Sensitivity Label Maze: Avoiding Common Pitfalls

We can discuss a lot around the importance of sensitivity labels in Data Protection. In a nut shell, this falls down to three things:

• Data as a Valuable Asset
• Risks of Data Breaches Regulatory Requirements
• Regulatory Requirements

So, what are they?

As per their definition:
Sensitivity Labels are customizable tags that classify and protect data based on its sensitivity level.

They help organizations manage and secure sensitive information by applying protection settings like encryption and content markings.

The Role of Sensitivity Labels

Obviously, they are integrated into Microsoft 365 apps, such as Word, Excel, PowerPoint, and Outlook. They provide protection settings that travel with the data, ensuring security across different platforms and devices.

In Microsoft Entra, they are used to control access to resources in Microsoft 365 applications, Microsoft Teams, Microsoft 365 Groups, and SharePoint sites. They help manage access and protect content without hindering user collaboration.

Common Misconceptions

After all, as everything else in life, there are few misconceptions about them, such as:

• They are only for large organizations and highly confidential information – can be used by organizations of all sizes to protect various types of sensitive information, not just highly confidential data.
• They are too complex for everyday use, and they can restrict collaboration – while they do require some setup, they are designed to be user-friendly and can be applied seamlessly to documents and emails without hindering collaboration.
• They are only for documents and emails – as referenced above, they do have multiple roles within different cloud services.
• They can replace other security measures – they are a part of a comprehensive security strategy and should be used in conjunction with other security measures, not as a replacement
• They are the same as classification labels – while they serve to identify the data, the sensitivity labels focus on protecting that data.

Now, these misconception can severely impede the execution of the project. Even worse, take the project in different direction.

Common Mistakes to Avoid

As it is with every project (and in life:), there are mistakes we make. So, this list just summarizes the most common onest:

• Who’s in charge !?!?!?
• “One to rule them all” – putting everyone in the same bucket
• Client-side vs. Service-side labeling
• Over-labeling (i.e., complex policies, going the “extra mile”)
• Inconsistent Labeling across Platforms
• Incorrect Label application or misconfiguration
• Misconfiguration of permissions (e.g., who can apply which labels)
• Failing to set default labels for certain types of content
• Sensitivity Labels without encryption
• Deploying labels without testing process
• Training gaps

Needless to say, that the first point is on of the “ultimate battles” in an organization – is it Legal, Compliance or IT Department in charge? Getting to the conclusion that it’s not IT Department, should be obvious. Right? Well, it does not happen that often. Subsequently, the IT Department just implements the data protection rules, as per request of the business units.

While we are at that, do not use same label structure for every Department. They do have different needs for data classification and protection. With that in mind, choose between client and server side, and based on that, define the labels structure. Take in consideration what would the default label be, relevant for certain content type.

The more complexity you add to the label structure, it becomes more difficult for the users to figure out which one to use. Hence, mistakes will be made.

Common mistakes during trainings and adoption

That’s why testing, monitoring and (last, but not least) proper training is necessary. And I don’t mean the end users only. Your IT Operations teams need to be brought up to speed as well.

On one hand, business users don’t know what to expect. A lot of materials might be produced and provided, but still it is a puzzle for them. This will cause strain on the support operations. Thinks will get picked up by hands-on experiences. Some things and activities that can help are:

• Develop a Clear Communication Plan – define purpose, expectations, business needs & customize the training.
• Conduct Live Training Sessions – recordings, videos, written material is addition, but the main focus should be live training, so the users can test, give real time feedback, ask questions.
• Sandbox Environment – set up a test environment where users can practice applying sensitivity labels without risk to actual data. Let them experiment with different labels and see how protections like encryption and access restrictions apply.
• Quizzes and Feedback – after each practice session or training module, include quizzes or quick assessments to ensure users understand key points. Provide feedback to reinforce learning.
• Ongoing Auditing -inform users that label usage is monitored and audited to ensure compliance, but that the goal is to protect the company and its data, not to penalize employees.

Conclusion and quick tips

Sensitivity Labels roll out is serious process, for which the roll out stages should not be underestimated. Some quick tips, from my side, would be:

• Involve representatives from different departments early in the process (Legal, IT, Business, Champions, etc.)
• Define clear concept for implementation
• Keep it simple, but efficient
• Define roll-out stages plan
• Test the labels within pilot group (first pilot, second pilot, etc.)
• Consider different labels for different business units according to their needs
• Communicate clearly the strategy, phases, roll-out and inform affected teams/people accordingly
• Do not underestimate training and adoption (EVER!)
• Establish feedback process
• Have a clear focus on who is responsible for what (changes, feedback, monitoring, support)

Additional information and links

Microsoft Purview – Sensitivity Labels | Microsoft Learn
Explore sensitivity labels (Training)
Implement sensitivity labels (Training)
Create and configure sensitivity labels with Microsoft Purview (Training)
End User Training for Sensitivity Labels