Create and Publish Sensitivity Labels - Microsoft Purview (Compliance) (2023)

.

All Microsoft Purview information protection solutions are implemented usingsensitivity labels. To create and publish these labels, go toMicrosoft Purview-Compliance-Portal.

First, create and configure the sensitivity labels you want to make available to applications and other services. For example, the labels you want users to see and apply in Office apps.

Then create one or more labeling policies that contain the labels and policy settings that you configured. It is the labeling policy that publishes the labels and settings for selected users and locations.

before you start

Your organization's global administrator has full permissions to create and manage all aspects of sensitivity labels. If you are not logging in as a global admin, read on.Permissions required to create and manage sensitivity labels.

Create and configure sensitivity labels

1. DoMicrosoft Purview-Compliance-Portal, selectsolutions>information protection>labels

2. Nolabelspage, select+ Create a labelTo start configuring the new sensitivity label:

   Use

   (Video) How to Implement & Manage Sensitivity Labels and Label Policies | Microsoft Purview | Microsoft365

   By default, tenants don't have labels and you have to create them. The labels in the example image show default labels that have beenmigrated from Azure Information Protection.

3. NoSet the scope for this labelOn the page, the options you select determine the scope of the label for the settings you can configure and where they are visible when published:

   

   • What ifArticleis selected, you can configure settings that apply to applications that support sensitivity labels, such as B. Office Word and Outlook. Optionally, you can expand these labels in the preview.include meetingsfrom Teams and Outlook, and to secure Teams meetings themselves by applying settings to Teams meetings and related chats.

     Se oArticleIf the option is not selected, the first page of these settings is displayed, but you cannot configure them and the labels are not available for users to choose from in these applications.

     See Also

     CREATE TYPE (Transact-SQL) - SQL ServerCREATE VIEW (Transact-SQL) – SQL ServerCreate a database user - SQL ServerCreate a login - SQL Server

   • What ifgroups and sitesis selected, you can configure settings that apply to Microsoft 365 for teams and SharePoint sites and groups. If this option is not selected, the first page of these settings will be displayed, but you will not be able to configure them and the labels will not be available for user selection for groups and sites.

   For information about theSchematic databasesscope, cf.Automatically label your content in Microsoft Purview Data Map.

4. Follow the instructions for configuring the tag settings.

   For more information on label settings, seeWhat sensitivity labels can dogeneral information and use the UI help for individual settings.

5. Repeat these steps to create more labels. However, if you want to create a child label, first select the parent label and select...ProMore promotionsand then selectadd sub-label.

6. After creating all the necessary labels, check their order and move them up or down if necessary. To change the order of a label, select...ProMore promotionsand then selectRide upormove down. For more information, seeLabel priority (order matters)from general information.

To edit an existing label, select it and selectedit labelKnopf:

This button starts theEdit sensitivity labelSetting that allows you to change all tag settings in step 4.

Delete a label only if you understand the implications for users. For more information, seeRemove and delete bookmarksSection.

Until you publish your labels, they cannot be selected from apps or services. To release the labels, they must beadded to a labeling policy.

Additional label settings with Security and Compliance PowerShell

Additional annotation settings are available withdefinite designationcmdlet de.

For example:

• Use olocale settingsMultinational deployment parameters to allow users to see the label name and tooltip in their local language. Thefollowing sectionhas an example configuration that specifies the label name and tooltip text for French, Italian, and German.

• Advanced configurations supported by the inner label are included in the PowerShell documentation. For more help configuring these advanced PowerShell settings, see thePowerShell tips for configuring advanced settingsSection. For other advanced configurations supported by the Azure Information Protection unified labeling client, seeThis client's administration guide documentation.

Example configuration for configuring a sensitivity label for different languages

The following example shows the PowerShell configuration for a label named "Public" with placeholder text for the tooltip. In this example, the label name and tooltip text are set to French, Italian, and German.

As a result of this setting, users with Office applications that use these display languages ​​will see their label names and tooltips in the same language. If you have the Azure Information Protection Unified Labeling client installed to label files from File Explorer, users with these language versions of Windows will see your label names and tooltips in their local language when using the label actions right-click the label.

Use Office for the languages ​​you need to supportlanguage identifier(aka language tags) and provide your own translation for the tag name and tooltip.

Before executing the commands in PowerShell, you must first.

$Languages ​​= @("fr-fr","it-it","de-de")$DisplayNames=@("Publique","Publico","Öffentlich")$Tooltips = @("Texte Français ", "Testo italiano","English text")$label = "Public"$DisplayNameLocaleSettings = [PSCustomObject]@{LocaleKey='DisplayName';Settings=@(@{key=$Languages[0];Value=$DisplayNames [0];}@{key=$Languages[1];Value=$DisplayNames[1];}@{key=$Languages[2];Value=$DisplayNames[2];})}$TooltipLocaleSettings = [PSCustomObject ]@ {LocaleKey='Tooltip';Settings=@(@{key=$Languages[0];Value=$Tooltips[0];}@{key=$Languages[1];Value=$Tooltips[1]; }@ {key=$Languages[2];Value=$Tooltips[2];})}Set-Label -Identity $Label -LocaleSettings (ConvertTo-Json $DisplayNameLocaleSettings -Depth 3 -Compress),(ConvertTo-Json $TooltipLocaleSettings -Depth 3 - Komprimieren)

PowerShell tips for configuring advanced settings

Although you can specify a sensitivity label by its name, we recommend using the GUID of the label to avoid potential confusion when specifying the label or display name. The label name is unique within your tenant, so you can be sure you are configuring the correct label. The display name is not unique and can result in setting the wrong label. To find the GUID and confirm the scope of the label:

Get-Label | Format-Table -Property DisplayName, Name, Guid, ContentType

To remove an advanced setting from a sensitivity label, use the same AdvancedSettings parameter syntax, but specify a null string value. For example:

Set-Label -Identität 8faca7b8-8d20-48a3-8ea2-0f96310a848e -AdvancedSettings @{DefaultSharingScope=""}

To verify your tag configuration, including advanced settings, use the following syntax with your own tag GUID:

(Get-Label -Identity 8faca7b8-8d20-48a3-8ea2-0f96310a848e).configurações

Publish sensitivity labels by creating a labeling policy

1. DoMicrosoft Purview-Compliance-Portal, selectsolutions>information protection>etiquette guidelines

2. Noetiquette guidelinespage, selectpost tagto startcreate policyConstruction:

   Use

   (Video) How to create and use sensitivity labels in Microsoft 365

   By default, tenants don't have label policies and you must create them.

3. NoSelect sensitivity labels to publishside, choose theSelect sensitivity labels to publishShortcut. Select the labels you want to be available in apps and services, then selectAdd to.

   Important

   If you select a child label, be sure to also select the parent label.

4. Review selected labels and select to make changesTo edit. Otherwise, selectNext.

5. Follow the prompts to configure policy settings.

   The displayed policy settings match the scope of the selected labels. For example, if you selected labels that only have thisArticleScope, don't see policy settingsApply this label to groups and sites by defaulteRequire users to label their groups and sites.

   For more information about these settings, seeWhat Labeling Guidelines Can Dogeneral information and use the UI help for individual settings.

   For labels set toMicrosoft Purview Data Map Assets (Preview): These labels have no associated policy settings.

6. Repeat these steps if you need different policy settings for different users or scopes. For example, you might want additional labels for a group of users, or a different default label for a subset of users. Or if you've set up labels with different scopes.

7. If you create more than one labeling policy that might conflict for a user, review the order of the policy and move it up or down as needed. To change the order of a label policy, select...ProMore promotionsand then selectRide upormove down. For more information, seeLabel policy priority (ordering issues)from general information.

completion ofcreate policy-The setting automatically publishes the labeling policy. To make changes to a published policy, simply edit it. You cannot choose a specific action to post or repost.

To edit an existing label policy, select it and then select theedit policyKnopf:

This button starts thecreate policyConfiguration that allows you to edit the included labels and label settings. When configuration is complete, all changes are automatically replicated to selected users and services.

Additional labeling policy settings using Security and Compliance PowerShell

Additional labeling policy settings are available withSet-LabelPolicycmdlet de.

This documentation contains advanced settings supported by integrated labeling. For other advanced configurations supported by the Azure Information Protection unified labeling client, seeThis client's administration guide documentation.

When to expect new labels and changes to take effect

For labels and label policy settings, allow 24 hours for changes to propagate across services. There are many external dependencies, each with their own time cycles, so it's a good idea to wait this 24 hour period before spending time troubleshooting labels and label policies for recent changes.

However, there are some scenarios where label and label policy changes can take effect much more quickly or take longer than 24 hours. For example, updates to new and deleted sensitivity labels for Word, Excel, and PowerPoint on the web can be replicated within an hour. But for configurations that rely on populating a new group and changes to group membership or network replication latency and bandwidth limitations, these changes can take 24-48 hours.

Use PowerShell for sensitivity labels and their policies

you can use nowto create and configure all the settings you see in your labeling admin center. This means that in addition to using PowerShell for settings not available in the naming admin centers, you can now fully script the creation and management of sensitivity labels and sensitivity label policies.

See the following documentation for supported parameters and values:

• new label
• New-LabelPolicy
• definite designation
• Set-LabelPolicy

You can also useremove tageRemove-LabelPolicyif you need to script deletion of sensitivity labels or sensitivity label policies. However, before deleting sensitivity labels, read the next section.

Remove and delete bookmarks

In a production environment, it is unlikely that you will need to remove sensitivity labels from a labeling policy or delete sensitivity labels. It is most likely that you will need to perform one or more of these actions during an initial trial period. Make sure you understand what happens when you perform any of these actions.

Removing a label from a label policy is less risky than deleting it and can always be added back if needed. You cannot delete a label if it is still in a label policy.

If you remove a label from a label policy so that the label is no longer published to the originally specified users, the next time the label policy is updated, users will no longer see that label for selection in their Office applications. If that label has already been applied, the label will not be removed from the content or container. For example, users using labels built into desktop apps for Word, Excel, and PowerPoint will still see the label name applied in the status bar. An applied container label still protects the Teams or SharePoint site.

In comparison, when deleting a label:

• If the label has encryption applied, the underlying protection model is shelved so previously protected content can still be opened. Due to this archived protection template, you cannot create a new tag with the same name. Although it is possible to delete a protection template withPower Shell, only do this if you are sure you don't need to open content encrypted using the archived template.

• For documents stored in SharePoint or OneDrive and you havesensitivity labels enabled for office files: When you open the document in Office for the web, the label applied in the app doesn't appear and the name of the label no longer appears in thesensitivityColumn in SharePoint. If the deleted label has applied encryption and the Services are able to process the encrypted content, the encryption will be removed. The outgoing actions of these services produce the same result. For example, download it, copy it there, move it there, and open it with a desktop or mobile Office app. While the label information remains in the file's metadata, applications are no longer able to map the label ID to a friendly name, leading users to assume that a file is not labeled.

• For documents stored outside of SharePoint and OneDrive or for which you haven't enabled sensitivity labels for Office files and for emails: When you open the content, the label information is preserved in the metadata, but without mapping the label ID to name persistent users View the name of the applied label (for example, in the status bar of desktop applications). If the deleted label applied encryption, the encryption will remain and users will continue to see the name and description of the now archived protection template.

• For containers like sites in SharePoint and Teams: The label is removed and any settings defined with that label are no longer applied. This action typically takes between 48 and 72 hours for SharePoint sites, and may be faster for Microsoft 365 teams and groups.

As with all label changes, removing a sensitivity label from a labeling policy or deleting a sensitivity label takes time to replicate between users and services.

Next steps

Use the following articles to configure and use your sensitivity labels for specific scenarios:

• Restrict access to content using encryption on sensitivity labels

• Automatically apply a sensitivity label to content

  (Video) How to Create & Manage Retention Labels & Label Policies in Microsoft 365 | Microsoft Purview

• Use sensitivity labels with teams, groups, and sites

• Enable sensitivity labels for Office files in SharePoint and OneDrive

To monitor how your labels are being used, seeStart with data classification.