Implement Information Protection
Sensitivity labels are the unit of protection
A sensitivity label bundles what protection to apply: encryption (usage rights, content expiry, offline access), content marking (header, footer, watermark), auto-labeling of matching items, and container settings for sites, groups, and Teams. A label only protects anything once it is published through a label policy, which decides who sees it, the default label, whether justification is required to remove or downgrade a label, and the help link shown to users. Scopes matter: a label scoped only to Files & other data assets and Emails cannot be applied to a Team or SharePoint site; container settings live under the Groups & sites scope.
Two ways labels get applied
- Manual - user picks the label in Office, web apps, or the Purview portal.
- Automatic - client-side auto-labeling evaluates content inside the Office app as the user works, while service-side auto-labeling policies evaluate data at rest in SharePoint, OneDrive, and Exchange. Both rely on sensitive information types (SITs), trainable classifiers, or exact data match (EDM).
Traps that show up in questions
- A label that exists in the tenant but sits in no published policy is invisible to users - no policy, no label.
- When several labels could apply, priority order in the label list decides the winner; verify whether the question is about priority or about the client-side versus service-side engine.
- Container labels do not push encryption down to items; item-level protection must come from the item's own label (inheritance covers the label, not the encrypted rights).
- Encrypted documents block co-authoring unless the encryption template grants co-owner/Full Control rights to the collaborators.
- Mandatory labeling forces a label before save/send but users can still change it if justification is allowed.
Rule of thumb: the label defines protection; the policy defines population and enforcement.