Two labels, two jobs
Sensitivity labels (authored in Microsoft Purview) attach to two very different kinds of object, and this is the number-one source of confusion:
| Label scope | Attaches to | What it enforces |
|---|---|---|
| Container label | A site / Microsoft 365 Group / Team | Privacy (public vs private), external-sharing ceiling, unmanaged-device access, default sharing link — settings on the box |
| File / email label | An individual document or message | Encryption, content marking (headers/footers/watermarks), and the usage rights baked into the encryption — settings on the content |
The critical truth: a container label does NOT encrypt the files inside it. It governs how the site behaves — who can join, whether guests are allowed, whether downloads are blocked on unmanaged devices — but a document in a "Confidential" site is not itself a "Confidential"-encrypted file unless it also carries a file label. Site label and file label are independent layers.
What the container label actually sets
When applied to a site, the label can force:
- Privacy: public or private group.
- External sharing: cap the site's
SharingCapability(it can only tighten, per the tenant-sharing concept). - Unmanaged-device access: full / limited (browser-only) / block — the same app-enforced restriction as the Conditional Access concept, but driven by the label.
- Default sharing link for the site.
Label-driven Copilot exclusion (the mechanism that matters)
This is where labels become a real Copilot boundary. Copilot honours file encryption: it retrieves content under the asking user's effective permissions AND their usage rights on encrypted items. A file encrypted by a sensitivity label will only surface in Copilot if the user has at least the EXTRACT (and VIEW) usage right in that label's encryption settings. Author a label whose encryption grants VIEW but withholds EXTRACT/copy, and Copilot can respect the item's existence but cannot pull its content into a response. That is the durable control the oversharing runbook points at: labels, not just ACLs.
The failure modes
- Assuming the container protects the content. Files in a labelled site are not encrypted — only labelled files are. Copilot can still read an unlabelled file in a "Confidential" site if the user has access.
- Label priority / precedence. Labels are ordered; a higher-priority label wins, and only one applies at a time. Auto-labelling can be overridden by a manual higher label.
- Unencrypted labels do nothing to Copilot. A label that only applies a watermark or footer imposes no cryptographic barrier — Copilot reads straight through it.
- Legacy content is unlabelled by default — labels are not retroactive without auto-labelling policies, so crown-jewel back-catalogues stay exposed until a scan labels them.
What to watch (proofs)
- Site labels in the estate: SharePoint admin center → Active sites shows the
sensitivity column;
Get-SPOSite <url> | fl SensitivityLabelreturns the label GUID applied to a site. - Label content-marking and encryption config: Purview → Information protection → Labels — inspect each label's encryption usage rights (does it grant EXTRACT?).
- Copilot exclusion proof: as a test user without EXTRACT rights, ask Copilot about a known encrypted document — it should not return the content.
- Coverage curve: auto-labelling policy simulation counts in Purview — how much crown-jewel content is actually labelled vs merely sitting in a labelled site.