University of Wisconsin-Milwaukee

You can use sensitivity labels (link to KB) in Microsoft 365 apps to protect sensitive data. Sensitivity labels allow classification of files, emails, and SharePoint sites with sensitive information as either Sensitive or Restricted.

• Credit Card Numbers
• U.S. / U.K. Passport Numbers
• U.S. Social Security Numbers
• U.S. Driver’s License Numbers
• U.S. Bank Account Numbers

Microsoft Office documents stored in OneDrive and SharePoint and attachments in Outlook email messages.

Navigate to the Sensitivity section in the top toolbar and click the applied label to uncheck it. A pop-up will appear asking you to select a justification for why you are removing the label.

• If a document has been incorrectly labeled or you determine there is no risk in sharing the document with an external user, you can navigate to the sensitivity section in the toolbar and remove the sensitivity label. You will be asked to provide a justification for removing the label.
• Add the external user as a guest member to a Microsoft Team or Outlook Group and then share the labeled file with them. Once the external user is a guest in a Team or Group, labeled files can be shared to them via the Team/Group or via OneDrive.
• If a document is labeled as restricted, external users will not be able to access it. You will need to re-label the document as sensitive or remove the label.

Yes, sensitivity labels can be manually applied by users to email messages. Additionally, auto labeling policies scan the body of emails for sensitive information and apply the Sensitive label if detected.

Additionally:

• If an un-labeled document containing sensitive information is attached to an email and sent Microsoft will automatically label the document as sensitive. The email itself will not be labeled.
• If an un-labeled document containing sensitive information is attached to an email using a sharing link and sent Microsoft will not automatically label the document or email as sensitive.

Your document should be labeled as Sensitive or Restricted if it contains:

• Credit Card Numbers
• U.S. / U.K. Passport Numbers
• U.S. Social Security Numbers
• U.S. Driver’s License Numbers
• U.S. Bank Account Numbers
• Other information defined as moderate or high risk by UW System Administrative Procedure 1031.A,

Files containing high risk data, which is not intended to be shared outside of your team or organization should be labeled with the Restricted label. The Restricted label will prevent any form of external sharing. The Restricted label should be used situationally, depending on the needs of the individual or group.

Yes, files shared in Teams will be available to team members depending on the label of the file itself. Individual Teams chats cannot be labeled, and the content of one-to-one Teams chats are not scanned for auto-labeling purposes. The contents of files stored in Team channels/sites are scanned and auto labeled. Meetings can be labeled. Additionally, external guest members of a Team can open sensitive labeled documents as well.

The main goal of sensitivity labels is to prevent unauthorized file access and data leaks, however, there may be some additional benefits in terms of phishing prevention. For example, if a user is tricked into sending their SSN or Credit Card number to a malicious actor, their email could be flagged as sensitive preventing the external user from viewing it.

The time it takes to auto label a document varies. We have found in testing that sensitive information is usually detected in a matter of seconds in the Word desktop client or Word online.

External guest members in Teams can access content labeled as sensitive. However, they cannot access content labeled as restricted.

With the Sensitive label, while external access is restricted by default, users can share access externally manually. With Restricted, there is no ability to share externally.