/group protection), publish labels via label policies, deploy auto-labelling policies for automatic classification, and extend labels to Microsoft 365 Groups, SharePoint sites, and Teams meetings.
- Know that labels are created in the compliance portal but applied by users in Office apps (client-side) or automatically by service-side policies
- Encryption is powered by Azure Rights Management (Azure RMS) — it follows the document wherever it goes, even outside Microsoft 365
- Know that auto-labelling policies (service-side) run 24–72 hours after configuration and can label existing content; client-side recommends labels in real time as users type
- Understand label priority — if multiple labels could apply, the highest-order label wins for auto-labelling; for user conflicts, the more restrictive label is typically kept
Exam Tip: The key SC-400 distinctions to memorise: Client-side labelling = user applies in Office app or user gets a recommendation; Service-side auto-labelling = policy scans content in Exchange/SharePoint/OneDrive and applies label automatically without user action. Auto-labelling policies require Microsoft 365 E5 Compliance.
Sensitivity labels are the mechanism that makes information protection persistent and portable. A sensitivity label attached to a Word document or email travels with that content — wherever it’s shared, copied, or forwarded. The encryption, access restrictions, and visual markings configured in the label follow the document even if it leaves Microsoft 365.
🏷️ The Sensitivity Label Taxonomy
Before creating labels, design a taxonomy (a hierarchy of label names) that reflects your organisation’s data sensitivity levels. Most organisations use three to five parent labels.
| Recommended Tier | Examples | Typical Contents |
|---|---|---|
| Public | Public, External | Marketing materials, press releases, job postings — safe to share externally |
| General | General, Internal | Day-to-day work content, internal communications — not sensitive but not intended for public |
| Confidential | Confidential, Confidential\All Employees, Confidential\Recipients Only | Business strategies, personnel data, financial forecasts, customer PII |
| Highly Confidential | Highly Confidential, Highly Confidential\Board Only | M&A documents, source code, trade secrets, regulatory filings |
💡 Label Design Principles
- Keep the taxonomy simple — 3–5 labels is easier for users to understand than 20 granular labels
- Use sublabels to add workload-specific variants (e.g. Confidential\GDPR, Confidential\Legal Privilege) without cluttering the top-level taxonomy
- Higher-priority labels cannot be changed to lower-priority ones by users without justification (if you enable downgrade justification)
⚙️ Label Settings (Scopes & Actions)
Label Scopes
| Scope | What It Labels |
|---|---|
| Items | Files (Office documents, PDFs) and emails — the most common scope; enables content marking and encryption for documents and messages |
| Groups & sites | Microsoft 365 groups, SharePoint sites, Teams — configures privacy settings, external access, and conditional access policies at the container level |
| Schematised data assets | Azure SQL, Synapse, Azure Data Lake — labels cloud data assets catalogued in Microsoft Purview Data Map |
Item Protection Settings
| Setting | What It Does |
|---|---|
| Encryption | Applies Azure RMS encryption. You configure: who can access the content, what permissions they have (view-only, edit, co-author, full control), and whether access expires |
| Content marking | Adds header (top of document), footer (bottom), and/or watermark (diagonal text across page). Markings are inserted as text and serve as a visual indicator and audit signal |
| Auto-labelling for files and emails | Client-side: recommends or automatically applies the label when the Office app detects matching SITs as the user types |
🔐 Encryption with Azure RMS
| Encryption Option | Use Case |
|---|---|
| Assign permissions now | You define exactly who can access content with this label and what they can do. Pre-configured — users cannot change permissions. Best for strict Confidential or Highly Confidential labels. |
| Let users assign permissions | When the label is applied, the user chooses who to encrypt for (like Outlook’s “Encrypt-Only” or “Do Not Forward”). Best for sensitive but user-controlled scenarios. |
| Double Key Encryption (DKE) | Two keys required: one from Microsoft, one from your own on-premises key server. Even Microsoft cannot decrypt content. For highly regulated sectors (government, defence). Requires Microsoft 365 E5. |
⚠️ Encryption and External Access
When a labelled and encrypted document is shared externally, recipients can only open it if they have an identity that Azure RMS can validate — either an Azure AD (Entra ID) account in your tenant, a Microsoft Account, or a federated identity. Users without a valid identity cannot open encrypted content even if they receive the file.
📢 Label Policies — Publishing Labels to Users
Creating a label doesn’t make it available to users. You must publish the label via a label policy. A label policy controls:
| Label Policy Setting | Description |
|---|---|
| Published labels | Which sensitivity labels are included in this policy and shown in the users’ Office apps |
| Users and groups | Which users or groups receive this policy — different teams can receive different label sets |
| Policy settings | Default label for documents and emails; require justification to remove or downgrade a label; require users to label their emails before sending; require labelling of sites and groups |
ℹ️ Label Policy Propagation
After publishing or modifying a label policy, allow up to 24 hours for the labels to appear in users’ Office apps. If users report not seeing a new label, ask them to sign out and back in to Office apps.
🤖 Auto-Labelling Policies (Service-Side)
Auto-labelling policies scan content in Exchange Online mailboxes, SharePoint sites, and OneDrive accounts — and automatically apply labels without user interaction.
| Feature | Client-Side (per-label) | Service-Side (auto-labelling policy) |
|---|---|---|
| Who applies the label | Office app on the user’s device | Purview service — no user action needed |
| When it applies | As the user types in the document | Within 1–3 days for existing content; near-real-time for new content |
| Simulation mode | No simulation — recommend or automatically apply | Yes — run policy in simulation mode to see matches before enforcing |
| Scope | Office documents and emails created by the user | All content in specified Exchange mailboxes, SharePoint sites, OneDrive accounts |
| Licence requirement | Microsoft 365 Apps for Business or E3/E5 | Microsoft 365 E5 Compliance (or equivalent add-on) |
🏢 Labels for Sites, Groups & Teams
| Container Setting | What It Controls |
|---|---|
| Privacy | Public (anyone in org can find and join) or Private (only members can access) — sets the default for new groups with this label |
| External user access | Allow or prevent external guest accounts from being added to groups with this label |
| External sharing from SharePoint | Control whether the SharePoint site associated with this group can share files with external users |
| Conditional Access | Require managed or compliant devices to access SharePoint sites with this label — integrates with Entra ID Conditional Access policies |
PowerShell — Sensitivity Labels Administration
# List all sensitivity labels and their status Get-Label | Select-Object DisplayName,Priority,ContentType,IsActive # Get a specific label's full settings Get-Label -Identity 'Confidential' | Select-Object -ExpandProperty Settings # List all label policies (which labels go to which users) Get-LabelPolicy | Select-Object Name,Labels,ExchangeLocation,SharePointLocation # Add a new label to an existing policy Set-LabelPolicy -Identity 'Finance Team Labels' -AddLabel 'Highly Confidential - Board Only' # Create an auto-labelling policy in simulation mode New-AutoSensitivityLabelPolicy -Name 'Auto-label Credit Cards' ` -ApplySensitivityLabel 'Confidential' ` -SensitiveInfoType @{Name='Credit Card Number';minConfidence=75;minCount=1} ` -SharePointLocation 'All' -Mode 'SimulationWithoutNotifications'
💡 Best Practices
- Start with a simulation mode auto-labelling policy before enforcing — review the matched items in the portal to calibrate before committing to mass labelling
- Configure a default label policy setting to require users to label new documents and emails — this drives adoption and prevents unlabelled data accumulation
- Require justification to downgrade a sensitivity label — this creates an audit trail if a user changes “Confidential” to “Public” and helps detect accidental or malicious downgrading
- Apply site-level sensitivity labels to all new SharePoint sites and Teams — container-level labels set the security perimeter for all content within the container
🎓 Interview Q&A
Q: A user applies a “Confidential” sensitivity label to a Word document and shares it with an external partner via email. The partner reports they cannot open the document. What are the most likely causes?
Cause 1 — External partner has no valid identity: If the label uses “Assign permissions now” encryption with access restricted to specific users or groups, the external partner’s email address must be explicitly listed. Resolution: either add the partner’s email to the label’s permissions, or switch to “Let users assign permissions” mode for external sharing scenarios.
Cause 2 — External partner has no Azure RMS-compatible client: The document requires a client that can process Azure RMS encryption — Microsoft Office (any version), the free Azure Information Protection viewer, or a supported PDF reader. Resolution: advise the partner to use Office apps or provide the free AIP viewer.
Cause 3 — Guest access is blocked at the container level: If the label is also applied to a SharePoint site with “Block external user access” enabled, guests cannot access content in that site. Resolution: review the site’s sensitivity label settings or share via a different method.
🎯 SC-400 Mock Test
Module 3 — Sensitivity Labels
5 questions · Scenario-based · Pass mark: 70%
Q1 of 5
A sensitivity label “Confidential – Legal Privilege” is created but no users can see it in their Word or Outlook apps. What is the most likely cause?
AThe label is inactive and needs to be enabled in the label status settings
BUsers need Microsoft 365 E5 licences to see sensitivity labels in Office apps
CThe label has been created but not published via a label policy — labels must be added to a policy scoped to the relevant users before they appear in Office apps
DLabels only appear in the web versions of Office apps — desktop clients require Azure Information Protection client
✅ C. Creating a sensitivity label in the compliance portal makes it available in Purview but does NOT make it visible to users. The label must be added to a label policy and that policy must be scoped to the relevant users or groups. Without publication, no one sees the label in their Office apps.
Q2 of 5
An organisation wants to ensure that ALL documents containing credit card numbers in their existing SharePoint libraries are automatically labelled “Confidential” within 3 days without user involvement. Which approach should they use?
AConfigure client-side auto-labelling on the “Confidential” label to recommend labelling to users when credit card numbers are detected
BCreate a service-side auto-labelling policy scoped to SharePoint, selecting the “Credit Card Number” SIT and setting the label to “Confidential” — run in simulation first, then enforce
CCreate a DLP policy that applies the “Confidential” sensitivity label when credit card numbers are detected
DConfigure the label policy to require all users to apply the “Confidential” label before saving documents
✅ B. Service-side auto-labelling policies scan existing content in SharePoint, OneDrive, and Exchange without user action — exactly the requirement. Client-side (A) only works when a user opens and edits a document, not for existing content. DLP (C) blocks or notifies — it does not apply sensitivity labels directly.
Q3 of 5
What is the purpose of configuring a sensitivity label with “Groups & sites” scope?
ATo control the privacy setting, external access, external sharing, and conditional access enforcement at the Microsoft 365 Group, SharePoint site, or Teams team level — not individual files
BTo automatically encrypt every file stored in the SharePoint site with that label applied
CTo restrict which Microsoft 365 Groups can be created — only certain groups can use labels
DTo publish the label to users in specific security groups rather than all users
✅ A. “Groups & sites” scope configures container-level protection — privacy (public/private), guest access, external sharing, and conditional access requirements. It does NOT encrypt individual files in the site (that requires item-scope encryption settings on each file).
Q4 of 5
An employee tries to change a sensitivity label from “Highly Confidential” to “Public” on a document but receives a dialog asking them to provide a reason. Which policy setting caused this prompt?
AThe label has encryption that prevents priority changes without approval
BThe user’s role doesn’t include “Label Downgrade” permissions in Entra ID
CA DLP policy prevents classification changes on confidential documents
DThe label policy is configured with “Users must provide justification to remove a label or lower its classification” — this setting prompts users for a reason when downgrading
✅ D. Label policies include a setting: “Users must provide justification to remove a label or lower its classification.” When enabled, any attempt to change from a higher-priority label to a lower one triggers a mandatory justification dialog. The justification is recorded in the audit log, creating a trail for security review.
Q5 of 5
Which encryption option for sensitivity labels is most appropriate for documents that should be accessible to any authenticated user but must still be encrypted?
ADouble Key Encryption (DKE) — uses two keys to ensure only your organisation can access content
BAssign permissions now → “All authenticated users” — grants access to any user with a valid Microsoft or organisation identity while still encrypting the content
CDo Not Forward — prevents forwarding while keeping the content accessible to anyone
DNo encryption — sensitivity labels only provide visual markings, not encryption
✅ B. “Assign permissions now” with the recipient set to “All authenticated users” encrypts the document with Azure RMS while allowing any user with a valid Microsoft identity (work, school, or personal Microsoft account) to open it. DKE (A) would prevent authentication outside your specific key server. “Do Not Forward” (C) is email-specific. Option D is incorrect — labels can and do apply encryption.
🔒
Locked — Pass Module 2 quiz to unlock this module.