An employee of a municipality shares an Excel file with an external party. It contains citizen service numbers. No one noticed until it was too late.
It's not malice. It's just too easy. And that's exactly why sensitivity labels and DLP exist in Microsoft Purview.
Sensitivity Labels: Protection Travels with You
With a sensitivity label, you classify a document or email. For example, *Public*, *Internal*, *Confidential*, or *Strictly Confidential*.
You associate protection with a label:
- Encryption: only authorized persons can open the document.
- Marking: a header or watermark like "Confidential".
- Restrictions: for example, no forwarding or printing.
The smart part is: that protection is embedded in the file itself. Is it downloaded or forwarded? The protection remains.
You can also apply labels to teams and SharePoint sites. Then you determine, for instance, whether guests may have access.
DLP: The Safety Net Function
Data Loss Prevention (DLP) recognizes sensitive information and intervenes. Think of:
- A warning if someone shares a document with citizen service numbers externally.
- Blocking an email with credit card information.
- A notification in Teams when someone puts health data in a chat.
Purview recognizes many types of sensitive information by default, including Dutch and Belgian identification numbers.
How to Implement It
- Start with a simple labeling scheme. Four or five labels are enough. Too much choice is paralyzing.
- Let users apply labels themselves. With a default label and clear explanation.
- Start DLP in test mode. See what happens before blocking anything.
- Use warnings first. A timely tip teaches more than a block.
- Expand step by step. For example, to automatic labeling or devices.
What License Do You Need?
Basic features for labels and DLP are included in Business Premium and E3. Automatic labeling and more extensive DLP features usually require E5 or a compliance add-on.
Labels and Copilot
Sensitivity labels also work with Microsoft 365 Copilot. Copilot respects the protection and incorporates labels into new content it creates based on labeled sources. Planning to deploy Copilot? Then this is a good time to introduce labels.
Not an IT Project, but an Agreement
Labels only work if employees understand why. Explain what is confidential in your organization. With examples from their own work. This way, information protection becomes a habit, not a hurdle.
Want to collaborate GDPR-proof in Microsoft 365? Schedule a conversation and we’ll help you set up a labeling schema that employees actually use.
Frequently Asked Questions
Can externals open labeled documents?
Yes, if you grant them access via the label. They then log in with their own account.
What is the difference between a label and a retention policy?
A sensitivity label protects information. A retention label determines how long information is kept.
Can DLP also work in Teams chats?
Yes. DLP can recognize and block sensitive information in Teams chats and channels, depending on your license.
