Microsoft 365 Sensitivity Labels: A Small Business Setup

Sensitivity labels are the data protection most Business Premium customers already pay for and never turn on. You can label and encrypt files and email today with no new license.

What you don't get is automatic labeling. That part costs extra, and most firms under 50 people can live without it for the first year.

What is a sensitivity label?

A sensitivity label is a tag you put on a file, email, or meeting that says how sensitive it is and enforces rules to match. A label can add a footer or watermark, encrypt the content, and control who can open, copy, or forward it.

The protection travels with the file. Download it, email it, drop it on a USB stick, and the rules still apply.

That's the difference from folder permissions. Permissions protect the location. Labels protect the thing itself.

Do you need E5 to use sensitivity labels?

No. Business Premium covers manual labeling.

A Microsoft Q&A answer on Business Premium licensing puts it plainly: "Business Premium supports manual sensitivity labeling and basic DLP." The same answer adds that auto-labeling "requires an E5 license or an E5 add-on."

For a Business Premium tenant, that means buying an add-on. Microsoft's compliance add-on for Business Premium, the Purview Suite, is listed at USD $10 per user per month, paid yearly, or $15 bundled with the Defender Suite. On a 25-person firm, that's $3,000 a year before anyone has labeled a single file.

Start manual. Buy automation once you know what you'd automate.

What labels does Microsoft give you out of the box?

Microsoft ships a default set of labels for eligible tenants: Personal, Public, General, Confidential, and Highly Confidential. The last three have sublabels. Two matter most:

• Confidential \ All Employees encrypts the item so anyone in your organization can co-author it and nobody outside can open it.
• Highly Confidential \ Specific People lets the sender choose exactly who can open it. In Outlook it applies Do Not Forward.

The default policy also sets General \ All Employees (unrestricted) as the default label on new documents, email, and meetings, and it asks users for a justification when they remove a label or lower one. That's a sensible starting point. Don't redesign it on day one.

How many labels should a small business have?

Four or five, and staff should be able to say what each one means without looking it up. Every label you add is a decision you're asking a busy person to make in the two seconds before they hit Send. Fifteen labels means people pick at random or stop picking.

A layout that works for most 10-to-75-person firms:

1. Public. Marketing material, published pricing, anything already on your website.
2. General. Normal internal work. The default. No encryption.
3. Confidential. Client files, financials, HR records. Encrypted to staff only.
4. Highly Confidential. M&A, payroll exports, anything regulated. Encrypted to named people.

If you're an RIA, a medical practice, or a law firm, map these to the categories your regulator already uses. Don't invent a fifth scheme alongside your data retention policy.

How do you roll labels out without breaking work?

Pilot with three people, fix what breaks, then turn it on for everyone. The order matters.

1. Enable labels for SharePoint and OneDrive. Microsoft calls this a one-time manual step and a prerequisite for labels in Office for the web. Skip it and web users won't see labels at all.
2. Publish to a pilot group first. Pick one person from operations, one from finance, and whoever emails clients the most.
3. Test encrypted email with your real outside contacts. Send a Confidential file to a client on Gmail and one on Microsoft 365. Make sure they can open it. Encryption that stops your own clients from reading your mail is a help desk ticket, not security.
4. Check your line-of-business apps. Scanners, e-signature tools, and older document management systems often can't read encrypted files. Find out in the pilot, not on a Monday.
5. Train for ten minutes, not an hour. Show the label bar in Outlook and Word. Explain the four labels. Done.

If you later add auto-labeling, expect a wait. Per Microsoft's documentation, the default auto-labeling policy for SharePoint and OneDrive "waits 25 days before it automatically starts simulation." Plan the timeline around that.

How do sensitivity labels affect Microsoft 365 Copilot?

Copilot obeys them, which is why labels belong on your list before a Copilot rollout. Microsoft's Copilot guidance for Purview says that when a user has view rights to encrypted content but not the Copy right (EXTRACT), "Copilot won't summarize this content but can reference it with a link."

Labels also carry forward. When Copilot builds a new document from labeled sources, the new content can inherit the label. A summary of a Highly Confidential memo stays Highly Confidential.

Labels don't fix bad permissions, though. If every employee can open the payroll folder, Copilot can surface it to every employee.

Clean up access first. Our guide to fixing SharePoint oversharing before Copilot covers that step.

Where do labels fit with DLP and email encryption?

Labels classify. DLP enforces. Encryption protects.

You'll want all three, and labels come first because DLP and encryption both key off them.

A DLP rule can block an email that contains credit card numbers. A label tells DLP that a file is Confidential even when there's no card number in it. Encryption makes sure that if the file gets out anyway, nobody outside can read it.

For the wider tool comparison, see our breakdown of data loss prevention tools for small business. For the cost side, see email encryption cost.

Frequently asked questions

Is Microsoft Purview Information Protection included in Business Premium?

Yes, for manual labeling. Users can apply labels and encryption to files, email, and meetings themselves. Automatic labeling based on content needs an E5-level license, which Business Premium tenants have to buy as an add-on.

Can outside clients open a file encrypted with a sensitivity label?

Only if the label grants them access. Labels encrypted to "All Employees" block everyone outside your organization by design. Use a label that lets the sender choose recipients when you need to share protected files with clients, and test it with their email system first.

What happens if someone removes a label?

With Microsoft's default policy, they have to type a justification before removing or lowering a label. That won't stop a determined person. It does stop the accidental downgrade, and label activity shows up in the Purview audit log, so you can see who changed what.

Do sensitivity labels work on Macs and phones?

Yes. Microsoft's documentation covers labeling in Office apps on Windows, macOS, iOS, and Android, and in Office for the web once SharePoint and OneDrive labeling is on.

The gap is perpetual Office: labels "aren't supported for standalone editions of Office." Find those machines in your pilot.

How long does a sensitivity label rollout take?

For a firm under 50 people, plan two to four weeks: one week to configure and pilot, one to fix what the pilot finds, then a staged rollout. Adding auto-labeling later adds at least the 25-day simulation window for SharePoint and OneDrive.

Get labels set up right the first time

Labels are a configuration job, not a purchase. Most of the work is deciding what your four labels mean and testing them against the way your firm actually shares files.

NetSys sets this up as part of our Microsoft 365 management and broader managed security services. Book a complimentary risk assessment and we'll show you what's already labeled, what isn't, and what Copilot can see today.