Classification & Protection

Apply labels FIRST so that discovery, DSPM, and governance reports are meaningful.

Sensitivity Labels {#sensitivity-labels}

Goal: Create a label taxonomy that classifies data by sensitivity level and applies appropriate protections.

2.1 Design Label Taxonomy

Before creating labels, establish a classification framework approved by leadership.

2.2 Create Sensitivity Labels

Navigate to Microsoft Purview portal → Solutions → Information protection → Labels.

Install-Module ExchangeOnlineManagement -MinimumVersion 3.0.0

# Connect to Security & Compliance PowerShell
Connect-IPPSSession

# Create parent labels (groups)
New-Label -DisplayName "Public" -Name "Public" -Tooltip "No protection required"

New-Label -DisplayName "Internal" -Name "Internal" -Tooltip "General internal use"

New-Label -DisplayName "Confidential" -Name "Confidential" -Tooltip "Sensitive business data"

New-Label -DisplayName "Regulatory" -Name "Regulatory" -Tooltip "Data subject to regulations"

# Create sublabels under Regulatory
New-Label -DisplayName "FERPA" -Name "FERPA" -ParentId "Regulatory" `
    -Tooltip "Student education records"

New-Label -DisplayName "HIPAA" -Name "HIPAA" -ParentId "Regulatory" `
    -Tooltip "Protected health information"

2.3 Configure Label Encryption

For labels that require encryption, configure protection settings in the label definition. Encryption is a native sensitivity label capability in Microsoft Purview Information Protection.

2.4 Apply Visual Markings

Configure headers, footers, and watermarks to indicate classification level.

# Add visual markings to Confidential label
Set-Label -Identity "Confidential" `
    -ApplyContentMarkingHeaderEnabled $true `
    -ApplyContentMarkingHeaderText "CONFIDENTIAL" `
    -ApplyContentMarkingHeaderFontColor "#FF0000" `
    -ApplyContentMarkingHeaderFontSize 12

Set-Label -Identity "Confidential" `
    -ApplyContentMarkingFooterEnabled $true `
    -ApplyContentMarkingFooterText "For internal use only"

2.5 Publish Labels to Users

Create a label policy to make labels available in Office apps.

# Create label policy for all users
New-LabelPolicy -Name "Enterprise Labels" `
    -Labels "Public","Internal","Confidential","FERPA","HIPAA" `
    -ExchangeLocation "All" `
    -SharePointLocation "All" `
    -OneDriveLocation "All" `
    -ModernGroupLocation "All"

# Configure policy settings
Set-LabelPolicy -Identity "Enterprise Labels" `
    -AdvancedSettings @{
        "requiredowngradejustification" = "true"
        "outlookdefaultlabel" = "Internal"
    }

2.6 Validation Checkpoint

Auto-Labeling {#auto-labeling}

Goal: Automatically classify content based on sensitive information types (SITs), reducing reliance on users to label correctly.

2.5.1 Client-Side Auto-Labeling

Configure labels to automatically apply when Office apps detect sensitive content.

# Configure auto-labeling for FERPA label
Set-Label -Identity "FERPA" `
    -AutoApplyType "Recommend" `
    -SensitiveInformationType @(
        @{Name="U.S. Social Security Number (SSN)"; minCount=1},
        @{Name="All Full Names"; minCount=1}
    ) `
    -Locale "en-us" `
    -AutoLabelingMessage "This document may contain FERPA-protected data."

2.5.2 Service-Side Auto-Labeling

For content already in SharePoint, OneDrive, and Exchange, create auto-labeling policies that run server-side.

# Create auto-labeling policy for FERPA content in SharePoint
New-AutoSensitivityLabelPolicy -Name "Auto-Label FERPA" `
    -SharePointLocation "All" `
    -OneDriveLocation "All" `
    -ApplySensitivityLabel "FERPA" `
    -Mode "Simulation" # Start in simulation mode

# Add conditions
New-AutoSensitivityLabelRule -Policy "Auto-Label FERPA" `
    -Name "Student Records Rule" `
    -ContentContainsSensitiveInformation @(
        @{
            Name="U.S. Social Security Number (SSN)"
            MinCount=1
        },
        @{
            Name="All Full Names"
            MinCount=1
        }
    )

2.5.3 Auto-Labeling Workflow

flowchart LR
    A[Create Policy] --> B[Simulation Mode]
    B --> C{Review Matches}
    C -->|False Positives| D[Refine Conditions]
    D --> B
    C -->|Accurate| E[Enable Policy]
    E --> F[Monitor & Tune]

2.5.4 Simulation Best Practices

2.5.5 Validation Checkpoint

Data Lifecycle Management {#data-lifecycle}

Goal: Establish retention and deletion policies to manage the complete data lifecycle.

3.1 Retention Policy Strategy

Design retention policies based on regulatory requirements and business needs.

3.2 Create Retention Policies

Navigate to Microsoft Purview portal → Solutions → Data lifecycle management → Policies → Retention policies.

Install-Module ExchangeOnlineManagement -MinimumVersion 3.0.0

# Connect to Security & Compliance PowerShell
Connect-IPPSSession

# Step 1: Create the policy (defines WHERE)
New-RetentionCompliancePolicy -Name "Email Retention - 3 Years" `
    -ExchangeLocation "All" `
    -Enabled $true

# Step 2: Create the rule (defines HOW LONG and WHAT ACTION)
New-RetentionComplianceRule -Name "Email 3 Year Rule" `
    -Policy "Email Retention - 3 Years" `
    -RetentionDuration 1095 `
    -RetentionDurationDisplayHint Days `
    -RetentionComplianceAction Delete

# Example: SharePoint site-specific retention
New-RetentionCompliancePolicy -Name "Student Records - 7 Years" `
    -SharePointLocation "https://tenant.sharepoint.com/sites/StudentRecords"

New-RetentionComplianceRule -Name "Student Records Rule" `
    -Policy "Student Records - 7 Years" `
    -RetentionDuration 2555 `
    -RetentionDurationDisplayHint Days `
    -RetentionComplianceAction Delete

# Example: Teams retention (channels and chats)
New-RetentionCompliancePolicy -Name "Teams Chat - 1 Year" `
    -TeamsChannelLocation "All" `
    -TeamsChatLocation "All"

New-RetentionComplianceRule -Name "Teams 1 Year Rule" `
    -Policy "Teams Chat - 1 Year" `
    -RetentionDuration 365 `
    -RetentionDurationDisplayHint Days `
    -RetentionComplianceAction Delete

3.3 Retention Labels for Records Management

For content requiring formal records management (declaration, disposition review), use retention labels instead of policies.

3.4 Create Records Labels

# Create retention label for contract records
New-ComplianceTag -Name "Contract - Final" `
    -Comment "Final executed contracts requiring records management" `
    -RetentionAction "Keep" `
    -RetentionDuration 2555 `
    -RetentionType "CreationAgeInDays" `
    -IsRecordLabel $true `
    -Regulatory $false `
    -ReviewerEmail "records@tamu.edu"

# Publish label policy
New-RetentionCompliancePolicy -Name "Records Labels" `
    -RetentionComplianceTag "Contract - Final" `
    -PublishComplianceTag $true `
    -SharePointLocation "All"

3.5 Records Management Setup

For formal records management with disposition reviews:

1. Navigate to Microsoft Purview portal → Records management
2. Create File plan with retention labels
3. Configure Disposition reviewers
4. Set up Event types for event-based retention

3.6 Validation Checkpoint

Classification Completion Checklist

Before moving to Discovery & DSPM, validate:

Next Steps

With labels and lifecycle policies in place, you're ready to discover and measure:

• Discovery & DSPM — Now DSPM can report on labeled vs. unlabeled content, oversharing, and Copilot exposure

Related Resources

• Information Protection — Product overview
• Data Lifecycle Management — Retention product overview
• Records Management — Formal records management