Complete Setup: How to Protect Sensitive Data with Sensitivity Labels in Microsoft 365

In today’s hybrid work environment, sensitive business data is constantly moving — across devices, apps, and even outside your organization. To ensure this data stays protected wherever it goes, Microsoft 365 offers a powerful tool: sensitivity labels.

This guide walks you through how to use sensitivity labels to classify and protect your organization’s sensitive data — without disrupting productivity.

🔐 What Are Sensitivity Labels?

Sensitivity labels are part of Microsoft Purview Information Protection. They allow organizations to classify and protect data based on its sensitivity level — such as Public, Internal, Confidential, or Highly Confidential. Once applied, these labels can:

• Encrypt content to restrict access

• Add watermarks, headers, or footers

• Control sharing and access permissions

• Persist with the file or email, even when it leaves your environment

🛠️ Step-by-Step: How to Set Up Sensitivity Labels

1. Plan Your Label Taxonomy

Start by defining a clear classification scheme. Common examples include:

• Public

• Internal

• Confidential

• Highly Confidential

You can also create sublabels for more granularity (e.g., “Confidential – HR”).

2. Create Sensitivity Labels

In the Microsoft Purview portal, navigate to:Solutions > Information Protection > Sensitivity labels > + Create a label

For each label, define:

• Name and description

• Tooltip to guide users

• Protection settings (encryption, content markings, etc.)

• Scope (emails, files, or other data assets)

3. Configure Protection Settings

The protection settings you configure will be enforced when the label is applied. These may include:

• Encryption and access restrictions

• Watermarks or headers

• Automatic application based on content detection (e.g., credit card numbers, SSNs)

4. Publish Labels with Label Policies

Once your labels are ready:

• Go to Label publishing policies > + Publish labels

• Choose which users/groups can see and use the labels

• Define default labels and mandatory labeling if needed

5. Test Before Full Rollout

Start with a pilot group to ensure labels work as expected. Then expand to the rest of your organization.

📌 Example: Confidential Label Configuration

Please find configuration for a Confidential label that applies:

• Encryption

• Add a watermark

• Automatically apply to files/emails when sensitive data like credit card numbers or U.S. Social Security Numbers are detected

Recipient Experience:

If a recipient receives an encrypted email, they may need to take extra steps to open or reply. In most versions of Outlook (including mobile and web), this is seamless. In other email clients like Gmail or Yahoo, the recipient may receive a secure link to validate their identity. Learn more about opening encrypted messages

🤝 How PlexHosted Can Help

At PlexHosted, we specialize in helping SMBs enhance their security and compliance posture with Microsoft 365. Whether you're just starting or optimizing an existing setup, PlexHosted provides expert guidance, hands-on support, and proactive monitoring to keep your environment secure and compliant.

Book a Meeting with Us