Office 365 Sensitivity Labels

[mwnci]

Hi all,

I am keen to start using sensitivity labelling across our Office 365 network to categorise confidential data and control access and sharing.

 

My initial focus will be on labelling documents containing personal data including safeguarding, SEND and HR data which will greatly improve our data protection compliance in terms of access control and retention.

 

Has anyone had a go at rolling this out? Any thoughts on best practice for label categories/types (our needs are likely to be broadly similar across edu settings)?

[psydii]

We've got similar configured. A few people are using them. Nobody has noticed any problems yet. The key advice is to keep it simple and keep the number of labels to a minimum. Most labels have thr Senior Management Team having access + the relevent group as per the name of the label. We added pastoral to the list.

 

We also deployed Azure Information Protection client to all staff, and configured Adobe Acrobat support via GPO and a plugin

 

Rolling it out operationally requires buy-in from SMT. This has been the hold up for us. It is never important enough in their view for them to take any time to review the proposal or run a trial. I've pushed ahead with he technical piece, reminding SMT from time to time. As soon as we have a serious data breach I exepect to be asked roll it our within a day or two.

[mwnci]

There is a clear pattern for us when it comes to data breaches - human error. I'm fortunate in that I'm in a position to drive the roll out of labelling to remove human error from the equation (to a degree).

I'm also thinking about how we use Power Automate to help with this - for example auto labelling everything that is put in a particular folder.

 

We are applying the labels directly in office which certainly streamlines things a bit.

An added complication is the fact that you can apply a label to a container (Sharepoint/365 Group/Teams) or directly to a file. I still haven't really worked out the benefit of applying a label to a container and as such I've come to the conclusion (for now) that we are better off focusing on the individual file for the time being.

[TechMonkey]

An added complication is the fact that you can apply a label to a container (Sharepoint/365 Group/Teams) or directly to a file. I still haven't really worked out the benefit of applying a label to a container and as such I've come to the conclusion (for now) that we are better off focusing on the individual file for the time being.

 

My first thought is that if your DSL has a particular folder where things are kept, everything in there is marked as Child Protection and given high security to prevent any accidents. They would then have to manually lower the sensitivity, you could even set it to demand a reason, if they need to pass it on to anyone.

Alternative is Accounts folder could be marked as sensitive or as having financial data.

[mwnci]

One of the annoyances is that files are not automatically labelled if a label is applied to a container. The label has to be applied to each file individually. Users can be alerted by an automated email if there is a label mismatch between the file and its container.

 

Ideally, I would use power automate to auto apply a label to any file in a folder, but that functionality isn't there (at least with the licences that I have got).

 

I'm now pursuing the option here using Cloud App Security: https://joannecklein.com/2020/03/30/microsoft-cloud-app-security-and-sensitivity-labels/ - looks like I still need additional licencing.

[psydii]

I've found myself reading a lot of Jo's blogs recently. Seems to be the definative resource for summarising the documentation. Invaluable if you are working on the compliance side of things.

 

On the topic of labels requiring manual application: Rather than a label, you can use Retention Policy and apply it to a Library. I have found it difficult to keep retention labels vs retention policies straight in my head, and had several confusing conversations with MS Support!