Automating Data Classification: Sensitivity Labels with DLP in Microsoft 365

As data volumes continue to grow, manual classification of sensitive content is no longer sufficient. Microsoft 365 offers auto-labeling capabilities integrated with Data Loss Prevention (DLP) to ensure that sensitive content is automatically detected, classified, and protected based on organizational policies—without user intervention.

This article explores how to configure auto-labeling using sensitivity labels and DLP policies within Microsoft Purview to enhance compliance and reduce human error.

Why Auto-Labeling Matters

Manual application of sensitivity labels depends on user awareness and training, which introduces the risk of misclassification. Auto-labeling enables:

• Proactive protection of sensitive content (e.g., PII, financial records, IP)
• Consistent enforcement of data classification across environments
• Regulatory compliance by meeting standards like GDPR, HIPAA, and CCPA
• Reduced insider risk by preventing unauthorized sharing or access

Technical Overview

Microsoft auto-labeling is powered by Microsoft Purview Information Protection and can be configured via:

• Information Protection – Auto-labeling policies
• Data Loss Prevention policies
• Microsoft 365 Compliance Center

It supports predefined sensitive information types (e.g., credit card number, SSN) and custom patterns, keywords, or trainable classifiers.

Step-by-Step Guide: Implementing Auto-Labeling with DLP

Step 1: Create or Reuse Sensitivity Labels

Ensure you have sensitivity labels created with protection policies. If needed:

• Go to Microsoft Purview compliance portal
• Navigate to Information Protection > Labels
• Create labels with encryption, content marking, or access restrictions
• Publish them via label policies

Step 2: Plan Your Detection Logic

Decide what sensitive data you want to detect automatically. You can choose from:

• Built-in Sensitive Information Types (e.g., U.S. Social Security Number, IBAN)
• Keywords (e.g., “confidential”, “project x”)
• Custom regex patterns
• Trainable Classifiers for context-based detection (e.g., resumes, contracts)

Reference: List of Sensitive Info Types

Step 3: Create Auto-Labeling Policy

1. Go to:
   https://compliance.microsoft.com/informationprotection
   Choose Auto-labeling from the left menu.
2. Click Create auto-labeling policy.
3. Configure the policy:
   • Choose locations: Exchange, SharePoint, OneDrive, Teams
   • Define conditions: Select built-in types, keywords, or trainable classifiers
   • Choose the label to apply: e.g., “Confidential – Finance”
   • Define test mode or simulation (Recommended before enforcement)
4. Review and publish the policy.

Step 4: Monitor the Simulation

After publishing in simulation mode:

• View matched items in the Simulation results
• Confirm whether the rules and labels apply correctly
• Adjust keywords, patterns, or confidence thresholds if needed

Step 5: Enforce the Policy

Once validated:

• Switch the auto-labeling policy to Enforce mode
• The system will apply the sensitivity labels automatically to new and existing content

Best Practices

• Start with Simulation Mode to avoid over-labeling or misclassification
• Use custom info types for proprietary data formats
• Pair with DLP policies to block sharing of mislabeled or unlabeled content
• Combine with retention labels for lifecycle management
• Audit and fine-tune using Microsoft Purview Activity Explorer

Integration with DLP

Auto-labeled content can trigger Microsoft Purview DLP policies, which allow actions like:

• Block copy-paste or print in Windows
• Restrict sharing or external access
• Send incident alerts to compliance teams

This integration enhances the security perimeter by enforcing real-time data protection even after the content leaves the original source.

Summary Table