Microsoft 365 Sensitivity Labels : What you need to know

Microsoft 365 Sensitivity Labels classify and protect data based on how sensitive it is — encryption, watermarking, access control — and unlike bolt-on security tools, the label travels embedded in the file itself, so it stays enforced even after the document is copied, downloaded, or shared outside the org.

In this post: Key features · Why it matters · Sensitivity vs. retention labels · The co-authoring tradeoff · Assigning a label via PowerShell · Best practices · When would you actually use this?

Key features

Classification: Public, Confidential, Highly Confidential, Restricted — or whatever taxonomy you define.
Encryption tied to the label, blocking unauthorized access even after the file leaves the org.
Access control defining who can view, edit, or share.
Watermarking and headers for visible classification, which also deters casual misdistribution.
Consistent enforcement across Outlook, SharePoint, OneDrive, Teams, and Office apps.

Why it matters

Compliance: GDPR, HIPAA, CCPA and similar regimes require demonstrable data handling controls — labels are how you actually show that, not just claim it.
Persistent protection: the label stays enforced regardless of where the file ends up, unlike perimeter-based security tools.
Reduces insider risk: access controls apply whether the exposure would be accidental or deliberate.
Low workflow friction: classification happens inside the apps people already use, not a separate tool that gets skipped under deadline pressure.

The label is embedded in the data itself — copy it, share it, download it, and the classification and security policy travel with it.

Sensitivity labels vs. retention labels

These two get confused constantly because they’re both applied the same way (a label picker on the file), but they solve unrelated problems. Sensitivity labels answer “how protected does this need to be” — encryption, access control, watermarking, applied the moment someone creates or opens the file. Retention labels answer “how long does this need to exist” — keep-for-X-years, delete-after-Y, or trigger a disposition review, entirely independent of who can currently access it. A file can carry both at once with no conflict: “Highly Confidential” (sensitivity) and “Retain for 7 years” (retention) are answering two different questions about the same document. If you’re only using one of the two, it’s worth checking whether the other actually applies to your compliance requirements — they’re not substitutes for each other.

The co-authoring tradeoff

Encryption and real-time collaboration have historically been in tension, and it’s still not fully resolved for the strictest option. Standard encrypted labels support co-authoring and AutoSave in SharePoint/OneDrive today. But two configurations specifically break it: a label with a user access expiry date set to anything other than “Never,” and any label using Double Key Encryption (DKE) — the option where your organization holds one encryption key and Microsoft holds the other, for content sensitive enough that you don’t want Microsoft able to decrypt it unilaterally. DKE-protected files can’t be co-authored, can’t be searched, can’t go through eDiscovery, and can’t be set as a library’s default label. That’s the real tradeoff: DKE gives you the strongest control over the data, at the cost of most of the collaboration features SharePoint is otherwise built around. Reserve it for the narrow set of content that genuinely needs it, not as a default “most secure” setting.

Assigning a label via PowerShell

Connect-IPPSSession
$Label = Get-Label -Identity "Confidential"
Set-LabelPolicy -Identity "Finance Policy" -Label $Label.Id -EnableMandatory $true

This assigns a “Confidential” label under a named policy and makes it mandatory — useful for rolling out labeling to a specific department (finance, in this example) without forcing it org-wide immediately.

Best practices

Define the labeling strategy before deploying — what each level actually means, in terms people will remember.
Use automatic labeling where you can — AI-driven detection catches what manual labeling misses through inconsistency or forgetfulness.
Train people, don’t just deploy — a label nobody understands doesn’t get applied correctly.
Audit usage via the Compliance Center rather than assuming the policy is working as designed.
Pair with DLP policies — labels classify, DLP actually blocks; together they cover more than either alone.
Scope policies by department instead of one org-wide policy trying to fit everyone.

When would you actually use this?

An auditor is asking how you demonstrate data-handling compliance for regulated data — labels plus DLP policy is the actual answer, not “we trust our staff.”
Finance/legal/HR documents keep getting shared more broadly than intended — label-driven access control and watermarking makes misdirected sharing visible and restricted, not silent.
You want classification without adding a separate tool to people’s workflow — this lives inside Outlook/Word/Teams already.

Hope this helps. Let me know in the comments if you run into issues.