Week 8, Day 4 — Sensitivity labels deep-dive

What does the Finance label currently do?

• Ask: "You created the Confidential/Finance label in Week 7 Day 5. If Priya Nair applies it to a spreadsheet and then emails it to an external address — what does the label actually prevent?" — reveal the answer: nothing. The label adds a header and is visible in Purview, but there is no encryption and no enforcement. It is a sticker.
• Ask: "What would need to be true for the label to actually block an external recipient from opening that spreadsheet, even if they somehow received it?" — prime the answer: encryption. The file must be encrypted at source so that only authorised identities can obtain the decryption key — regardless of where the file travels.
• Frame the day: by 1:30pm, the Confidential/Finance label will have four layers — encryption (Part A), auto-labelling policy in simulation (Part B), SharePoint library default (Part C), and a label condition in the existing DLP policy (Part D). The label stops being a sticker and becomes a full governance control.

AzureRMS encryption model

When a user applies a Confidential/Finance label to a Word document, the Microsoft Purview Information Protection client calls the Azure Rights Management service, which generates a content key unique to that file. The content key is encrypted using the tenant's Azure RMS public key and embedded in the file's licence store. When a recipient tries to open the file, their client sends the licence request to Azure RMS, which checks whether their Entra ID account is in the Finance group. If yes: file opens. If not: access denied — even if the file is in their Downloads folder.

• Permission levels — Viewer (read only), Reviewer (read + comment), Co-Author (read + edit + save, no print restriction), Co-Owner (all rights). For Finance: Co-Author is appropriate — they need to edit documents, not just read them.
• Rights Management owner — the RMS owner always retains full rights regardless of group membership changes. Set this to the admin account, not a shared mailbox. If a user leaves the Finance group, they lose access immediately. The RMS owner does not.
• Offline access — the client caches a use licence for a configurable number of days (set to 7 in the lab). After 7 days offline, the user must re-authenticate against Azure RMS. This balances usability for travelling employees with security.
• The label travels with the file — if a Finance user emails an encrypted file to an external address, the DLP policy (after Part D) blocks it. But if the file somehow left before DLP was in place, the external recipient still cannot open it — encryption is the last line of defence regardless of where the file ends up.

Add encryption to the Confidential/Finance label

• Navigate to purview.microsoft.com → Information protection → Labels → Confidential → Finance. Click Edit label.
• Navigate to the Encryption step. Set: Configure encryption settings: On.
• Assign permissions now or let users assign permissions: Assign permissions now.
• User access to content expires: Never. Allow offline access: 7 days.
• Click Assign permissions → + Add all users and groups in your organisation. Remove the default. Then: + Add users or groups → LL-Finance group → Add. Permission level: Co-Author.
• Add a second entry: + Add users or groups → your admin account → Add. Permission level: Co-Owner. This makes the admin the Rights Management owner.
• Save through to completion. Record in Lab Journal: what does the RMS owner permission allow that Co-Author does not?

Auto-labelling — simulation mode, location scoping, and how it differs from library defaults

Auto-labelling policies can apply labels to thousands of files before anyone reviews the results — which is why Microsoft requires simulation mode as a mandatory first step. In simulation, the policy scans and identifies files that would be labelled, but makes no changes. The Purview portal shows matched items after 24–48 hours.

• Auto-labelling vs SharePoint default labels — auto-labelling scans content and applies based on conditions (SITs, keywords). SharePoint default labels apply to new or unlabelled items in a specific library regardless of content. Both are needed: auto-labelling catches sensitive content anywhere; library defaults catch new uploads before content is even written.
• Location scoping — the lab scopes to the Finance SharePoint site, all Exchange email, and all OneDrive. A production policy would scope more carefully — all-of-Exchange scans every email for credit card numbers, which generates significant volume and processing time.
• Label override — auto-labelling can be set to override a lower-priority label or to never override a manually applied label. For the lab, accept the default: never override a manual label of equal or higher priority.

Auto-labelling policy → SharePoint library default → DLP label condition

Part B — Auto-labelling policy in simulation (10 min)

• Navigate to purview.microsoft.com → Information protection → Auto-labelling → + Create policy.
• Policy name: LL — Finance Auto-Label. Choose label: Confidential/Finance.
• Locations: SharePoint sites → Add Finance site URL. Exchange email → All. OneDrive accounts → All.
• Conditions: Content contains sensitive info type → Credit Card Number (the same SIT used in Lab 7-D).
• Save and confirm the policy is in Simulation mode — not enforced. Record the policy status in Lab Journal.

Part C — SharePoint Finance library default label (10 min)

• Navigate to the Finance SharePoint site → Documents library → Library settings → Default sensitivity labels.
• Set the default label for this library to Confidential/Finance. Save.
• Test: upload any new file to the Finance Documents library. After upload, click the file → check the sensitivity label column — it should show Confidential/Finance automatically.
• Lab Journal: what is the difference between this library default and the auto-labelling policy from Part B? When would each one apply a label to the same document?

Part D — Add label condition to existing DLP policy (10 min)

• Navigate to purview.microsoft.com → Data loss prevention → Policies → LL — Financial Data Protection. Click Edit policy.
• Navigate to Advanced DLP rules → Edit the existing rule.
• Under Conditions → + Add condition → Content contains → Sensitivity labels → Confidential/Finance. Set the condition logic to OR — the rule fires if the content matches a Credit Card SIT or has the Confidential/Finance label.
• Save the rule and policy. Record in Lab Journal: why does adding a label condition to DLP create stronger protection than either the label or the DLP SIT condition alone?

Remaining governance gaps — warm-up for Day 5 written synthesis

• Give students 10 minutes to independently list what they think are the three most significant remaining governance gaps in the Lakeview Logistics tenant. Written — not discussed yet.
• Pair-share for 5 minutes. Then brief class discussion — surface the range of gaps students identified. Do not confirm or deny any answers — this primes Part D without giving it away.
• Expect: no label for Teams messages, no MFA for guest users, no CA for unmanaged devices accessing Finance SharePoint, retention not covering Teams private chats, IRM has no HR connector, audit log retention is only 90 days.
• Brief students on Part D marking criteria: specificity is the key criterion. "MFA gap" scores 0. "No CA policy requiring compliant device for guest accounts accessing SharePoint Online, allowing an unmanaged contractor device to download Finance content without Intune telemetry" scores full marks.