Microsoft Purview Data Classification & Sensitivity Labels
Classification identifies sensitive content; sensitivity labels apply persistent protection
(visual marking, encryption, access, and downstream DLP/lifecycle controls). Together they are
the foundation of Microsoft Information Protection and every Purview enforcement story.
When to use
Defining what data is sensitive and applying a consistent label taxonomy across Microsoft 365,
Power BI/Fabric, and (via Purview Data Map) the broader estate.
Do not use this skill for AI prompt visibility (use purview-dspm-ai) or for full strategy
sequencing (use purview-information-governance).
Pick the right detection method
| Use case |
Method |
| Well-known regulated patterns (credit card, NI, SSN, IBAN) |
Sensitive Information Types (SITs) - built-in |
| Org-specific keywords / regex |
Custom SITs with confidence tuning |
| Concept-based ("this looks like a contract") |
Trainable classifiers (built-in or custom) |
| Match against your own customer/HR list |
Exact Data Match (EDM) - hashed structured data |
| Hybrid - regex + supporting evidence |
SIT with named entities + proximity |
Rule of thumb: SITs for patterns, classifiers for concepts, EDM for "is this row from our actual
customer table". Don't try to make one method do all three jobs.
Approach
- Inventory regulatory and business drivers - List the data types you must detect (GDPR PII,
PCI, IP, HR) and map each to a detection method.
Verify: each detection candidate has a named business owner.
- Choose detection methods - Pick SITs, trainable classifiers, or EDM per data type; build
or tune confidence levels.
Verify: a test corpus of true and false positives is prepared per detector.
- Design a label taxonomy - Keep it simple (e.g., Public / General / Confidential /
Highly Confidential) with sub-labels; define markings, encryption, and scope per label.
Verify: ≤4 top-level labels, ≤3 sub-labels each, named with business language not jargon.
- Publish labels - Use label policies to scope labels to users; set defaults and mandatory
labelling where appropriate; configure mandatory-label justification.
Verify: pilot users see the label menu in Word/Outlook with the correct default.
- Auto-labelling - Use client-side (recommended/automatic in apps) and service-side
auto-labelling (SharePoint/OneDrive/Exchange) based on SITs/classifiers; always start in
simulation.
Verify: simulation reports show match counts per label and per source; review false-positive sample.
- Roll out in waves - Pilot department -> business unit -> tenant; pair every wave with
training and a feedback channel.
Verify: label adoption metric per wave > target before promoting.
- Extend - Labels flow into DLP, Data Lifecycle, DSPM for AI, and Defender for Cloud Apps -
confirm downstream policies key off the new labels.
Guardrails
- Tune SIT confidence levels and run auto-labelling in simulation to control false positives
before enforcement.
- Plan label encryption carefully - it affects external sharing, co-authoring, search, and some
third-party tools; do not encrypt the top tier on day one without a recovery plan.
- Train users; mandatory labelling without guidance causes friction and mislabelling - publish a
short visual guide and the "when do I use Confidential vs Highly Confidential" rule.
- Keep the taxonomy short - a 9-tier taxonomy is unusable; users default to General.
- Confirm Power BI/Fabric, Office mobile, and Mac apps support the labels and protections you
choose - capability varies.
Common anti-patterns
- Inventing 12 labels then wondering why adoption stalls at 4%.
- Enabling auto-label in enforce mode on day one and breaking external sharing.
- Building custom SITs without a test corpus, then tuning in production.
- Encrypting the default label "to be safe" - now every shared file fails for external partners.
- Treating classification as IT's job with no data-owner sign-off on the taxonomy.
Example prompts
Design a sensitivity label taxonomy with auto-labelling.Create sensitive information types (SITs) and trainable classifiers.How do I use Exact Data Match (EDM) for precise classification?Classify data before applying protection and DLP.Pilot auto-labelling in simulation and measure false positives.
Microsoft Learn
1---2name: purview-data-classification3description: Guidance for Microsoft Purview data classification and sensitivity labels - sensitive information types (SITs), trainable classifiers, exact data match, and sensitivity label taxonomy with auto-labelling. Covers building a label taxonomy, picking detection methods, and rolling out auto-labelling in simulation. WHEN: data classification, sensitivity labels, sensitive information types, SIT, trainable classifier, exact data match EDM, auto-labelling, label taxonomy, classify data, information protection labels, MIP labels.4license: MIT5---67# Microsoft Purview Data Classification & Sensitivity Labels89Classification identifies sensitive content; **sensitivity labels** apply persistent protection10(visual marking, encryption, access, and downstream DLP/lifecycle controls). Together they are11the foundation of Microsoft Information Protection and every Purview enforcement story.1213## When to use14Defining what data is sensitive and applying a consistent label taxonomy across Microsoft 365,15Power BI/Fabric, and (via Purview Data Map) the broader estate.1617Do not use this skill for AI prompt visibility (use `purview-dspm-ai`) or for full strategy18sequencing (use `purview-information-governance`).1920## Pick the right detection method21| Use case | Method |22|---|---|23| Well-known regulated patterns (credit card, NI, SSN, IBAN) | **Sensitive Information Types (SITs)** - built-in |24| Org-specific keywords / regex | **Custom SITs** with confidence tuning |25| Concept-based ("this looks like a contract") | **Trainable classifiers** (built-in or custom) |26| Match against your own customer/HR list | **Exact Data Match (EDM)** - hashed structured data |27| Hybrid - regex + supporting evidence | SIT with **named entities** + proximity |2829Rule of thumb: SITs for patterns, classifiers for concepts, EDM for "is this row from our actual30customer table". Don't try to make one method do all three jobs.3132## Approach331. **Inventory regulatory and business drivers** - List the data types you must detect (GDPR PII,34 PCI, IP, HR) and map each to a detection method.35 *Verify: each detection candidate has a named business owner.*362. **Choose detection methods** - Pick SITs, trainable classifiers, or EDM per data type; build37 or tune confidence levels.38 *Verify: a test corpus of true and false positives is prepared per detector.*393. **Design a label taxonomy** - Keep it simple (e.g., Public / General / Confidential /40 Highly Confidential) with sub-labels; define markings, encryption, and scope per label.41 *Verify: ≤4 top-level labels, ≤3 sub-labels each, named with business language not jargon.*424. **Publish labels** - Use label policies to scope labels to users; set defaults and mandatory43 labelling where appropriate; configure mandatory-label justification.44 *Verify: pilot users see the label menu in Word/Outlook with the correct default.*455. **Auto-labelling** - Use **client-side** (recommended/automatic in apps) and **service-side**46 auto-labelling (SharePoint/OneDrive/Exchange) based on SITs/classifiers; always start in47 simulation.48 *Verify: simulation reports show match counts per label and per source; review false-positive sample.*496. **Roll out in waves** - Pilot department -> business unit -> tenant; pair every wave with50 training and a feedback channel.51 *Verify: label adoption metric per wave > target before promoting.*527. **Extend** - Labels flow into DLP, Data Lifecycle, DSPM for AI, and Defender for Cloud Apps -53 confirm downstream policies key off the new labels.5455## Guardrails56- Tune SIT confidence levels and run auto-labelling in **simulation** to control false positives57 before enforcement.58- Plan label encryption carefully - it affects external sharing, co-authoring, search, and some59 third-party tools; do not encrypt the top tier on day one without a recovery plan.60- Train users; mandatory labelling without guidance causes friction and mislabelling - publish a61 short visual guide and the "when do I use Confidential vs Highly Confidential" rule.62- Keep the taxonomy short - a 9-tier taxonomy is unusable; users default to General.63- Confirm Power BI/Fabric, Office mobile, and Mac apps support the labels and protections you64 choose - capability varies.6566## Common anti-patterns67- Inventing 12 labels then wondering why adoption stalls at 4%.68- Enabling auto-label in enforce mode on day one and breaking external sharing.69- Building custom SITs without a test corpus, then tuning in production.70- Encrypting the default label "to be safe" - now every shared file fails for external partners.71- Treating classification as IT's job with no data-owner sign-off on the taxonomy.7273## Example prompts74- `Design a sensitivity label taxonomy with auto-labelling.`75- `Create sensitive information types (SITs) and trainable classifiers.`76- `How do I use Exact Data Match (EDM) for precise classification?`77- `Classify data before applying protection and DLP.`78- `Pilot auto-labelling in simulation and measure false positives.`7980## Microsoft Learn81- Sensitivity labels: https://learn.microsoft.com/purview/sensitivity-labels82- Sensitive information types: https://learn.microsoft.com/purview/sensitive-information-type-learn-about83- Trainable classifiers: https://learn.microsoft.com/purview/trainable-classifiers-learn-about84- Auto-labelling: https://learn.microsoft.com/purview/apply-sensitivity-label-automatically85- Exact Data Match: https://learn.microsoft.com/purview/sit-learn-about-exact-data-match-based-sits86- Label encryption considerations: https://learn.microsoft.com/purview/encryption-sensitivity-labels
vinayaklatthe