AI tools are now part of everyday working life, whether your organisation has formally adopted them or not. That makes it more important than ever to know where your sensitive data sits and how it is protected.
Â
In Episode 3 of Purview Perfection, our team was joined by Joseph Borland-Scott, Microsoft Security Partner Sales Specialist, to talk through Microsoft Purview sensitivity labels. We covered how to build a label taxonomy your people will actually use, how to roll labelling out in stages, and how to apply protection once your data is labelled.
Â
Like every episode in the series, our discussion points are based on real engagements with our customers. We’ve summarised the key takeaways below.
Why Data Protection Has Moved Up the Agenda
Microsoft Purview has been around for some time, but the rapid adoption of AI has brought data protection back to the forefront.
Figures shared in the session suggest that around 80% of people are bringing consumer AI tools into the workplace, and that 22% of those are exposing sensitive business data to consumer-grade AI. In most cases this isn’t malicious. Employees see the benefits of AI at home and want the same productivity gains at work. But data shared with consumer tools can leave your control, and some services may use it to train their models.
Banning AI often makes shadow AI worse. As Joseph explained, it usually works much better to give employees a clear, approved way to use AI, such as Microsoft 365 Copilot Chat, and set clear boundaries.
What this means for Copilot
Microsoft 365 Copilot works within your Microsoft 365 environment and is not trained on your business data. However, it can draw on any content the user already has permission to access. Permissions tend to spread over time across SharePoint sites, libraries and Teams. When they do, Copilot can surface information that should be more tightly controlled, particularly in departments such as finance, HR and legal.
Joseph suggested three key questions for any organisation investing in AI:
- Do you know where your sensitive data is?
- Is it appropriately classified and protected?
- Are the right people able to access it?
Your data does not need to be perfect before you start. What matters is having a clear plan and understanding the risks.
What Is a Sensitivity Label?
A sensitivity label is a tag applied to your data. Once applied, it is stored in the file’s metadata and travels with it, including when files are shared outside your organisation.
Because the label stays with the file, you can:
- Apply protection, such as encryption and access restrictions
- Audit where labelled data has gone
- Add consistent headers, footers and watermarks
- Use the label to trigger data loss prevention (DLP) policies
How to Build a Simple Label Taxonomy in Microsoft Purview
Naming your labels can be surprisingly emotive, but our advice is to keep it simple.
A four-level structure works well for most organisations, particularly SMBs:
Label | Who Can Access | Typical Content | Protection Posture |
|---|---|---|---|
Public | Anyone, internal & external | Marketing, published guides, open datasets | None – free sharable |
Internal | All employees & guests | Policies, intranet, day-to-day working docs | Content formatting; Header’s footers, watermarking |
Confidential | Named teams / need-to-know | Contracts, finance, customer & project data | Encryption + marking |
Highly Confidential | Very restricted group | M&A, secrets, regulated / special-category data | Strong encryption, do-not-forward |
Using sub-labels for departments
Larger organisations may need different controls for different teams. Legal and finance might both handle highly confidential data, but each may need its own level of protection. Instead of adding new top-level labels, create sub-labels such as Highly Confidential – Legal and Highly Confidential – Finance. The structure stays clean, and you can still target policies at each team.
Guiding your users
- Use plain names so labels are easy to understand
- Apply consistent colours to labels in the user interface (this does not colour the document itself)
- Add policy tips so Purview can suggest an appropriate label
- Pilot with a small group, measure success, then expand
How Labels Should Be Applied
There are several ways to apply labels. We recommend a staged approach:
- Manual labelling: introduce labels to your users and educate them on when to use each one.
- Mandatory labelling: prompt users to choose a label whenever they create, edit or email content, so labelling becomes a habit.
- Recommended labelling: Purview suggests a label based on the content.
- Automatic labelling: the end goal, once the groundwork is in place.
Avoid default labels
If every item gets a default label, users never have to think about labelling. You end up with one label across your whole data set and no meaningful way to apply different controls to different data.
Don’t rush to auto-labelling
Auto-labelling can seem like the obvious starting point, but switching it on too early is often intrusive and disruptive. If everything is labelled confidential with strict controls, people struggle to do their jobs.
Microsoft’s built-in sensitive information types, such as credit card and passport numbers, are useful quick wins, but they won’t cover much of your organisation’s own sensitive data. Auto-labelling only works well once you have spent time on trainable classifiers, exact data match and document fingerprinting, using plenty of real examples. We will cover these in detail in Episode 4.
What Can Be Labelled?
Within Microsoft 365, sensitivity labels can be applied to:
- Files and emails – Word, Excel, PowerPoint, PDF and Outlook.Â
- Teams meetings, so content within a sensitive meeting inherits the label
- Containers, including SharePoint sites, Microsoft 365 groups and Teams
- Copilot:Â Labels are respected by Copilot. With AI controls in place, it can refuse to work with Highly Confidential content.
Labelling a container can cover a lot of data without relying on individual users. Tread carefully, though, and start with your most sensitive areas.
Copilot respects sensitivity labels and the protection applied to labelled content. That makes labelling a key part of preparing for Copilot adoption.
Label First, Protect Second
Because labels travel with your data, you don’t need to apply protection on day one. Labelling first lets you see what data has been labelled and how before you weigh up the business impact of adding controls. You can then apply protection policies to data that is already labelled.
We recommend starting with Highly Confidential data and testing the impact with your pilot groups. Simulation mode shows how a policy would affect real data before you enforce it. The aim is to protect your data and build user confidence without stopping people from doing their jobs.
Protection options
Once data is labelled, protection can include:
- Encryption that stays with the file wherever it goes
- Restricting access and editing to specific people
- Preventing forwarding or printing
- Encrypt-only options for broader protection
Data loss prevention
DLP policies can also use labels. If someone tries to share labelled data outside the business, Purview can warn them, ask them to justify the action, block it or enforce encryption. This works across Exchange, SharePoint, Teams and endpoints. Controls for Copilot and other AI apps are also growing, including controls on prompts.
Purview Is an Adoption Journey
Purview is a slow burner. You wouldn’t propose on a first date, so don’t switch everything on at once and expect it to work.
A successful rollout means:
- Building labels with your team
- Educating users and piloting with small groups
- Measuring success before adding controls
- Moving towards auto-labelling once the training is in place
Joseph agreed that getting the rollout right matters as much as getting the technology right. You have one opportunity to land labelling with your people. If controls stop them sharing information legitimately, they may look for ways around them.
Key takeaways
- Keep your label taxonomy simple
- Labels protect your data wherever it travels, with visibility and auditability
- Label first, then target policies at those labels
- Simulate policies before enforcing them
Coming Up in Episode 4
Episode 4 is planned for December, after a break in November. It will cover sensitive information types, exact data match, document fingerprinting and insider risk management.
Get Expert Support with Microsoft Purview
Every topic in Purview Perfection comes from real customer challenges. You might be planning a Copilot rollout, worried about shadow AI or unsure where your sensitive data sits. Whatever your starting point, our team can help you take a practical, staged approach to Microsoft Purview.
We can help you:
- Design a sensitivity label taxonomy that suits your organisation
- Plan a phased labelling rollout and user education
- Review permissions and data access ahead of Copilot adoption
- Configure protection, DLP and simulation policies
- Prepare for auto-labelling with targeted classifiers
We’re offering a free 30-minute call to discuss your Purview requirements and answer your questions. We’ll also talk you through how we would approach your environment.
Frequently Asked Questions
What are Microsoft Purview sensitivity labels?
Sensitivity labels are tags that classify your data based on how sensitive it is. They are stored in the file’s metadata and travel with the data. You can use them to apply protection such as encryption, access restrictions, watermarks and DLP policies.
How many sensitivity labels should we have?
For most organisations, four top-level labels are enough: Public, Internal, Confidential and Highly Confidential. Where departments need different controls, sub-labels let you add them while keeping the structure simple for users.
Should we start with automatic labelling?
We don’t recommend it. Auto-labelling works best once users are familiar with labels and you have trained Purview to recognise your own sensitive data. Starting with manual and mandatory labelling reduces disruption and builds confidence.
Does Copilot respect sensitivity labels?
Yes. Microsoft 365 Copilot respects sensitivity labels and the protection applied to labelled content. However, it can still access anything a user has permission to see, so you should review permissions alongside labelling.
Can we label data before applying protection?
Yes. Because labels travel with your data, you can apply protection policies later. That gives you time to assess the impact before enforcing controls, and simulation mode lets you test policies against real data first.
How can CloudGuard help with Microsoft Purview?
We help organisations plan, configure and adopt Microsoft Purview in a practical, staged way. That covers everything from label taxonomy and user education to protection policies, DLP and auto-labelling. Book a free 30-minute call to discuss your requirements.
