3. Classify and Protect Information
Design Sensitivity Labels, Publishing, and Auto-Labeling
Create a small handling taxonomy, publish it deliberately, validate encryption, and automate only high-confidence decisions.
Approx. 3 min reading · Includes diagrams; allow extra time for reflection and linked resources.
Start reading ↓About this learning content and editorial review
Your focus
What you’ll learn
- Apply a repeatable method for design sensitivity labels, publishing, and auto-labeling in a licensed, governed, and testable Purview environment.
This lesson develops a practical understanding of design sensitivity labels, publishing, and auto-labeling and connects design choices to supported capabilities, operational dependencies, user impact, and verifiable evidence.
A label communicates a handling decision
Sensitivity labels should tell people how information must be handled. A practical taxonomy often uses a small progression such as Public, Internal, Confidential, and Highly Confidential, with sublabels only where the handling outcome changes. A file label can add markings, apply encryption, restrict rights, and supply context to DLP. A container label can govern settings for a SharePoint site, Team, or Microsoft 365 group. These scopes are related but not interchangeable.
For each label, define examples, authorized recipients, external-sharing behavior, encryption, downgrade rules, support implications, and owner. Test coauthoring, search, eDiscovery, mobile, guests, offline use, and line-of-business integrations before enforcing encryption. The sensitivity label design guide provides the full taxonomy and rollout method.
Publishing policies decide who sees labels, defaults, mandatory labeling behavior, and justifications. A correctly created label that is not published to a user is functionally absent.
Automation must inherit the same accountability as a manual decision
Auto-labeling connects evidence to a handling outcome. Client-side recommendations let the user contribute context. Service-side policies can evaluate content at rest. E5-level entitlements normally govern automatic sensitivity-labeling features, so include licensing in the design.
Start in simulation. Inspect matched and unmatched content, estimate encryption and collaboration impact, validate exceptions, and obtain data-owner approval. Expand by population and location only after results are stable. Keep a route for relabeling errors and monitor downgrades, failures, and drift. The encryption and auto-labeling readiness guide covers pre-enforcement checks.
When labels appear in Microsoft 365 web apps but not desktop applications, troubleshoot licensing, policy scope, account, client build, built-in labeling, group policy, add-in conflicts, and propagation in order. Use the web-versus-desktop label checklist rather than recreating policies blindly.
Resources
- Microsoft Learn reference for Design Sensitivity Labels, Publishing, and Auto-Labeling — Official Microsoft documentation supporting the capability, prerequisites, and current product behavior taught in this lesson.