Topic 3 of 6
Sensitivity labels and DLP
Once sensitive data is recognized, it has to be protected. Sensitivity labels mark and protect content wherever it goes; DLP stops it from leaving where it shouldn't. They're complementary tools, and the exam asks you to tell what each one does.
Contents
Sensitivity labels
A label is like a stamp attached to content that travels with it, even when it leaves the organization. It classifies and, if configured, protects.
Customizable
Each organization creates its own labels and levels: Personal, Public, General, Confidential, Highly Confidential…
Clear text
The label is stored in unencrypted metadata, so other apps and services can read it and act on it.
Persistent
The label and its protection go with the file to any location: email, USB, another cloud.
One per item
Each document or email supports only one sensitivity label (though it can also have a retention label).
Label scopes: files and other data assets (by default), emails, meetings, and groups and sites.
What a label can do
Encrypt
Emails, meeting invites, and documents, defining which users or groups can do what (view, edit, print) and for how long.
Mark content
Headers and footers on emails, meeting invites, and documents. Watermarks on documents and Loop, but not on emails or meeting invites.
Automatic or recommended labeling
Based on the sensitive information types or classifiers detected.
Protect containers
Teams, Microsoft 365 Groups, SharePoint sites, Viva Engage communities, and Loop workspaces: privacy, guest access, and unmanaged device access. It doesn't label the documents inside.
Extend to third-party apps
With the Microsoft Information Protection SDK.
Default sharing link
Sets the link type for SharePoint sites and documents to avoid oversharing.
Classify only
A label with no protection, useful to know what exists and for reporting.
Labels and Copilot
Microsoft 365 Copilot honors labels: it checks the user's permissions before using encrypted content, and whatever it generates from several files inherits the most restrictive label among the sources.
How labels are applied
| Method | Who decides | Example |
|---|---|---|
| Manual | The user picks the label | Marks a report as Confidential |
| Default | The policy, as a starting point | Every new document starts as General |
| Recommended | The system suggests; the user accepts or not | "This document contains card data, apply Confidential?" |
| Automatic | The system applies the label on its own | On detecting passport numbers, applies Highly Confidential |
Auto-labeling can work while the user is in Office apps or as a service-side policy on content already stored in SharePoint, OneDrive, and Exchange.
Label policies
Creating a label isn't enough: you have to publish it to users or groups with a policy. The policy decides:
- Who sees the labels in their apps
- A default label for new emails and documents (the user can change it)
- Require justification to remove a label or downgrade it to a less restrictive one
- Mandatory labeling before saving, sending, or creating sites or groups
- A link to a custom help page explaining the labels
Data loss prevention (DLP)
Data loss isn't always an attack: often it's an employee sending a file to the wrong recipient or uploading customer data to a personal service. DLP policies identify, monitor, and protect sensitive items at rest, in transit, and in use, with deep content analysis rather than a simple text search.
Locations
Teams, Exchange, SharePoint, OneDrive · Office apps · Windows 10/11 and macOS endpoints · third-party cloud apps · on-premises file shares and SharePoint · Fabric and Power BI · Microsoft Edge for Business
Anatomy of a DLP policy
What to monitor: A template (for example, U.S. financial data or GDPR) or a custom policy.
Administrative scope: The whole organization or specific administrative units.
Locations: Where it applies: email, sites, endpoints, third-party apps…
Conditions: What the content must match: contains a SIT, a label, is shared outside the organization…
Actions: What happens on a match.
Protective actions, from softest to hardest
- Policy tip: a warning to the user in Outlook or another app
- Block with the option to override by giving a justification
- Block without override
- For data at rest: block access or move the file to quarantine
- In Teams: don't show the message with sensitive information to recipients
Before turning it on, a policy can run in simulation mode to see how many items it would have affected without bothering anyone.
Endpoint DLP and alerts
Endpoint DLP extends protection to Windows 10/11 and macOS devices. It monitors and can block actions on sensitive files:
Copy to USB
Copy to a network share
Upload to the cloud or paste into the browser
- Activities are logged in the audit log and in Activity explorer.
- Alerts show up in the Purview DLP alerts dashboard and in the Defender portal as incidents.
- Security Copilot summarizes alerts, and the DLP Alert Triage Agent prioritizes them by content risk, exfiltration risk, and policy risk.
Protection in AI interactions
Users paste data into AI assistants. Purview applies the same controls: SITs detect sensitive data in Microsoft 365 Copilot prompts and responses, and endpoint DLP can warn or block when someone tries to paste, for example, card numbers into third-party generative AI sites. The activity shows up in Activity explorer and in DSPM (data security posture management).
Labels vs. DLP
| Sensitivity label | DLP policy | |
|---|---|---|
| What it does | Classifies and protects content (encryption, markings) | Controls what users do with content |
| Where it lives | In the file itself, traveling with it | In the locations where the policy applies |
| Example | Only HR can open this file | This file can't be sent outside the company |
They combine: a DLP policy can use a label as a condition ("block external sharing of everything labeled Confidential").
Exam scenarios
| Situation | Answer | Why |
|---|---|---|
| Keep a document encrypted even when it's sent outside the company | Sensitivity label with encryption | Protection travels with the file. |
| Make every new document start as "General" | Default label in the policy | The user can change it. |
| Force users to label before saving | Mandatory labeling | A label policy setting. |
| Control who can access a private Teams team | Label scoped to groups and sites | It protects the container, not the files. |
| Warn the user before sending card numbers by email | DLP policy with a policy tip | It educates without blocking. |
| Stop copying confidential files to USB | Endpoint DLP | It controls actions on Windows and macOS. |
| Test a DLP policy without affecting users | Simulation mode | It shows what would have happened. |
| Stop pasting sensitive data into a third-party AI chatbot | Endpoint DLP (Edge, browsers) | It warns or blocks the action. |
Common exam traps
❓ Can you apply a watermark to an email with a label?
No. Watermarks go on documents and Loop. Emails use headers and footers.
❓ Does a label applied to a SharePoint site label all its documents?
No. It protects the container (access, privacy, guests); the documents aren't labeled because of it.
❓ Can a document have two sensitivity labels?
No. Just one. It can also have a retention label, though.
❓ Is the label lost if the file leaves Microsoft 365?
No. It's persistent: it lives in the metadata, and its encryption travels with the file.
❓ A label is created but users don't see it. What's missing?
Publishing it with a label policy.
❓ Does DLP only protect email?
No. It also covers Teams, SharePoint, OneDrive, endpoints, third-party apps, on-premises repositories, Power BI, and Edge.
❓ Does a policy tip block sending?
No. It only warns the user. Blocking is a separate action.
Did you get this topic?
Test what you just learned
A company wants to warn users when they try to send card numbers by email, but let them continue if they give a justification. What does it configure?
Ready to test "Sensitivity labels and DLP"?
Original questions, each with a full explanation.
Start a mock exam