How to Create and Publish Sensitivity Labels in Microsoft Purview

Introduction

Sensitivity labels are the mechanism Microsoft Purview uses to classify and protect your organization’s data. A well-configured label can automatically encrypt a document, stamp it with a visible header, and restrict who can forward or print it. Once a label is applied – either by a user in Word or automatically based on content – the protection travels with the file wherever it goes.

This guide walks you through creating, configuring, and publishing a sensitivity label from scratch. By the end, you will have a label deployed and users will see it in their Office apps. Before you start, make sure you have the Compliance Data Administrator or Information Protection Analyst role. If you followed the first-day setup guide, this should already be in place.

Understanding Label Scope Before You Create Anything

The first decision you make when creating a label is its scope. Purview asks you what this label will protect. You have three options. Files and emails is the most common – it applies the label to documents in Office apps, SharePoint, OneDrive, and emails in Outlook. Meetings lets you protect Teams meetings and recordings.

Schematized data assets connects your label to the Purview Data Map so you can classify data at the column and table level in SQL databases and Azure Data Lake. For most organizations starting out, choose Files and emails. You can add meeting and data asset scopes later by editing the label. The scope choice determines which settings pages appear in the wizard.

Under Files and emails, you have two sub-options. Encryption controls whether labeled files are encrypted and who can access them. Content marking adds visible watermarks, headers, or footers. Both are optional – you can create a label that simply applies a classification name without any protection, useful for getting users comfortable before enforcing strict controls.

Step by Step: Creating a New Sensitivity Label

Go to the Microsoft Purview compliance portal, expand Information protection in the left navigation, and click Labels. Click the Create a label button. Give your label a meaningful name that users will understand – something like Confidential or Internal Use Only.

The description is equally important because it tells users when to apply the label. Write something like “Apply this label to documents containing non-public business data, financial projections, or strategic plans.” This appears as a tooltip when users hover over the label name in Office apps.

On the next page, select Items under scope and check Files and Emails. Leave meetings and schematized data assets unchecked. Click next. You now choose your protection settings. Check Encrypt files and emails or Mark the content of files – or both. The next several pages walk you through each setting in detail.

Configuring Encryption Settings That Actually Make Sense

When you check Encrypt files and emails, the wizard presents you with a critical choice. Assign permissions now lets you decide exactly who can access labeled content and what they can do with it. Let users assign permissions allows the person applying the label to choose who gets access at the moment they label the document. For most organization-wide labels, choose Assign permissions now.

You then set the access scope. Choose All users and groups in your organization if you want anyone with a company account to open the file – appropriate for an Internal label that prevents external sharing. Choose Specific users and groups if only a subset of your organization should have access, like a finance team label restricted to the finance department.

Under permissions, decide what actions are allowed. The default is everything, but you can restrict printing, copying, forwarding, and screen capture. For a Confidential label, consider disabling forwarding and copy-paste. For Highly Confidential, disable everything except view-only access. Match the restrictions to the actual sensitivity level.

Double Key Encryption requires two separate keys to decrypt content – one held by Microsoft, one held by your organization. It makes it impossible for Microsoft to access the data even under legal order. It is overkill for most use cases and adds significant complexity. Skip this for your first label. You can also set an expiration date on access, useful for documents that should become inaccessible after a project ends.

Adding Visible Content Markings

Encryption is invisible to the user opening a document. Content markings make classification obvious. When you check Mark the content of files, Purview lets you add a header, footer, or watermark to labeled documents. For a Confidential label, you might add a header that reads “CONFIDENTIAL – Do Not Distribute” in red text across the top of every page.

These markings make it immediately clear to anyone handling a printed or forwarded copy that the document contains sensitive information. They also serve as a deterrent against casual mishandling – it is much harder to claim you did not know a document was confidential when the word is printed on every page.

When configuring text, you can use variables that automatically populate. Typing ${If.Label} inserts the label name, and ${If.AppliedBy} shows who applied the label. Markings apply to Word, Excel, and PowerPoint documents. For emails, only the header and footer appear. Watermarks are not supported on emails. On SharePoint and OneDrive, markings are visible when documents are opened in Office Online or desktop apps, but not in the web preview alone.

Auto-Labeling So Users Do Not Have to Think About It

If you rely entirely on users manually applying labels, you will have gaps. People forget. People label things incorrectly. Auto-labeling solves this by having Purview automatically apply a sensitivity label when it detects specific sensitive information types or matches a trainable classifier.

Go to the label you created, scroll to Auto-labeling for files and emails, and click Create an auto-labeling policy. You define conditions based on sensitive information types. For example, if a document contains a credit card number and a passport number, automatically apply Highly Confidential. You choose where the policy applies – Exchange, SharePoint, OneDrive – and whether to apply to all locations or specific ones.

The critical toggle is at the end: Simulation mode versus Enforce policy. Always start in simulation. It runs the detection rules without applying labels and gives you a report of what would have been labeled. After reviewing results, switch to enforce. Auto-labeling scans existing files in SharePoint and OneDrive retroactively.

For documents that do not follow predictable patterns, use trainable classifiers instead of sensitive information types. A trainable classifier uses machine learning to identify documents by their content – resumes, contracts, source code. I cover this in the trainable classifiers guide. If labels do not appear or auto-labeling does not work, check the troubleshooting guide for fixes.

Publishing Labels So Users Actually See Them

Creating a label is only half the work. Until you publish it through a label policy, users will not see it in Word, Excel, PowerPoint, or Outlook. Go to Information protection and select Label policies. Click Publish labels. Choose the labels to include and select which users and groups the policy applies to.

You have two key configuration choices. First, whether to require users to provide a justification when they remove a label or apply a lower classification – this creates an audit trail. Second, whether to display the label as a mandatory default, meaning users must apply a label before saving or sending. Only enable mandatory labeling after user training and leadership buy-in.

After publishing, expect a delay. Labels typically appear in Office desktop apps within 4 to 8 hours. In Outlook on the web, they can appear within an hour. If labels do not appear after 24 hours, check that the user is in the policy scope, has the right license, and has refreshed their Office client from the Sensitivity dropdown.

Once labels are published, track adoption through Activity Explorer and the label activity reports. To prevent labeled content from leaving the organization, the next step is setting up Data Loss Prevention policies that use your sensitivity labels as conditions.