Sensitivity Labels and Data Classification with Microsoft Purview

What this guide covers

Sensitivity labels are sold on one clean promise. Classify your data once and it stays protected everywhere it travels. The Learn overview will tell you exactly that in a sentence. What it will not tell you is that the promise rides on a dependency chain you have to build by hand: a taxonomy you design, publishing policies that decide who even sees which labels, auto-labeling that may or may not fire, encryption that quietly rewrites who can open a file, container labeling for sites and teams, and a set of clients that each honor a different subset of the whole thing.

Two failure modes account for most stalled programs. Get the taxonomy wrong and users either ignore labels or mislabel everything. Turn on encryption without understanding usage rights and you lock people out of their own documents, sometimes for good. This is the most powerful part of Purview and the easiest to ship badly.

This book is the connected account Microsoft never publishes in one place. It walks information protection from what a label is, through a hands-on trial-tenant build, publishing, and auto-labeling, into encryption and container labeling, on to how labels feed DLP and Insider Risk, and ends on the operational reality of client support and rollout. Every limit, license boundary, and portal path is grounded against current Microsoft Learn and validated in a live Microsoft 365 E5 lab. You do not need a production tenant to follow along. A trial tenant and the willingness to provision one are enough.

Chapter map

1. What Sensitivity Labels Actually Do (and Don't)
2. Licensing and Prerequisites
3. Designing a Label Taxonomy
4. Publishing Policies: Who Sees Which Labels
5. Auto-Labeling: Client-Side and Service-Side
6. Encryption and Content Marking: What a Label Actually Enforces
7. Message Encryption: OME and Advanced Message Encryption
8. Container Labeling: Sites, Teams, Groups, and SharePoint
9. Labeling on Endpoints, Office, and the Information Protection Scanner
10. How Labels Feed DLP and Insider Risk
11. Operational Reality: Client Support, Gotchas, and Troubleshooting

Appendices: PowerShell for Labels and Policies; Microsoft Learn Bibliography; Taxonomy and Rollout Readiness Checklist; Standing Up a Trial Tenant for Information Protection.

Who it is for

This is written for the security engineer or consultant standing up information protection for the first time and wanting one document that connects the pieces Microsoft keeps on separate pages, for the compliance, privacy, and records stakeholders who own what gets classified and what protection buys them, and for the Microsoft 365 admin who will field the "why can't I open this file" tickets after go-live. It also maps to SC-401, Administering Information Security in Microsoft 365; the classification and information protection depth that exam expects is covered here in practice rather than as a list of facts to memorize.

See where you are

7 questions from this guide's territory (3 easy, 4 medium), with the explanation after each. Nothing is stored and nothing is sent anywhere.

The rest of Microsoft Purview Field Guides

One product per book, a lab appendix in every one, and a companion page like this one for each.

• 
  Field guide

  Audit, Alerts, and Investigation with Microsoft Purview

  The what-happened ticket arrives with a deadline, and the event you need aged out of the audit log months ago. The investigation surface, in the order you use it.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Communication Compliance with Microsoft Purview

  One Microsoft Purview tool reads your employees' messages, inspecting Teams, Exchange, Viva Engage, Copilot prompts, and connected third-party sources for harassment, threats, and regulatory violations.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Data Loss Prevention with Microsoft Purview

  Turn on Microsoft Purview DLP the way the wizard suggests and you get one of two outcomes: a wall of false positives nobody reads, or a policy so timid it protects nothing.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  eDiscovery and Legal Holds with Microsoft Purview

  When legal hands you a hold notice, the clock is real and the stakes include sanctions. Holds preserve and searches collect, so a matter you searched but never held can quietly lose data before anyone notices.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Insider Risk Management with Microsoft Purview

  There is no button that blocks the leak.

  Kindle$12.99Get it on AmazonCompanion page
• 
  Field guide

  Data Retention and Records Management with Microsoft Purview

  Nothing visibly breaks when retention is wrong.

  Kindle$12.99Get it on AmazonCompanion page

The hard set (3 questions)

The hardest SC-401 questions this guide publishes, none of them repeated from the placement quiz above: the answer first, why every other option is wrong, and the Microsoft Learn page behind it. The practice book for this exam holds the full bank.

You previously enabled co-authoring for files with sensitivity labels for your tenant. You then discover a legacy business tool that reads labeling metadata from the old custom-properties location and is now misbehaving. How do you turn co-authoring off?

Correct answer: D. Run Set-PolicyConfig -EnableLabelCoauth:$false in Security & Compliance PowerShell

Once co-authoring for files with sensitivity labels is enabled, it can't be disabled from the Microsoft Purview portal. You must use the Set-PolicyConfig cmdlet with -EnableLabelCoauth:$false in Security & Compliance PowerShell. Be aware that disabling it can cause labeling metadata written in the new location for unencrypted files to be lost.

Why the other options are wrong:

• A. Set-Label has no CoAuthoring parameter; the tenant setting is controlled through Set-PolicyConfig.
• B. Recreating label policies doesn't turn off the tenant-wide co-authoring metadata setting.
• C. The portal has no off switch for this feature; enabling it in the portal is one-way.

Memory hook: Co-authoring: portal turns it ON, only PowerShell (Set-PolicyConfig) turns it OFF.

Microsoft Learn: Sensitivity labels coauthoring

Your tenant has two label priority orders that interact: file-scoped labels (Personal=0, Public=1, General=2, Confidential=3, Highly Confidential=4) and a container-scoped label (Confidential Sites=5). A user uploads a document labeled Highly Confidential (priority 4) to a SharePoint site labeled with Confidential Sites (priority 5). What happens?

Correct answer: C. No event is generated - the mismatch event fires only when the document's label is MORE sensitive (higher priority) than the site's label; here the document (priority 4) is less sensitive than the site (priority 5), so no event is raised.

The 'Detected document sensitivity mismatch' event fires when a document with a higher-priority label is uploaded to a site with a lower-priority label, not the other way around. If the document label is HIGHER priority than the container label, SharePoint is concerned the sensitive document may be in a less-protected container. In this scenario, the container label has priority 5 and the document has priority 4, meaning the container's priority is higher than the document's. No mismatch event fires because the document is in a more-sensitive-or-equal container.

Why the other options are wrong:

• A. Documents are never automatically upgraded or downgraded to match container labels. Container and item labels are independent; no inheritance or promotion occurs.
• B. Uploads are not blocked by label priority mismatches. The SharePoint behavior is to audit and notify, not to block. There is no requirement that document label priority must equal or exceed the container label.
• D. This answer reverses the mismatch direction. A mismatch event fires when the document's label priority exceeds the container's. Here the container's priority (5) is higher than the document's (4), so there is no event.

Memory hook: Mismatch fires when the DOCUMENT label is higher priority than the CONTAINER label (sensitive doc in a low-security site). Reverse direction = no event. Container higher = fine.

Microsoft Learn: Sensitivity labels Teams groups sites

You are evaluating whether to enable co-authoring for files encrypted with sensitivity labels in your tenant. Before flipping this setting, which of the following consequences must you evaluate and plan for?

Correct answer: B. Enabling co-authoring changes the labeling metadata format for Word, Excel, and PowerPoint, which can cause apps, scripts, or tools reading from the old metadata location to misread labels or show unencrypted files as unlabeled.

Enabling co-authoring for files with sensitivity labels changes the labeling metadata format and its storage location in Word, Excel, and PowerPoint files. Any app, script, or tool in the tenant that reads labeling metadata from the old location will misread it after the change: it may see labeled files as unlabeled or display stale label names. This is effectively a one-way change: disabling it is PowerShell-only and can lose new-format labeling metadata for unencrypted files.

Why the other options are wrong:

• A. Co-authoring cannot be reversed through a portal toggle. Disabling requires PowerShell (Set-PolicyConfig -EnableLabelCoauth:$false) and can lose new-format labeling metadata for unencrypted files. It is effectively one-way.
• C. Co-authoring does not remove or change encryption from existing files. It changes the metadata format only, and encrypted files remain encrypted. Co-authoring of encrypted files requires cloud key, 'Assign permissions now,' and 'Never expires' access.
• D. Co-authoring is available to Microsoft 365 Apps across licensing tiers, subject to minimum version requirements per platform. There is no restriction to Business vs Enterprise.

Memory hook: Co-authoring on = metadata format change. Old-format readers break. One-way: disable is PowerShell-only and lossy. Inventory tooling FIRST.

Microsoft Learn: Sensitivity labels coauthoring