The difference from folder permissions
Ordinary SharePoint permissions protect the place a file is stored. Once someone with access downloads it, emails it or copies it to a USB stick, those permissions no longer apply; the copy can go anywhere. That is fine for most documents, but not for a payroll export, a client's medical summary or a draft sale agreement.
A sensitivity label can encrypt the file itself and record who is allowed to open it. If a labelled document is attached to an email sent to the wrong person, they cannot open it, because their account is not on the list. The protection follows the file rather than the folder, which is the key idea to understand before deciding whether you need labels at all.
A simple scheme to start with
Most small businesses need no more than three or four labels. Public for material that can go anywhere, such as brochures. General for normal internal business documents, which is the default. Confidential for material only staff should see, perhaps with a footer and a header marking. Highly Confidential for the small set of documents restricted to named people, with encryption.
Keep the names plain and the descriptions short, because staff choose labels from a menu in Word, Excel, PowerPoint and Outlook and will not read a policy each time. A one-line description under each label, such as use for payroll, HR records and anything with bank details, does more than a long document nobody opens.
What each label can do
Labels can add visual markings, such as a header that says Confidential or a watermark across each page. They can encrypt content so only specified people or groups can open it, and set whether they can edit, print or copy text. They can also be applied to Teams and SharePoint sites to control whether guests can be added or whether the site can be shared externally.
Encryption is powerful but needs care. An encrypted file sent to an outside accountant will not open unless they are included in the label's permissions or the label allows the person applying it to choose recipients. Test labels with real scenarios, such as sending a confidential file to your lawyer, before rolling them out across the office. A label that blocks your own accountant from opening the year-end pack will be abandoned within a week.
Manual, default and automatic labelling
With manual labelling, staff pick a label when they save a document or send an email. You can set a default label, usually General, so everything gets at least a basic label, and require people to give a reason if they lower a label from Confidential to General. That keeps the burden light while still building a habit.
Some higher licences add automatic labelling, where Microsoft 365 spots content such as credit card or passport numbers and recommends or applies a label. Business Premium includes manual labelling and some related protection features; automatic labelling across the board needs more advanced licences. Check current licensing before planning around automation.
Rolling labels out without disruption
Create the labels in the Microsoft Purview portal and publish them first to a small group, such as management and accounts. Ask them to use them for a few weeks and note anything awkward, especially around encryption and sending to outsiders. Adjust names and settings based on what they find before publishing to everyone.
Then spend fifteen minutes with each team showing where the label button is and what each label is for, using examples from their own work. Label a few important existing libraries centrally rather than asking staff to go back through old documents. Over time, reports in Purview show how labels are being used and where sensitive documents are being stored or shared.
When labels are worth the effort
Labels earn their place in businesses that handle sensitive personal or commercial information and share it outside the office: health practices, accountants, lawyers, recruiters, and firms working on tenders or acquisitions. They also support Copilot readiness, because Copilot respects label-based encryption, and they help show reasonable security safeguards under the Privacy Act 2020.
For a small office whose sensitive material is limited to payroll and a few HR files, tight site permissions and good sharing settings may be enough for now. Start there, and add labels when the business starts sharing confidential material externally on a regular basis or when a client or insurer asks how documents are protected.
In short
- Labels protect the file itself, not just the folder it sits in.
- Start with three or four plainly named labels.
- Test encryption with outside recipients before rolling out.
- Set a default label and ask for a reason when one is lowered.
- Pilot with a small group, then train each team with real examples.