Microsoft Purview's version is the reference point for the term. Administrators create the labels and publish them to users or groups; users then see them in Word, Excel, PowerPoint and Outlook, on the desktop and on the web. Because the label is written into the item's metadata in clear text, it stays with the document when it is downloaded, emailed or copied, and other software can read it. Each item carries one sensitivity label at a time, and the labels sit in a priority order, so replacing Confidential with something lower can be made to require a written justification. Microsoft's own deployment advice reports that real deployments lose effectiveness once people are offered over five top-level labels.
- Encryption that limits who can open the item and what they may do with it.
- Content marking: headers, footers and watermarks stating the classification.
- Container settings for Teams, groups and SharePoint sites, such as guest access and external sharing.
- Automatic or recommended labelling when the content matches sensitive-information rules.
Labels and the AI assistant
Microsoft 365 Copilot recognises labels: where a label applies encryption, Copilot returns content from that item only if the user holds the right to copy from it, and new content drafted from a labelled source in Word, PowerPoint or Outlook can inherit the source's label. That makes labelling the practical brake on an assistant surfacing a salary file in a summary, a concern the AI assistants at work topic returns to.
Encryption has a collaboration cost too: desktop co-authoring of encrypted files needs a tenant setting switched on. Google Workspace offers classification labels for Drive files and Gmail messages, which administrators can apply automatically through data loss prevention rules. The label complements rather than replaces encryption policy, least privilege on the files themselves and zero trust thinking, and it belongs in the collaboration and meetings topic wherever files leave the team.
Not the Outlook sensitivity setting
Outlook has long let a sender mark a message as personal, private or confidential. Microsoft's own documentation separates that from a sensitivity label: the older setting signals what the sender intends and enforces nothing.