Office 365 Labels vs Label Policies

This is a quick post outlining the distinction between Office 365 labels and label policies. While the screenshots are from Sensitivity labels and label policies, the basic concept applies to compliance labels and label policies as well.

In the following screenshot, I have seven Sensitivity labels defined. Remember Sensitivity labels describe and prescribe how labeled content gets handled.

However, in my label policies, I only have two policies:

I had to do a bit of pruning, because to be honest my demo environment included a policy for every label. “Personal” got a “Personal” label policy, “General” got a “General” label policy, and so on. In effect, every label got its own policy, and every policy was published to all users.

However a label policy can also group multiple labels together. Administratively this typically makes a bit more sense, because instead of having a redundant 1-1 mapping of labels to policies, you can have multiple policies that group specific labels together for the purpose of scoping availability and settings. Sor far, I have just the one policy in effect, “Contoso General Purpose”. The “General Sensitivity Policy” has been deactivated.

Only three of those seven labels are part of this policy.

For the user, that means the only labels available will that ones that have been published and which include her in scope. Logged in as Megan (on a trust Azure Windows 10 VM), here’s what she sees:

This is all well and good if I have one set of Sensitivity labels that apply to everyone in my organization. Where it shines, however, is if a business unit came to me and said, “wait, we have some specific types of information, and rules about handling it, that are specific to our work.” I can spin up another label policy and scope it to just that group – and, for the purposes of my demonstration, to Megan as well.

Let’s saw Megan, and the entire Sales & Marketing group, need some extra labels available around Confidential information.

I put those two labels in a new label policy, and publish that as well, and voila: Megan has additional labels she can apply. I’m also requiring her to label.

Label policies are a way to organize the scope and settings of your various labels. Clearly, there is room for settings collision, so the design of your information governance should be as much a part of your information architecture as it is of your compliance settings.