Manage protection settings and marking for applied sensitivity labels

Sensitivity labels in Microsoft 365 are tags that can be applied to content such as documents and emails. These labels can enforce protection actions like encryption, content marking, and access restrictions across your organization’s files and emails.

Creating and Configuring Sensitivity Labels

To create and configure new sensitivity labels:

1. Open Microsoft 365 compliance center.
2. Navigate to Solutions > Information protection.
3. Click on + Create a label and follow the prompt to configure label settings.

When configuring sensitivity labels, you can define several protection settings:

• Encryption: It allows you to encrypt documents and emails. You can set permissions that restrict how recipients can interact with the content (viewing, editing, printing, forwarding, and copying).
• Content marking: You can add watermarks, headers, and footers to documents. This visibly marks the content as sensitive.
• Endpoint data loss prevention (DLP): Extend the protection to endpoint devices to prevent unauthorized actions such as copying sensitive data to a USB drive.
• Auto-labeling: Set up conditions that automatically apply labels based on the presence of sensitive information types.

Example of Creating a Sensitivity Label with Protection Settings

Imagine you work for a company that frequently handles confidential financial data. You can create a label called “Confidential Financial” with the following settings:

• Encryption: Set permissions to allow only users within your finance department to edit the content, while others can only view it.
• Content marking: Add a watermark that says “Confidential” diagonally across each page of the document.

Applying and Managing Sensitivity Labels

Once created, sensitivity labels can be published to users and groups within the organization. This involves creating and configuring a label policy:

1. Label policies: Determine how labels are published to users and where they can be applied.
2. Priority: In case of multiple applicable labels, determine which label takes precedence based on priority order.

Configuring Label Policies for Sensitivity Labels

1. In the compliance center, go to Information protection.
2. Select the label you created and choose Publish labels.
3. Choose users or groups the label should apply to and define the settings for automatic or recommended labeling.

Example of Applying Sensitivity Labels

Following the earlier example, the “Confidential Financial” label could be published to the finance department. This policy ensures that any document created or edited by these users will either recommend or automatically apply this label.

Label Priority and Conflict Handling

Label priority is essential when a document meets conditions for more than one label. You must set the labels priority in the label policy where the most protective label has the highest priority.

In this table, “Confidential Financial” has the highest priority and will be applied over “Internal Use” if both conditions are met for a document.

Monitoring and Analytics

For an administrator, it is critical to monitor the application of sensitivity labels across the organization’s data estate:

1. Audit logs: Review actions related to sensitivity labels such as labeling, label changes, and access attempts contrary to label permissions.
2. Analytics: Use dashboards to understand exposure of sensitive information and how labels are being used within your organization.

Enforcing and Troubleshooting Sensitivity Labels

Finally, protection settings only have value if they are enforced and understood. Regularly:

• Review and update: Policies to ensure they still align with organizational requirements.
• Educate users: On how to classify data correctly.
• Troubleshoot: Issues such as labels not appearing or being applied incorrectly.

As part of the SC-400 exam preparation, comprehending how to manage, configure, and enforce sensitivity labels is essential to administering information protection in Microsoft 365. Understanding the practical application of these labels will help ensure that sensitive information within your organization is appropriately protected.