A sensitivity label is a tag attached to a document, email, meeting invitation or collaboration space that records how confidential its contents are, and that carries rules about what may be done with them. A label named "Confidential" might encrypt a spreadsheet so that only staff can open it, stamp "Internal only" in its footer and stop an AI assistant from summarising it. The term is Microsoft's, used across its Purview compliance suite, though Google and Adobe now honour or imitate such labels. It exists because files leave their folders. Permissions set on a SharePoint site vanish once a document is downloaded or attached to an email; a label travels inside the file.

How a label works

A label is defined once, centrally, by a compliance administrator in the Microsoft Purview portal, then published to users through a label policy. Most organisations build a short ladder, for example Public, General, Confidential and Highly Confidential, sometimes split into sublabels such as "Confidential \ All Employees". Microsoft advises keeping to five main labels and five sublabels per label. The technical ceiling is far higher: more than 1,000 labels per tenant, or 500 if a label applies encryption to specified users, according to Microsoft's documentation as updated on October 29, 2026.

Each label can carry three kinds of action. Encryption uses Microsoft's rights management service to scramble the content and attach usage rights, such as view, edit, print or extract, for named users or groups. Content markings add a header, footer or watermark; watermarks are capped at 255 characters and headers and footers at 1,024. Container settings apply to a Microsoft Teams team, Microsoft 365 group or SharePoint site rather than to a file, controlling whether it is public or private, whether guests can be added, how widely files can be shared externally and whether unmanaged devices can connect.

Only one sensitivity label can sit on an item at a time. Labels have a priority order, with the most restrictive at the bottom of the list. Downgrading or removing a label can require a written justification, and when automatic rules or combined sources disagree, the higher-priority label wins.

Under the hood, the label is not the file's encryption key but a set of clear-text metadata keys. According to the Microsoft Information Protection (MIP) software development kit documentation, each label is written as a key of the form MSIP_Label_{GUID}_Enabled=True, where the GUID is the label's identifier in the organisation, accompanied by SiteId (the tenant), SetDate, Name and Method. Method is "Standard" when a label was applied by default or automatically and "Privileged" when a person chose it, a distinction that later decides whether automation may overwrite it. A ContentBits bitmask records the markings, with 0x8 meaning encryption. Because the tag is readable without decrypting the file, data loss prevention (DLP) gateways and third-party tools can act on it.

Who applies labels, and how

There are three routes. Manual labelling asks the author to pick from a Sensitivity button in Word, Excel, PowerPoint or Outlook; administrators can set a default and make labelling mandatory, blocking save or send until a label is chosen.

Client-side automatic labelling runs inside Office apps as a person types, applying or recommending a label when it detects, say, credit card numbers. Service-side automatic labelling runs in the cloud over content at rest in SharePoint and OneDrive or in transit through Exchange Online. It does not support recommendations, only enforcement, and it can be run first in simulation mode to see what would be labelled. According to Microsoft's documentation as of November 2026, a tenant may run up to 100 such policies, each covering up to 1,000 SharePoint sites, with simulations covering up to 20 million matched files and an absolute ceiling of 500,000 automatically labelled files per tenant per day, which Microsoft says is not a guaranteed rate. Automatic labelling requires E5-tier licences; Microsoft 365 E3 and Business Premium include manual labelling only.

Detection leans on sensitive information types, Microsoft's library of identifier patterns, and on trainable classifiers. Compliance teams own the taxonomy; every employee who writes a document becomes, in effect, a labeller.

From rights management to unified labels

Labels grew out of rights management, which Microsoft shipped in Windows Server 2003, and out of an acquisition. On November 9, 2015, Microsoft agreed to buy Secure Islands, an Israeli company whose software classified and protected files, with customers including UBS, Vodafone and Credit Suisse. Terms were not disclosed, according to PCWorld, and the deal closed on December 11, 2015.

Microsoft announced Azure Information Protection (AIP) on June 22, 2016, and declared it generally available on October 4, 2016. The preview had more than 500 active tenants, according to an announcement signed by Dan Plastina. AIP labels already combined "content detection, protection, and visual marking rules", with classification that could be automatic, user-driven or recommended. The catch was a separate Office add-in and label store.

The next phase was consolidation. Microsoft began unifying AIP labels with Office 365 "sensitivity labels" in 2018, and the AIP unified labelling client reached general availability on April 16, 2019. The classic AIP client reached end of support on March 31, 2021, according to Microsoft's lifecycle page. A storage change followed: MIP SDK version 1.7, described by Microsoft in November 2020, moved label metadata in Word, Excel and PowerPoint files into a new location to support co-authoring of encrypted files. In April 2022 Microsoft folded its compliance tools, information protection included, under the Purview brand. Adobe added Purview labelling to Acrobat in a public preview in June 2022, extending labels to PDFs. The AIP add-in for Office was retired on April 11, 2024, leaving labelling built into Microsoft 365 apps.

Google took a parallel route: Drive labels with automatic classification became generally available on January 28, 2022, and Gmail classification labels on April 23, 2025, according to the Google Workspace Updates blog.

Why marketers keep running into labels

For agencies and marketing departments the label has moved from a back-office setting to a gate on daily work. Media plans, client contracts and customer lists for audience matching often live in Microsoft 365, and labels decide whether they can be shared with a freelancer, opened on a personal laptop or fed to an AI assistant.

The AI question is the sharpest. According to Microsoft's Copilot documentation, Microsoft 365 Copilot will only summarise encrypted content if the user holds both the VIEW and EXTRACT usage rights, and new content generated from labelled items inherits the highest-priority label among them. Without labels, Copilot sees whatever the user can see. A survey of 193 managed service providers by Augmentt in August 2026 found that 47% had dealt with an AI or Copilot data exposure or near miss, with 20% citing missing DLP or sensitivity labelling, and only 3% judging every client tenant ready for Copilot. The Dutch education body SURF's privacy review likewise turned on Copilot's access to internal documents in SharePoint, OneDrive and Exchange Online.

Labels reach only sanctioned tools, and LayerX telemetry published in May 2026 showed that 47.11% of enterprise AI conversations ran on personal accounts, where a Purview label has no say over what is pasted.

Limitations and disputes

The first weakness is human. A label is only as accurate as the person or rule that applied it, and mandatory labelling tends to produce a sea of "General" as staff pick the least obstructive option.

The second is enforcement. Labels are honoured by applications that choose to read them. Microsoft's Copilot documentation lists gaps, including that Copilot does not currently recognise labels on Teams meetings and chats.

The third is trust in the vendor's own plumbing. In February 2026 Microsoft confirmed a code issue, tracked as CW1226324 and first detected on January 21, that let Copilot Chat summarise emails in users' Sent Items and Drafts folders "even though confidential labels are set in place", according to BleepingComputer. Microsoft did not say how many customers were affected. VentureBeat reported that the UK's National Health Service was among them. VentureBeat's headline put the criticism bluntly: Copilot had ignored sensitivity labels twice in eight months, and no DLP stack caught either failure.

Cost is another complaint: the automatic labelling needed to cover legacy archives sits behind the more expensive E5 tier.

Sensitivity label versus adjacent terms

Retention labels, also in Purview, govern how long content is kept or when it is deleted. They say nothing about who may read a file. An item can carry one of each.

Sensitive information types are detection patterns, such as a regular expression for a social security number. They are what automatic labelling looks for, not the label itself.

Government classification markings, such as the UK's OFFICIAL, SECRET and TOP SECRET scheme introduced on April 2, 2014, are policy categories. Labels are often configured to implement them; the marking is the policy, the label the mechanism.

In advertising, Google's sensitive categories are a different thing altogether: content and audience classes, such as health or religion, that advertisers can exclude or that ad policies restrict. They classify ads and pages, not internal documents.

Recent developments

Labels are spreading to new containers and to larger automated runs. Microsoft's message center notice MC1508238, published on October 14, 2026, said labels for Microsoft Entra security groups would roll out from mid-November and complete in late November 2026; once applied, such a label cannot currently be changed or removed. The daily auto-labelling ceiling rose from 100,000 to 500,000 files per tenant, rolling out tenant by tenant, according to Purview consultant Albert Hoitingh. The roadmap also lists automatic labelling for legacy .doc, .xls and .ppt files, though entries conflict, one giving November 2026 and another December 2026 for general availability.

The fragility of the whole stack was visible today, when a Microsoft 365 email outage hit 19 services, with Microsoft listing Purview's Information Protection label and auto-labelling policies among those affected.

Timeline

  • 2003: Microsoft ships rights management services with Windows Server 2003, the encryption layer later used by labels.
  • November 9, 2015: Microsoft announces the acquisition of Secure Islands; it closes December 11, 2015.
  • June 22, 2016: Azure Information Protection announced.
  • October 4, 2016: Azure Information Protection generally available, with classification labels and visual markings.
  • 2018: Microsoft begins unifying AIP labels with Office 365 sensitivity labels.
  • April 16, 2019: AIP unified labelling client generally available.
  • November 2020: MIP SDK 1.7 changes label metadata storage in Office files.
  • March 31, 2021: End of support for the AIP classic client.
  • January 28, 2022: Google Drive labels with automated classification generally available.
  • April 2022: Microsoft rebrands its compliance portfolio, including information protection, as Microsoft Purview.
  • June 2022: Purview labelling for PDFs in Adobe Acrobat enters public preview.
  • April 11, 2024: AIP add-in for Office retired.
  • April 23, 2025: Gmail data classification labels generally available.
  • January 21 to February 2026: Copilot Chat bug CW1226324 lets confidential-labelled emails be summarised.
  • October 14, 2026: Microsoft announces labels for Entra security groups, rolling out mid to late November 2026.
  • November 2026: Microsoft documentation lists a 500,000-file daily auto-labelling ceiling per tenant.

Summary

Who: Microsoft defines and operates sensitivity labels in Purview; compliance teams design the taxonomy; employees and automated policies apply labels; Adobe, Google and security vendors read or mirror them.

What: A sensitivity label is a metadata tag on a file, email, meeting or site that classifies its confidentiality and can enforce encryption, markings, sharing limits and restrictions on AI tools such as Copilot.

When: The concept arrived with Azure Information Protection in 2016, was unified with Office 365 labels from 2018 to 2019, moved under the Purview brand in April 2022 and has been extended through 2026 to AI assistants and security groups.

Where: In Microsoft 365 apps, SharePoint, OneDrive, Exchange Online, Teams, Power BI and labelled PDFs, and by extension wherever a labelled file travels.

Why: Folder permissions do not follow a file once it leaves; a label does, giving organisations a persistent way to protect client and customer data, a need sharpened by AI assistants that can read everything a user can.