Microsoft Purview Sensitivity Labels Explained: A Practical Guide for 2026

Microsoft Purview sensitivity labels are classification tags — such as Public, Internal, or Confidential — that organizations apply to documents and emails to automatically enforce protection policies like encryption, access restrictions, and watermarking, based on how sensitive that content is. For companies running payroll, contracts, or support data inside Microsoft 365, understanding how labels work is central to actually using the compliance tools already included in their tenant.

What a sensitivity label actually does

A label isn't just a visual tag — it's a policy trigger. Once applied, a sensitivity label can automatically:

• Encrypt the document, so only authorized users can open it, even if the file is shared outside the organization.
• Restrict permissions, limiting who can edit, forward, copy, or print the content.
• Apply visual markings like headers, footers, or watermarks indicating the classification level.
• Control external sharing, blocking a "Confidential" document from being shared outside the organization entirely, while allowing a "Public" one to be shared freely.

Common label tiers and what they mean in practice

Most organizations configure a simple three- or four-tier structure:

1. Public — safe for unrestricted external sharing, no additional protection applied.
2. Internal — intended for employees only; typically blocks external sharing but doesn't encrypt.
3. Confidential — sensitive business data; usually encrypted and permission-restricted even for internal users without a specific need to access it.
4. Highly Confidential (optional, for regulated industries) — the strictest tier, often combined with additional access logging and stricter retention controls.

Why this matters for payroll and contract data specifically

Payroll records and signed contracts are two of the most sensitive document categories any organization holds — they contain compensation data, personal information, and legally binding commercial terms. Applying sensitivity labels to this content isn't a nice-to-have; for many compliance frameworks, it's close to table stakes.

Payroll360 classifies and protects payslip content using Microsoft Purview labels automatically, so every generated payslip inherits the appropriate sensitivity tier without anyone manually labeling individual documents one at a time. The same principle applies to the kind of exposure covered in Shadow AI risk: why pasting company documents into ChatGPT is a security problem — labeled, protected content is far less likely to leak into a tool outside your tenant's controls.

How labels connect to the rest of Purview

Sensitivity labels work alongside two other Purview capabilities that matter for compliance-heavy teams:

• Audit logs — every view, download, and label change is recorded, giving compliance teams a searchable trail.
• Retention policies — labeled content can be automatically retained or disposed of according to your organization's record-keeping requirements, rather than relying on someone remembering to clean up old files.

Getting started without overcomplicating it

The most common mistake is designing too many label tiers upfront. A simple three-tier structure (Public / Internal / Confidential), applied consistently, protects more real data than an elaborate seven-tier taxonomy that employees find confusing and start ignoring.