Governance, Permissions, and Compliance

Sensitivity Label in SharePoint: Definition and Protection Guide

A sensitivity label is a Microsoft Purview Information Protection classification that can identify and protect sensitive files, emails, meetings, Microsoft 365 groups, Teams, and SharePoint sites. Depending on scope and configuration, a label can apply encryption, markings, sharing defaults, privacy, guest, or device-access controls. A site label does not automatically label files stored inside it.

Business LeaderIT DirectorSharePoint AdminAlso: Microsoft Purview sensitivity labelAlso: information protection labelAlso: data classification label

Current as of July 13, 2026: Microsoft's April 2026 guidance says label groups are replacing the older parent-label structure. Existing parent labels can be converted, and only the labels within a group are published or applied, not the grouping itself.

What Sensitivity Label Means in SharePoint

For files and emails, a sensitivity label is stored as persistent metadata and can travel with the content. An organization might publish labels such as Public, General, Confidential, and Highly Confidential. A label can be classification only, or it can enforce encryption, usage rights, headers, footers, watermarks, and other protection supported by the content and application.

For containers such as SharePoint sites, Microsoft 365 groups, and Teams, the label has a different scope. It can control settings such as privacy, external users and sharing, access from unmanaged devices, and other collaboration boundaries. The container label protects the location through settings; it does not automatically stamp every document in that location with the same file label.

Why It Matters to the Business

Sensitivity labels translate an organization's classification policy into visible, enforceable controls. Employees can recognize how content should be handled, while encryption and sharing restrictions can continue protecting a labeled file after it leaves SharePoint. Consistent labels also provide reporting and audit signals for security and compliance teams.

The taxonomy must be understandable. Too many labels, vague names, or overlapping rules lead to incorrect classification and workarounds. Business, legal, privacy, and security owners should define examples for each level, while IT tests how labels affect ordinary collaboration with employees, guests, Office apps, mobile devices, search, and automation.

What SharePoint Administrators Need to Know

Create labels with the correct scopes, configure protection, and publish them through label policies to the appropriate users and groups. Microsoft notes that each supported item can have one sensitivity label from the organization, while a document can also have a retention label. Label priority matters for downgrade justification and automatic-label conflict behavior.

Enable and test SharePoint and OneDrive support for labeled files before broad rollout. Built-in labeling can allow Office for the web, search, eDiscovery, DLP, and collaboration to process supported encrypted files, but limitations remain for password-protected files and some file features. Coauthoring for encrypted documents has a separate tenant configuration and should be validated with real templates and external users.

What to Consider

Choose the right scope

Separate file and email protection from group and site controls. A container label does not label its stored files.

Keep labels understandable

Use a small, ordered classification scheme with clear descriptions, examples, ownership, and downgrade rules.

Test collaboration

Validate encryption, coauthoring, search, DLP, external users, mobile access, templates, and automation before broad enforcement.

Practical Takeaway

A sensitivity label is most effective when people understand the classification and the technology enforces proportionate protection. Design file labels and site labels together, but never assume they behave the same way.

How This Shows Up in the Field

Protected document

A Highly Confidential file label encrypts a board document for a defined leadership group and adds a visible footer. The protection remains with the supported file after download.

Restricted site

A Confidential Project site label sets a private group, limits external sharing, and controls unmanaged-device access. Files still receive their own labels through user action, defaults, or auto-labeling policy.

Sensitivity labels, retention labels, and permissions

Sensitivity label	Classifies sensitivity and can apply persistent protection or container collaboration settings.
Retention label	Governs how long an item is retained or when it can be deleted and can mark it as a record.
SharePoint permissions	Control who can access and act on SharePoint objects; they remain essential even when labels are used.

Related 6SC Services and Proof

SharePoint Permissions and SecurityCoordinate labels with permissions, sharing, guest access, and site security. SharePoint GovernanceDefine classification ownership, publishing, review, and lifecycle practices. RAND Corporation case studySee a modern SharePoint environment delivered around demanding security and governance requirements.

Related SharePoint Glossary Terms

Retention LabelA retention label is a Microsoft Purview control applied to an individual document, folder, list item, email, or other supported item to govern retention and deletion. It can retain content, delete it after a period, retain then delete it, trigger disposition review, or mark it as a record. It differs from a container-wide retention policy. Data Loss Prevention (DLP)Data Loss Prevention, or DLP, is a Microsoft Purview policy capability that detects sensitive information and risky handling across SharePoint, OneDrive, Teams, Exchange, endpoints, and other supported locations. In SharePoint, a matching rule can audit activity, notify users, show policy tips, restrict access or sharing, and create incidents without replacing permissions or sensitivity labels. SharePoint PermissionsSharePoint permissions are the access rights that determine what a person or group can view, add, edit, delete, share, approve, or administer across sites and content. Rights are commonly assigned through Microsoft 365 groups or SharePoint groups using permission levels. Effective permission design favors groups, inheritance, least privilege, clear ownership, and regular access review. External SharingExternal sharing in SharePoint is the controlled ability to give people outside an organization's Microsoft 365 tenant access to sites, files, folders, libraries, or list items. It combines SharePoint organization and site settings, sharing-link choices, Microsoft Entra B2B guest authentication, and underlying permissions. The most restrictive applicable organization or site setting governs availability. Permission InheritancePermission inheritance in SharePoint is the default behavior in which a site, list, library, folder, item, or file receives access settings from its parent container. Breaking inheritance creates a unique permission scope with its own access control list. Inheritance simplifies administration; excessive unique scopes increase review effort, performance risk, and the chance of unintended access.

Frequently Asked Questions

Does a sensitivity label on a SharePoint site label every file in the site?

No. A Groups and sites label controls container settings such as privacy, guest access, sharing, and unmanaged-device access. Files require file-scoped labels applied manually, by default, or through supported automatic-labeling methods.

Can a document have both a sensitivity label and a retention label?

Yes. Microsoft states that a document or email can have one sensitivity label and one retention label at the same time. They serve different purposes: protection and classification versus lifecycle and records controls.

Does a sensitivity label always encrypt content?

No. A label can classify content without protection settings, apply only markings, or enforce encryption and usage rights. The organization decides what each label means and what protection it applies.

Can encrypted labeled files still support SharePoint search and coauthoring?

Supported files can participate when the required SharePoint, OneDrive, and coauthoring capabilities are enabled and the encryption configuration is compatible. Microsoft documents limitations, so test actual file types, templates, users, and integrations before rollout.

Official Microsoft References

Editorial review date: July 13, 2026. Product status and licensing can change; confirm current Microsoft documentation before implementation.

Apply classification without breaking collaboration

6SC can help align SharePoint permissions and sharing with a practical sensitivity-label design, then test the user and administrator experience before rollout.

Talk with 6SC