Company data is the most valuable asset of any organization – but only those who know which data is stored where and how sensitive it is can effectively protect it. Microsoft Purview Sensitivity Labels provide the solution: a seamless classification directly in SharePoint Online that automatically delivers protection.
Why Data Classification is Essential
The Problem: Data Overgrowth in SharePoint
In an average Swiss SME, thousands of documents are stored in SharePoint – from harmless meeting notes to confidential contracts, personnel files, and financial data. Without classification, the system treats all documents equally. This leads to significant risks:
- Data Leaks: Confidential documents are accidentally shared externally
- Compliance Violations: Swiss DSG requires adequate protection for personal data
- Loss of Control: No one knows which sensitive data is stored where
- AI Risks: Copilot searches all accessible data – without labels, AI may inadvertently include confidential content in responses
The Solution: Microsoft Purview Sensitivity Labels
Sensitivity Labels are digital tags that you attach to documents, emails, and SharePoint sites. Each label carries protection policies with it – no matter where the document travels, the protection remains intact.
The Four Pillars of Classification
1. Manual Classification
Employees select the appropriate label when creating or editing documents. In Word, Excel, and PowerPoint, the label selection appears directly in the ribbon:
- Public: For content that can be freely shared (marketing, blog posts)
- Internal: Standard label for general business documents
- Confidential: Restricted access, encryption active
- Highly Confidential: Maximum protection with watermark, copy protection, and restricted access
2. Automatic Classification
Microsoft Purview automatically detects sensitive content based on over 300 predefined Sensitive Information Types (SITs):
- AHV Numbers (Swiss social security number)
- IBAN Numbers and credit card data
- Personal Data (name, address, birth date in combination)
- Medical Diagnoses and health data
- Custom Patterns: You can define your own SITs – for example, for internal project numbers or customer numbers
The automatic classification runs as a policy in the background and can automatically label documents or make recommendations to users.
3. Container Labels for SharePoint Sites
In addition to documents, you can also classify entire SharePoint sites, Teams channels, and Microsoft 365 groups. Container Labels control:
- Access by external guests: Allowed or blocked
- File sharing: Only internal or also external possible
- Access from unmanaged devices: Full access, restricted, or blocked
- Conditional access policies: Linked with Conditional Access in Entra ID
4. Trainable Classifiers
For industry-specific content that cannot be captured with patterns, Microsoft Purview offers trainable classifiers. You feed the system with example documents, and the AI learns to recognize similar content – ideal for:
- Contracts and offers
- Technical specifications
- Patent documents
- Industry-specific forms
Step-by-Step: Setting Up Sensitivity Labels
Step 1: Define Label Taxonomy
Before you create labels in the Microsoft Purview Compliance Portal, you need a well-thought-out taxonomy. Our recommendation for Swiss companies:
Level 1 – Public No restrictions. For marketing materials, blog posts, public documentation.
Level 2 – Internal / General Standard label for everyday business. No external access, but no encryption needed.
Level 3 – Confidential Encryption active. Only authorized individuals can open. Sub-labels for different groups (e.g., “Confidential – HR,” “Confidential – Finance,” “Confidential – Management”).
Level 4 – Highly Confidential Maximum protection: encryption, watermark, no printing, no copy-paste, no forwarding. For M&A documents, board meeting minutes, strategic planning.
Step 2: Create Labels in the Purview Portal
In the Microsoft Purview Compliance Portal under Information Protection > Labels, you create your labels with the desired protection settings. Important:
- Activate encryption for confidential levels
- Configure content marking (header, footer, watermark)
- Set expiration dates for time-limited access
- Define co-authoring rights for collaborative work
Step 3: Publish Label Policies
Labels alone do nothing – you need to distribute them to users via policies:
- Default Label: Which label is applied by default to new documents?
- Mandatory Labeling: Users must select a label before they can save
- Reason for Downgrading: Anyone wanting to change a label from “Confidential” to “Internal” must provide a reason
- Target Groups: Policies can be applied to specific groups or the entire organization
Step 4: Configure Auto-Labeling Policies
For automatic classification, configure service-side auto-labeling policies:
- Select the Sensitive Information Types to be detected
- Define thresholds (e.g., from 3 AHV numbers in a document)
- Start in simulation mode to review results
- Activate the policy only after successful validation
Best Practices for Swiss Companies
Ensure DSG Compliance
The Swiss Data Protection Act (DSG) requires “appropriate technical and organizational measures” to protect personal data. Sensitivity Labels specifically meet this requirement:
- Encryption protects against unauthorized access
- Access logging documents who accessed which data when
- Automatic classification prevents personal data from remaining unprotected
- Audit trail enables traceability to the EDÖB
Training and Change Management
The best technology is useless if employees do not understand it. Invest in:
- Short, practical training sessions (max. 30 minutes)
- Visual guides on the intranet
- Champions program: motivated employees as multipliers
- Regular reminders and success stories
Interaction with Microsoft Copilot
Sensitivity Labels are the foundation for secure work with Microsoft Copilot. Copilot respects label restrictions:
- Documents labeled “Highly Confidential” are not included in Copilot responses if the user does not have access
- Copilot adopts the highest label when content from various sources is merged
- Encryption remains intact even in AI-generated summaries
CNEXT Supports You
Implementing Sensitivity Labels is a strategic project that requires careful planning. CNEXT accompanies you from analyzing your data landscape to developing the taxonomy and technical implementation and training.
Contact us for a non-binding initial consultation – we will show you how to effectively classify and protect your SharePoint data.
Further Links & Sources
Internal:
External:
Further Links & Sources
Internal:
External: