Create and Distribute Sensitivity Labels in Microsoft Purview

---

How to Create and Distribute Sensitivity Labels in Microsoft Purview

Sensitivity labels help protect your organization’s data by classifying and securing files, emails, and other items based on their sensitivity level. Labels can apply encryption, restrict access, or add visual markings such as headers and watermarks.

Here’s a step-by-step guide to create and distribute sensitivity labels using Microsoft Purview.

---

Step 1: Sign in to Microsoft Purview

1. Go to https://purview.microsoft.com.
2. Sign in using a Global Administrator, Compliance Administrator, or Compliance Data Administrator account.
3. From the home page, select View all solutions.

---

Step 2: Open the Information Protection Solution

1. Under Data Security, select Information Protection.
2. Click Open solution to access label management options.

This section lets you create new labels, manage existing ones, and publish them to specific users or groups.

---

Step 3: Create a New Sensitivity Label

1. Select Labels from the left-hand menu.
2. Click + Create a label.
3. Enter the following details:
   • Name: Give your label a clear title, such as Confidential – Internal Use Only.
   • Description for admins: Explain the purpose of the label (e.g., “Used for internal confidential documents”).
   • Description for users: A short message that helps users know when to apply it (e.g., “Use this label for documents that should not be shared externally”).
4. Click Next to move forward.

---

Step 4: Configure Label Settings

Choose the protection settings to apply when this label is used. You can enable one or more of the following:

• Encryption: Restrict access to specific users or groups.
• Content marking: Add headers, footers, or watermarks.
• Auto-labeling: Automatically apply labels based on sensitive information types.
• Endpoint data loss prevention: Apply label-based DLP rules across devices.

After configuring your desired settings, click Next.

---

Step 5: Review and Create the Label

Review your label’s details. Confirm all settings — especially encryption permissions and marking rules — are correct.
Once ready, click Create label.
Your new label is now created but not yet available to users. Next, you’ll publish it.

---

Step 6: Publish the Sensitivity Label

1. Go back to the Information Protection section in Microsoft Purview.
2. Select Label policies → Publish labels.
3. Click + Publish labels and choose the labels you want to include.
4. Configure the policy name and description.
5. Under Users and groups, select who can see and use these labels.
6. Choose whether to apply a default label for users or specific workloads (like Exchange or SharePoint).
7. Review your settings, then click Submit.

Tip: Publishing can take up to 24 hours before labels appear in Microsoft 365 apps like Outlook, Word, Excel, PowerPoint, and Teams.

---

Step 7: Verify Deployment

After the policy is published:

• Users will see the labels under the Sensitivity button in Microsoft 365 apps.
• You can verify label application and usage under Reports → Activity explorer in Purview.

---

Best Practices

• Start with simple classification (Public, Internal, Confidential, Highly Confidential).
• Apply encryption only when needed to avoid access delays.
• Regularly review label usage reports for optimization.
• Educate users on when and how to apply labels correctly.

---