> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/purview/sensitivity-labels.md). # Sensitivity Labels Sensitivity labels are classifications — like *Confidential* or *Highly Confidential* — that users or automation apply to files, emails, and containers (Teams, groups, SharePoint sites) to trigger protection: encryption, access restrictions, content marking (headers/footers/watermarks), and container-level controls like external sharing and guest access. A label is a reusable *definition*; a separate Microsoft object, a **label policy**, is what actually publishes a set of labels to specific users or groups and decides who sees which labels and whether labeling is mandatory. Augmentt manages the labels themselves, not label policies — see **What Sensitivity Labels doesn't do** below. {% hint style="warning" %} Purview is a separately licensed add-on, not part of the base Secure module. If a client isn't authorized for it, this tab shows a message directing you to contact **** instead of the usual controls. {% endhint %} You'll find it at **Secure > Purview > Sensitivity Labels**, split into **Labels** and **Templates**. This is the most fully built-out of the three Purview tools — creating or editing a label covers essentially the full Purview label surface, described field-by-field below. ## Properties * **Name** — the internal identifier. Immutable after creation (Microsoft's `Set-Label` works off `Identity`, not name). * **Display name** — what users see when applying the label. * **Priority** — determines processing order when a label needs to apply on top of another; on create, Augmentt places the new label at the lowest (least sensitive → shown as "will be created at the lowest priority") position, matching Purview portal default behavior. Priority becomes directly editable once the label exists. * **Enabled / disabled** — a disabled label still exists but can't be applied. * **Description for users** (`Tooltip`) — shown to users choosing the label. Required. * **Description for admins** (`Comment`) — internal notes, optional. * **Label color** — a fixed ten-color Fluent UI palette matching the Microsoft Purview portal's own picker (Charcoal, Silver, Beige, Berry, Lavender, Light blue, Light green, Marigold, Orange, Burgundy). A sublabel inherits its parent's color and can't set its own. * **Scope / content type** — which content types the label applies to: **Files**, **Emails**, and **Groups & sites**. (Microsoft's underlying `ContentType` also spans meetings and other schematized data in the wider Purview product; Augmentt's create/edit form covers Files, Emails, and Groups & sites — the three that carry configurable protection settings below. "Groups & sites" expands on Microsoft's side to the `Site` and `UnifiedGroup` content types.) Changing a label's protection settings later depends on which of these are selected — item-level protection (encryption, content marking) only appears when Files and/or Emails are in scope; container-level protection only appears when Groups & sites is in scope. ## Protection settings — item scope (Files / Emails) Shown only when the label's scope includes Files and/or Emails. ### Encryption / access control Toggled on with **Control access to files with encryption** (this requires **Azure Rights Management (Azure RMS)** to be active on the tenant — Augmentt surfaces a clear error if it isn't). Two modes: * **Assign permissions now** (`EncryptionProtectionType: Template`) — an admin defines exactly who can access protected content and what they can do: * **Permission assignments** — one or more rows, each with: * **Identities** — users, groups, or domains the permission applies to. * **Permission level** — a preset (**Owner**, **Editor**, **Restricted editor**, **Viewer**) that expands to a specific rights set, or a fully custom set of rights. * **Rights** — the underlying granular rights Microsoft supports: View, Edit, Doc-edit, Extract, View rights data, Edit rights data, Object model access, Export, Print, Reply, Reply-all, Forward, Owner. The four presets bundle these differently (e.g. Viewer = View + view-rights-data + object-model only; Owner = everything including the Owner right itself). * **Content expiration** — **Never**, or **expire after N days**. * **Offline access** — **Always** available offline, **Never** (must be online to open), or **available offline for N days** (up to 65,535 days). * **Let users assign permissions when they apply the label** (`EncryptionProtectionType: UserDefined`) — no admin-defined rights; instead Microsoft applies content-type defaults (`EncryptionDoNotForward` for email content, `EncryptionPromptUser` for file content) so the end user decides. ### Content marking Toggled on with **Apply content marking**, then any combination of: * **Header** — enabled/disabled, with its own header text. * **Footer** — enabled/disabled, with its own footer text. * **Watermark** — enabled/disabled, with its own watermark text. At least one of the three must be enabled with non-empty text for content marking to take effect — an enabled toggle with blank text is validated against and, on update, is not sent to Microsoft (avoiding a label that looks configured but marks nothing). ## Protection settings — Groups & sites scope Shown only when the label's scope includes **Groups & sites**, and only when **sensitivity labels for containers** are already enabled in the Microsoft Purview portal — this is a tenant-level prerequisite Microsoft requires before container labels can carry protection settings at all; Augmentt detects the missing prerequisite and blocks adding this scope with a clear prompt rather than silently failing later. * **Privacy & external user access** * **Group privacy** — Public, Private, or unset (`None`). * **Allow guest access** — whether external guests can be added to the group/site at all. * **External sharing & unmanaged devices** (grouped under one enable switch, since Microsoft's underlying Conditional Access-style settings are optional but at least one sub-setting must be chosen once enabled): * **Site external sharing control** — one of four levels: **Anyone** (new and existing external users, no sign-in required), **New and existing guests** (sign-in required), **Existing guests only**, or **Organization-only** (no external sharing). * **Unmanaged device access** — **Full access**, **Limited (web-only) access**, or **Block access**, applied via Conditional Access when a device isn't compliant/managed. These three are mutually exclusive — only the selected one is sent to Microsoft. * **Private teams & shared channels** * **Private team discoverability** — whether a private team with this label can be found via search. * **Shared channels: internal only** — blocks sharing the channel with external tenants. * **Shared channels: same label only** — restricts sharing to teams/channels carrying the exact same label. * **Shared channels: private teams only** — restricts channel sharing to private teams specifically. ## Labels and sublabels A label can be a **parent label** (a grouping with no protection settings of its own, shown as a header users expand) or a **sublabel** under one. Sublabels inherit color from the parent and can't set their own; editing a sublabel sends only the sections that actually changed, since Microsoft's `Set-Label` treats content type, encryption, marking, and groups/sites settings as independently updatable blocks. {% hint style="info" %} A handful of label configurations are edit-only in Microsoft Purview itself and can't be edited from Augmentt: parent label groups, and labels using a scope Augmentt doesn't yet model in its create/edit form (Microsoft's `ContentType` values beyond File/Email/Site/UnifiedGroup — e.g. meetings or schematized-data scopes). Augmentt shows why editing is disabled in those specific cases rather than silently failing or corrupting the label on save. {% endhint %} ## Creating and managing labels **Secure > Purview > Sensitivity Labels > Labels** lists every label on the tenant with its **priority** (editable, same drag/move pattern as DLP rule priority — higher processes first), **scope content type**, parent/sublabel relationship, and enabled status. Selecting a label opens the full detail view covering everything above. Unlike DLP and Retention, Sensitivity Labels supports building a **new** template from scratch (not only converting a live policy) as well as converting an existing label into a template, then deploying that template to one tenant or a baseline group of tenants — matching the create/edit field surface described above. ## Default templates Purview ships with **no built-in sensitivity label templates**. There is no seeded "Confidential" / "Highly Confidential" / "Public" starter set pre-populated for a new tenant to deploy — every template is either authored fresh in Augmentt or converted from a label that already exists on a connected tenant. ## Fleet view Switching to **All Companies** on the Sensitivity Labels tab shows every connected tenant with a simple status per tenant — loading, a label count, empty, or an integration error — so you can scan for label coverage gaps across your whole client base before drilling into any one tenant. This is one request per connected tenant, since Microsoft has no single cross-tenant Purview API. ## How deployment actually works Everything you create or change here is applied to the customer's tenant through Microsoft's **Security & Compliance PowerShell** cmdlets (the same plane behind the Purview compliance portal), not the Microsoft Graph API. Augmentt queues the change as a background task against the tenant and polls it to completion. ## What Sensitivity Labels doesn't do * Sensitivity **label policies** — the separate Microsoft object that publishes a set of labels to specific users/groups, sets a mandatory or default label, and controls whether justification is required to remove a label — aren't manageable from Augmentt. Only the labels themselves are. Publishing labels to users is still done from the Microsoft Purview compliance portal. * Groups & sites protection settings require the tenant-level "sensitivity labels for containers" prerequisite to already be turned on in Purview; Augmentt can't turn that prerequisite on for you, only detect and surface it. * A handful of scope/label-group combinations (noted above) are view-only from Augmentt and must be edited directly in Purview. ## Posture-check resolution There is **no dedicated Sensitivity Labels entry in Compliance Audit today**. A search of the platform's posture-check registry (`SECURE_CHECK_TYPES` and its numeric mapping) turns up nothing referencing sensitivity labels, Purview labels, or label policies at all — no check like "sensitivity labeling enabled" or "default label configured" contributes to a client's compliance score. Deploying (or not deploying) sensitivity labels currently has zero effect on Compliance Audit results. Since it doesn't move a score, here's the risk case worth knowing anyway: * **Unencrypted sensitive files leaving the tenant unprotected** — without a sensitivity label enforcing encryption, a file with sensitive content that gets forwarded, shared externally, or downloaded to an unmanaged device travels with zero protection baked in. A label with access control means the *file itself* stays protected even after it leaves the boundary DLP or Conditional Access can see. * **Uncontrolled Teams/group sprawl for sensitive projects** — a Groups & sites label with locked-down external sharing and blocked unmanaged-device access is often the only practical way to guarantee a sensitive project's Team can't quietly pick up an external guest or a personal-device viewer. * **No visible classification for humans or automation** — content marking (headers, footers, watermarks) is what makes sensitivity visible to a human glancing at a printed or forwarded document, and consistent classification is also what DLP conditions and eDiscovery searches downstream often key off of. Without labels, you lose both the human signal and a useful automation hook. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/purview/sensitivity-labels.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.