4.2MS-102Advanced
Est: ~15 mins•Verified: 2026-08
Purview Sensitivity Labels & Rights Encryption
Implement information protection sensitivity labels, Azure Rights Management (RMS) encryption, container protection for Teams/M365 Groups, and auto-labeling.
Tags:#Purview#Sensitivity Labels#Encryption#RMS#Information Protection#MS-102
01
Overview
Microsoft Purview Information Protection (Sensitivity Labels) classifies and protects corporate data across emails, documents (Word, Excel, PowerPoint), meetings, and container workspaces (Teams, SharePoint sites, Microsoft 365 Groups).
When a sensitivity label is applied:
- Metadata Tagging: Embeds clear-text metadata into document headers/footers/watermarks that persists even if the file leaves the organization.
- Rights Management Encryption (RMS): Encrypts the file using AES-256 with granular access control (View, Edit, Copy, Print). Even if a file is stolen via USB or leaked on the internet, unauthorized recipients cannot open it.
- Container Protection: Enforces privacy (Public vs Private), external guest sharing restrictions, and unmanaged device access rules on Teams and SharePoint sites.
- Service-Side Auto-Labeling: Automatically evaluates files at rest in SharePoint and OneDrive and applies labels when sensitive data is detected.
---
02
When to Use
| Sensitivity Label | Intended Content | Security Configuration |
|---|---|---|
| Public / Non-Business | Public marketing copy, press releases | No encryption; no visual markings. |
| General / Internal | Routine business communications | Watermarked; internal employees only. |
| Confidential | Financial statements, customer records | Encrypted (All corporate employees allowed View + Edit; external blocked). |
| Highly Confidential | M&A documents, trade secrets, source code | Encrypted with scoped permissions (Specific security groups only; print/copy disabled). |
---
03
Prerequisites
Licensing:
- Microsoft 365 E5 or E5 Information Protection for Service-Side Auto-Labeling.
- Microsoft 365 E3 for manual user labeling and basic encryption.
---
04
Portal Path
TEXT
Microsoft Purview Portal (https://purview.microsoft.com)
└── Information protection
├── Sensitivity labels (Create label, define encryption & markings)
├── Label policies (Publish labels to user security groups)
└── Auto-labeling (Create server-side simulation & automated labeling rules)---
05
Step-by-Step Implementation
Step 1: Create a Sensitivity Label with Encryption
- In Purview Portal (
purview.microsoft.com) > Information protection > Sensitivity labels > Click Create a label. - Name:
Confidential - Internal Only| Display name:Confidential \ Internal Only. - Define the scope for this label:
- Check
Items (files, emails, meetings). - Check
Groups & sites(Containers).
- Under Items:
- Choose protection settings: Check Apply or remove encryption and Apply visual markings.
- Under Encryption settings:
- Assign permissions now or let users assign:
Assign permissions now. - User access to content expires:
Never. - Allow offline access:
30 days. - Click Assign permissions > Add All users and groups in your organization with role Co-Author (View, Edit, Save).
- Under Visual markings:
- Add watermark:
CONFIDENTIAL - CONTOSO(Diagonal, Gray, 50% transparency).
Step 2: Publish Label via Label Policy
- Select Label policies > Click Publish label.
- Select the
Confidential - Internal Onlylabel. - Target: Select group
All Employees. - Policy settings:
- Apply a default label to documents:
General. - Require users to apply a label to their emails and documents:
Yes(Mandatory labeling). - Provide a justification before removing or changing to lower classification:
Yes.
- Name policy:
Global-Label-Publishing-Policy> Submit.
---
06
PowerShell Automation
Connect to Security & Compliance PowerShell:
PowerShell
Connect-IPPSSession -UserPrincipalName admin@contoso.com
# List all sensitivity labels published in tenant
Get-Label | Select-Object Name, DisplayName, Priority, ContentType
# Inspect label encryption settings
Get-LabelPolicy | Select-Object Name, DistributionList, Settings---
07
Microsoft Graph Automation
Query Information Protection Label Definitions via Graph:
PowerShell
Connect-MgGraph -Scopes "InformationProtectionPolicy.Read"
# Query tenant published labels
Get-MgInformationProtectionLabel -All |
Select-Object id, name, description, isActive---
08
Verification Checklist
VERIFICATION CHECKLIST
0/4 (0%)
Users in Word desktop and Word Online see the Sensitivity dropdown with published labels.
Saving a file labeled Confidential embeds the diagonal watermark.
Sending the encrypted document to an external personal email address prevents opening without corporate authentication.
Container label applied to a Microsoft Team automatically sets privacy to Private and blocks external guest addition.
09
Diagnostic Logs & Channels
| Resource | Location | Purpose |
|---|---|---|
| Purview Content Explorer | Data classification > Content explorer | Audits how many files across SharePoint and OneDrive currently carry specific sensitivity labels. |
| Unified Audit Log (UAL) | Purview > Audit | Records label changes, label upgrades, downgrades, and user justifications. |
---
10
Troubleshooting Matrix
| Error Code / Symptom | Root Cause | Exact Resolution |
|---|---|---|
| New labels not visible in Office apps | Label publishing policy takes up to 24 hours to replicate to Office desktop apps. | Users can sign out and sign back in to Office, or use Office on the Web for instant testing. |
| Users cannot co-author encrypted files | "Co-authoring for files with sensitivity labels" feature is disabled in tenant. | Enable Co-authoring in Purview settings > Information protection > Co-authoring toggle. |
---
11
Production Best Practices
Production Best Practice
Enable Co-Authoring for Encrypted Files:
By default, legacy RMS encryption locks an opened document to a single user. Always enable Co-authoring for files encrypted with sensitivity labels in Microsoft Purview settings so multiple users can edit encrypted Word/Excel files simultaneously in real-time.
---
12
MS-102 Exam Notes
Exam Blueprint & High-Yield Traps
High-Frequency Exam Objectives & Traps:
- Priority Numbering: Label with the highest priority number represents the highest classification sensitivity.
- Downgrade Justification: When moving from a higher priority label to a lower priority label, users can be required to provide an explanation.
- Container vs Item: A container label applied to a SharePoint site does not automatically encrypt existing files inside the site; it manages site-level settings (external sharing, guest access).
---
13