Capabilities of Microsoft Compliance Solutions · Topic 3 of 5
Data Classification, Labels and DLP
SC-900 Purview information protection: sensitive information types, classifiers, Content and Activity explorer, sensitivity labels and data loss prevention.
- 5 min
- Sensitive information types, trainable classifiers and exact data match classify content.
- Content explorer shows items and where they are. Activity explorer shows actions taken over time.
- Sensitivity labels classify and can encrypt, mark and restrict content.
What it is
To protect sensitive data you must first know where it is. Microsoft Purview does this in three stages. It classifies data, so it knows what is sensitive. It applies sensitivity labels, which attach protection to the content. It uses data loss prevention (DLP) to stop sensitive data leaving the organisation.
How it works
Data classification
Purview can recognise sensitive content by what it contains.
| Method | How it classifies |
|---|---|
| Sensitive information types | Patterns such as credit card numbers, passport numbers or bank accounts, with built in and custom types |
| Trainable classifiers | Machine learning models that recognise a kind of document, such as a contract or a résumé, from examples |
| Exact data match | Matches content against a table of your own sensitive values, such as customer records |
Two views help you see the results.
- Content explorer shows the items found, in each location such as SharePoint, OneDrive and Exchange, together with the labels they carry. It answers "what items do I have, and where?"
- Activity explorer shows the actions taken on labelled content over time, such as labels applied, changed or removed, and files copied or shared. It answers "what has happened to my sensitive data?"
Sensitivity labels
A sensitivity label classifies a document or email and can apply protection that travels with it.
- Encryption limits who can open the content and what they can do with it, such as view but not print.
- Content marking adds a visible header, footer or watermark such as "Confidential".
- Access restrictions apply to files, emails, meetings and also to containers such as Teams and SharePoint sites.
Labels are ranked from less to more sensitive, for example Public, General, Confidential and Highly Confidential. Administrators publish them with sensitivity label policies, which decide who sees which labels, and whether a label is required. Labels can be applied by users or automatically, when the content matches a sensitive information type.
Data loss prevention (DLP)
DLP policies detect and stop risky sharing of sensitive information. A policy defines what is sensitive, where to look, and what to do when a match is found.
- Where: Exchange email, SharePoint, OneDrive, Teams chats, and endpoint devices.
- What: content that matches sensitive information types or carries a certain label.
- Action: show a policy tip to the user, block the sharing, or send an alert to an administrator, with an override if allowed.
Labels compared with DLP
| Sensitivity labels | DLP | |
|---|---|---|
| Main job | Classify content and apply protection such as encryption | Detect and block sensitive data being shared |
| Works by | Marking the item, so protection follows it | Policies that watch actions such as sending and sharing |
| Example | Encrypt a file marked Highly Confidential | Block an email that contains credit card numbers |
A worked scenario
A bank wants to stop customers' card numbers being emailed outside the company. A sensitive information type recognises card numbers. A DLP policy covers Exchange and Teams, warns the sender with a policy tip and blocks external sharing. At the same time, the bank labels its financial reports as Confidential, which encrypts them and adds a watermark. Later, the security team uses Activity explorer to see how often labelled files were copied to removable drives, and Content explorer to see where the Confidential items are stored.
A typical label set
| Label | Typical protection |
|---|---|
| Public | No restrictions |
| General | A header marking the content as internal |
| Confidential | Encryption so that only employees can open it, and a watermark |
| Highly Confidential | Encryption limited to named people, no printing or forwarding |
A label can also apply to a container such as a Teams site or a SharePoint site, controlling external sharing and access from unmanaged devices.
Automatic labelling
Labelling does not need to depend on users remembering. An auto labelling policy looks for sensitive information types, such as national identity numbers, and applies the right label to matching documents and emails. A user can also be asked to label a file when they save it, by making labelling mandatory.
DLP policy outcomes
| Match | Possible outcome |
|---|---|
| A few card numbers in an internal email | Policy tip that warns the sender |
| Many card numbers in an email to an outside address | Block the email and alert the compliance team |
| A confidential file copied to a USB drive | Block or audit on the endpoint |
| A sensitive file shared in Teams with a guest | Block the sharing, with a justified override if allowed |
Why both are needed
Labels protect the content itself, wherever it travels. DLP watches actions such as sending, sharing and copying, and steps in at the moment of risk. The strongest design uses labels to mark what is sensitive, and DLP policies that act on those labels.
What to remember for the exam
- Sensitive information types, trainable classifiers and exact data match classify content.
- Content explorer shows items and where they are. Activity explorer shows actions taken over time.
- Sensitivity labels classify and can encrypt, mark and restrict content.
- DLP detects and blocks sensitive data being shared.
- Label policies publish labels to users.
Content explorer and Activity explorer are easy to swap. Content is "what and where". Activity is "what happened".
How the exam asks about this
- "Classify a document and apply encryption." A sensitivity label.
- "Prevent credit card numbers being sent outside the company." Data loss prevention.
- "See the actions taken on labelled content over time." Activity explorer.
- "See the items in each location with their labels." Content explorer.
Common mistakes
Using a label when the need is to block sharing. DLP blocks sharing. Labels classify and protect.
Thinking DLP covers only email. It also covers SharePoint, OneDrive, Teams and devices.
Confusing sensitivity labels with retention labels. Sensitivity labels protect. Retention labels keep or delete.
Believing labels are always applied by users. They can be applied automatically.
Check yourself
What does a sensitivity label do?
It classifies content and can apply protection such as encryption and marking.
Which tool shows actions taken on labelled content over time?
Activity explorer.
What does a DLP policy do?
It detects sensitive information and blocks, warns about or reports its sharing.
Topic 3 of 5 in Capabilities of Microsoft Compliance Solutions
Test yourself on Capabilities of Microsoft Compliance Solutions
The full Microsoft SC-900 question bank has 503 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.