Microsoft Purview Sensitivity Labels - What They Are and Why Copilot Makes Them Urgent
Sensitivity labels are a feature of Microsoft Purview that most Microsoft 365 tenants have available but have not fully implemented. They allow you to classify documents and emails - Confidential, Internal, Public - and apply consistent policies to each classification. Before Copilot, implementing sensitivity labels was a compliance best practice. With Copilot, they become the primary mechanism for governing what AI can retrieve and surface from your content.
What sensitivity labels actually do
A sensitivity label is a classification tag applied to a document, email, or Teams meeting. The label persists with the file - it travels with it when it is shared, downloaded, or moved. The label itself does not restrict access, but the policies attached to the label do.
Policies can include encryption (only authorised users can open the file), watermarking (visible or invisible watermarks on printed or downloaded copies), header and footer additions, and access restrictions. For the purposes of Copilot, the most relevant capability is that labelled content can be handled differently - excluded from Copilot responses, handled with additional controls, or flagged when Copilot attempts to summarise it.
A simple label taxonomy for Australian SMBs
Example label structure
| Label | Applies to | Typical policy |
|---|---|---|
| Public | Content intended for external audiences - website copy, published reports | No restrictions |
| General | Standard internal business documents with no sensitive content | No restrictions, internal use guidance |
| Confidential | Client files, financial data, contracts, HR records | Encryption optional, Copilot controls applicable |
| Highly Confidential | Board papers, acquisition planning, executive compensation, legal privilege | Encryption required, excluded from Copilot responses |
How sensitivity labels interact with Copilot
Copilot respects sensitivity labels. Content labelled Highly Confidential can be configured so that Copilot will not include it in responses, even if the user technically has access to the underlying file. This is one of the few Copilot-specific controls that operates independently of the underlying permission model.
This matters because permissions and sensitivity are not the same thing. A board paper might be stored in a SharePoint site that the CFO has access to along with twenty other finance team members. The permission model says those twenty people can access the file. But the sensitivity label can say Copilot should not surface the board paper in response to a general query from any of those users - only when it is directly requested.
Without sensitivity labels, Copilot treats all accessible content equally. A highly confidential board paper and a routine internal memo are both just documents that fall within the user's permission boundary.
Why most tenants have not implemented labels
Microsoft Purview sensitivity labels have been available for several years. Most Microsoft 365 Business Premium and enterprise tenants have the licence entitlement to use them. Few have fully implemented them, for several reasons:
- Labelling requires a policy decision about what constitutes confidential content in your organisation - a decision that tends to get deferred
- Auto-labelling (applying labels automatically based on content scanning) requires configuration and tuning
- Manual labelling requires training users and managing a behaviour change program
- The perceived compliance benefit was not strong enough to justify the implementation effort - until Copilot changed the calculus
How to get started with sensitivity labels
- 01
Design your label taxonomy first
Start with three to four labels maximum. Public, General, Confidential, and Highly Confidential covers most SMB requirements. Resist the temptation to create many granular labels - complex taxonomies are harder to adopt and harder to maintain. You can add labels later.
- 02
Create labels in the Microsoft Purview compliance portal
Access the compliance portal via compliance.microsoft.com. Under Information protection, create your labels with the desired settings for each classification level. At this stage, apply no policies - just create the labels and their definitions.
- 03
Publish labels to users
Labels are made available to users through label policies. Publish your label taxonomy to your pilot group first - typically IT staff and a small number of representative business users who can provide feedback on the taxonomy before organisation-wide rollout.
- 04
Apply Copilot-specific controls to your highest sensitivity label
For your Highly Confidential label, configure the label to encrypt content and configure Copilot to exclude labelled content from responses. This gives you the most important Copilot control without requiring full label adoption across your environment.
- 05
Train users on manual labelling
Users see label options in Word, Excel, PowerPoint, Outlook, and Teams when creating or editing content. Training should focus on the four labels, what each means, and a simple decision rule: 'When in doubt, label up.' A document labelled more conservatively than needed causes minimal disruption. A document labelled too openly is an exposure.
- 06
Configure auto-labelling for common sensitive content types
Microsoft Purview can automatically apply labels to documents containing Australian tax file numbers, credit card numbers, medical record formats, and other recognisable sensitive data patterns. Configure auto-labelling for your Confidential label targeting these content types. This catches the most obvious sensitive content without requiring manual intervention.
The minimum viable sensitivity label implementation for Copilot readiness is a single Highly Confidential label applied to your most sensitive content, with Copilot exclusion configured. That is a one-day implementation that gives you the most important protection. The full taxonomy and auto-labelling can follow.
The relationship between labels and permissions
Sensitivity labels do not replace permission management. They are a complementary control that operates at the content layer rather than the access layer. The correct approach is both: clean up permissions so content is only accessible to those who should have access, and apply sensitivity labels so that Copilot handles the most sensitive content with additional controls regardless of who has access.
Neither control alone is sufficient. Permissions without labels means Copilot treats all accessible content equally. Labels without permission review means the sensitivity policies are applied, but the underlying access problem remains.
Next step
Copilot Readiness Assessment
The Copilot Readiness Assessment reviews your current sensitivity label deployment, recommends a label taxonomy appropriate for your organisation, and configures Copilot controls for your highest-sensitivity content.
Learn more