What a label is and does
A sensitivity label is a classification stamp (Public → Confidential → Highly Confidential, your taxonomy) that can ENFORCE protection, not just mark:
| A label can enforce | Effect |
|---|---|
| Encryption + usage rights | Only authorised users can open; controls extract/print/forward — protection that travels WITH the file, even outside the tenant |
| Content marking | Headers/footers/watermarks |
| Access & sharing controls | On labelled containers (sites, teams, groups) — guests, external sharing (the SharePoint/Teams container-label concepts) |
| Copilot behaviour | Labelled content can be excluded from grounding via DLP-for-Copilot (the Copilot curriculum) |
| Records/retention interplay | Labels tie into the lifecycle (retention module) |
The label is the anchor: it's what DLP matches on, what Copilot honours, what container controls read. That's why coverage is the master metric.
Manual vs automatic — coverage is everything
- Manual: users pick the label. Never achieves coverage alone — people under-label and mislabel.
- Automatic / recommended: the classification engine applies (or suggests) a label when content matches SITs/classifiers — the only path to real coverage.
- Default labels on containers/libraries catch the unlabelled.
- Mandatory labeling forces a choice at save/create.
The dependency chain that stalls deployments: policies (DLP, Copilot exclusion) are only as good as label COVERAGE; coverage needs auto-labeling; auto-labeling needs good classification (the foundations concept). Estates that skip to policy-building protect their few hand-labelled files and call it done.
Taxonomy discipline
A label scheme that's too granular (fourteen labels nobody can choose between) fails as surely as one that's too coarse. The workable shape: 3–5 levels, clear names, one obviously-correct choice per situation, with sub-labels only where a real handling difference exists. The taxonomy is a business decision Purview enforces — not an IT one.
What to watch (proofs)
- Coverage, honestly: labelled vs unlabelled sensitive content by workload (DSPM / label analytics) — THE metric; a low number means the foundation isn't laid.
- Auto-label reality: auto-labeling policy match rates (Purview) — are labels actually applying at volume, or is coverage all manual (and therefore thin)?
- Encryption behaviour: an encrypted-labelled file opened by an unauthorised user — access denied is the protection-travels claim, proven.
- The downstream check: a DLP or Copilot-exclusion policy keyed to a label actually firing (the Copilot/Exchange curricula) — labels doing real work, not just decorating.