Sensitivity label

What is a sensitivity label?

A sensitivity label is a metadata tag that records how sensitive a file or dataset is and, where you want it to, enforces protection to match. A document tagged "Highly Confidential" can be automatically encrypted, restricted to people inside your organisation, and stamped with a watermark, all from that single tag. The label sits with the content as metadata, so the classification and its protection travel together.

The part that makes labels useful is that the protection stays with the file. If someone tags a spreadsheet confidential and then emails it outside the company, the encryption and access rules go with it. A person who is not on the allowed list cannot open the file, even though it has left every system you control. The label is the record of the decision and the mechanism that carries it around.

In the Microsoft ecosystem these are Microsoft Purview Information Protection labels, and the same set of labels is used across Word, Excel, Outlook, Power BI, Fabric, and even database columns, so one taxonomy covers the whole estate.

How a sensitivity label relates to classification

Data classification is the judgement about how sensitive something is. A sensitivity label is how that judgement is recorded and enforced. You decide a customer's health record is confidential, that is classification; you apply the Confidential label that encrypts it and limits who can open it, that is the label doing the work.

A label does not have to enforce anything. You can apply one purely to mark the sensitivity of data and give people a visual cue, without any encryption or access rules attached. When a label does carry file protection, it is sometimes called a protected label, and its protection policy spells out who can open, edit, or copy the content.

What a label can do to a file

• Encrypt the content. The file is scrambled so that only people with rights under the label's policy can decrypt and read it.

• Restrict access. The policy grants different people different rights, so one group gets full control while another can only view.

• Add visual markings. Headers, footers, and watermarks make the sensitivity obvious to anyone looking at the document.

• Mark without protecting. Apply the label as a classification signal only, and add protection later if the risk changes.

Labels are also a natural place to catch PII. A scan that finds passport numbers or bank details can apply a Confidential label automatically, so the sensitive data is protected the moment it is spotted rather than whenever someone remembers to lock it down.

Sensitivity labels in Power BI and Fabric

Labels flow into Power BI and Microsoft Fabric, where they can be applied to semantic models, reports, dashboards, dataflows, and .pbix files. The interesting behaviour is inheritance in both directions. A label defined on columns in an upstream Azure SQL database can flow into a Power BI semantic model that imports from it, and a label on a semantic model can flow down to every report built on top.

Protection follows the data out of the service too. When labelled content is exported to Excel, PDF, PowerPoint, or a .pbix file, Power BI applies the label to the export and encrypts it according to the label's settings, so a confidential report does not become an unprotected spreadsheet the moment someone exports it.

Sensitivity labels versus row level security

Both control who sees what, but at different layers, and they are easy to confuse.

Row Level Security filters rows inside a report or semantic model. A regional manager opens the same report as everyone else but sees only their own region's rows. The file is not protected; the data shown inside it is filtered per user.

A sensitivity label protects the item or file as a whole. It decides whether you can open the report or the exported spreadsheet at all, and it keeps that protection when the file travels. Many setups use both: row level security narrows what each person sees inside the report, while a label stops the underlying file from being opened or exported by the wrong people.

What to watch out for with sensitivity labels

Labels need licences and setup first. Using them requires the right Microsoft Purview Information Protection licensing, and applying them in Power BI needs a Pro or Premium Per-User licence. The labels and their protection policies also have to be defined and published before anyone can use them.

Protection has limits outside supported paths. Access control travels with data through supported export paths like Excel and PDF, but not everywhere. Exports to plain formats such as .csv or .txt, and some cross-tenant sharing scenarios, do not carry the enforced protection, so do not assume the label guards every possible route out.

A label is only as good as the taxonomy behind it. If people cannot tell Confidential from Restricted, they mislabel, and the protection lands on the wrong things. Keep the label set small and the guidance concrete.