Skilling Tasks

Your task is to create and publish sensitivity labels within your organization that classifies and protects sensitive data according to its level of confidentiality and the necessary access controls.

Tasks:

Enable support for sensitivity labels
Create sensitivity labels
Publish sensitivity labels
Configure auto labeling

Task 1 – Enable support for sensitivity labels in SharePoint and OneDrive

In this task, you’ll install the necessary modules and enable support for sensitivity labels on your tenant. This is needed for the optional task of applying sensitivity labels later in this exercise.

In the desktop, open an elevated PowerShell window by right clicking the Windows button in the task bar, then select Terminal (Admin).
Confirm the User Account Control window with Yes.
Run the Install-Module cmdlet to install the latest MS Online PowerShell module version:
```
 Install-Module -Name MSOnline
```
Confirm the Nuget security dialog and the Untrusted repository security dialog with Y for Yes and press Enter. This might take a while to complete processing.
Run the Install-Module cmdlet to install the latest SharePoint Online PowerShell module version:
```
 Install-Module -Name Microsoft.Online.SharePoint.PowerShell
```
Confirm the Untrusted repository security dialog with Y for Yes and press Enter.
Run the Connect-MsolService to connect to the MS Online service:
```
 Connect-MsolService
```
In the Sign into your account form, sign in as the user you selected as the Compliance Administrator in a previous exercise.
After signing in, navigate back to the terminal window.
Run the Get-Msoldomain cmdlet and save the domain as a variable:
```
 $domain = get-msoldomain
```
Use the $domain variable created in the previous step to create a new variable for $adminurl:
```
 $adminurl = "https://" + $domain.Name.split('.')[0] + "-admin.sharepoint.com"
```
Run the Connect-SPOService cmdlet using the $adminurl variable created in the previous step:
```
 Connect-SPOService -url $adminurl
```
In the Sign into your account form, sign in as the Global Administrator.
After signing in, navigate back to the terminal window.
Run the Set-SPOTenant cmdlet to enable support for sensitivity labels:
```
 Set-SPOTenant -EnableAIPIntegration $true
```
Confirm the changes with Y for Yes and press Enter.
Close the PowerShell window.

You have successfully enabled support for sensitivity labels for Teams and SharePoint sites.

Task 2 – Create sensitivity labels

In this task, your HR department has requested a sensitivity label to apply to HR employee documents. You’ll create a sensitivity label for internal documents and a sublabel for the HR department.

Open Microsoft Edge and navigate to https://purview.microsoft.com. Log into Microsoft Purview as the user you selected as the Compliance Administrator.
In the Microsoft Purview portal, select Solutions from the left sidebar, then select Information Protection.
On the Microsoft Information Protection page, on the left sidebar, select Sensitivity labels.
On the Sensitivity labels page select + Create a label.
The New sensitivity label configuration will start. On the Provide basic details for this label, enter:
- Name: Internal
- Display name: Internal
- Description for users: Internal sensitivity label.
- Description for admins: Internal sensitivity label for Contoso.
Select Next.
On the Define the scope for this label page, select Items, then select Files and Emails. If the checkbox for Meetings is selected, make sure it’s deselected.

[!NOTE] When Meetings is selected, you can’t create a sublabel for the sensitivity label.
Select Next.
On the Choose protection settings for labeled items page, select Next.
On the Auto-labeling for files and emails page, select Next.
On the Define protection settings for groups and sites page, select Next.
On the Auto-labeling for schematized data assets (preview) page, select Next.
On the Review your settings and finish page, select Create label.
On the Your sensitivity label was created page, select Don’t create a policy yet, then select Done.
On the Sensitivity labels page, find the newly created Internal sensitivity label. Select the vertical ellipsis (…) next to it, then select + Create sublabel from the dropdown menu.
The New sensitivity label wizard will start. On the Provide basic details for this label page enter:
- Name: Employee data (HR)
- Display name: Employee data (HR)
- Description for users: This HR label is the default label for all specified documents in the HR Department.
- Description for admins: This label was created with input from the Head of HR. Contact the HR department for any changes to the label settings.
Select Next.
On the Define the scope for this label page, select Items, then select Files, Emails, and Meetings.
Select Next.
On the Choose protection settings for labeled items page, select the Control access option, then select Next.
On the Access control page, select Configure access control settings.
Configure the encryption settings with these options:
- Assign permissions now or let users decide?: Assign permissions now
- User access to content expires: Never
- Allow offline access: Only for a number of days
- Users have offline access to the content for this many days: 15
- Select the Assign permissions link. On the Assign permissions flyout panel, select the + Add any authenticated users, then select Save to apply this setting.
On the Access control page, select Next.
On the Auto-labeling for files and emails page, select Next.
On the Define protection settings for groups and sites page, select Next.
On the Auto-labeling for schematized data assets (preview) page, select Next.
On the Review your settings and finish page, select Create label.
On the Your sensitivity label was created page, select Don’t create a policy yet, then select Done.

You have successfully created a sensitivity label for your organizations internal policies and a sensitivity sublabel for the Human Resources (HR) department.

Task 3 – Publish sensitivity labels

You will now publish the Internal and HR sensitivity label so that the published sensitivity labels will be available for the HR users to apply to their HR documents.

In Microsoft Edge, the Microsoft Purview portal tab should still be open. If not, navigate to https://purview.microsoft.com > Solutions > Information Protection > Sensitivity labels.
On the Sensitivity labels page select Publish labels.
The publish sensitivity labels configuration will start.
On the Choose sensitivity labels to publish page, select the Choose sensitivity labels to publish link.
On the Sensitivity labels to publish flyout panel, select the Internal and Internal/Employee Data (HR) checkboxes, then select Add at the bottom of the flyout panel.
Back on the Choose sensitivity labels to publish page, select Next.
On the Assign admin units page, select Next
On the Publish to users and groups page, select Next.
On the Policy settings page, select Next.
On the Default settings for documents page, select Next.
On the Default settings for emails page, select Next.
On the Default settings for meetings and calendar events page, select Next.
On the Default settings for Fabric and Power BI content page, select Next.
On the Name your policy page, enter:
- Name: Internal HR employee data
- Enter a description for your sensitivity label policy: This HR label is to be applied to internal HR employee data.
Select Next.
On the Review and finish page, select Submit.
On the New policy created, select Done to finish publishing your label policy.

You have successfully published the Internal and HR sensitivity labels. Note that it can take up to 24 hours for changes to replicate to all users and services.

Task 4 – Create a client-side auto labeling policy

In this task, you’ll create a client-side auto-labeling policy. Client-side auto-labels apply automatically to files and emails based on their content, ensuring that sensitive information is classified and protected before it leaves the user’s device.

You should still be on the Sensitivity labels page in the Microsoft Purview portal. If not, navigate to https://purview.microsoft.com > Solutions > Information Protection > Sensitivity labels.
On the Sensitivity labels page, find the newly created Internal sensitivity label. Select the vertical ellipsis (…) next to it, then select + Create sublabel from the dropdown menu.
The New sensitivity label configuration will start. On the Provide basic details for this label page, enter:
- Name: Confidential Research Data
- Display name: Confidential Research Data
- Description for users: This document or email contains sensitive research or development data that is proprietary to the organization.
- Description for admins: This label is auto-applied to documents and emails containing information related to research, prototypes, or internal projects.
Select Next.
On the Define the scope for this label page, select Items, then select Files, Emails, and Meetings.
Select Next.
On the Choose protection settings for labeled items page, select Apply content marking, then select Next.
Select Next.
On the Content marking page, select the toggle to enable content marking.
If the checkbox for Add a footer is selected, deselect it, and select the checkbox for Add a watermark, then select Customize text.
In the Customize watermark text flyout pane, enter Confidential - R&D Data as Watermark text. Increase the Font size to 40, then select Save at the bottom of the panel.
Back on the Content marking page, if other content marking options are enabled, disable them to ensure Add a watermark is the only option enabled.
Select Next.
On the Auto-labeling for files and emails page, set the Auto-labeling for files and emails to enabled.
In the Detect content that matches these conditions section, select + Add condition > Content contains.
In Content contains section select the Add > Trainable classifiers.
In the Trainable classifiers flyout panel, add these trainable classifiers:
- Source code
- Project documents
- Software Product Development Files
Select Add at the bottom of the panel to add these trainable classifiers.
Back on the Auto-labeling for files and emails page, select Next.
On the Define protection settings for groups and sites page, select Next.
On the Auto-labeling for schematized data assets (preview) page, select Next.
On the Review your settings and finish page, select Create label.
On the Your sensitivity label was created page, select Publish label to users’ apps, then select Done.
On the Publish label flyout panel, select Create new label policy.
On the Choose sensitivity labels to publish page, select the Choose sensitivity labels to publish link.
Select the parent Internal label and the Confidential Research Data label that was just created, then select Add.
Back on the Choose sensitivity labels to publish page, select Next.
On the Assign admin units page, select Next.
On the Publish to users and groups page, select Next.
On the Policy settings page, select the checkbox for Users must provide a justification to remove a label or lower its classification, then select Next.
On the Default settings for documents page, select Next until you reach the Name your policy page.
On the Name your policy page, enter:
- Name: R&D Confidential Data Policy
- Enter a description for your sensitivity label policy: Automatically applies labels to source code, project documents, and development files to protect sensitive R&D data.
Select Next.
On the Review and finish page, select Submit.
On the New policy created page, select Done.

You have successfully created a client-side auto-labeling policy that will automatically apply the Confidential Research Data label to files and emails containing research and development data. It might take up to 24 hours for the policy to take full effect.

Task 5 – Create a service-side auto labeling policy

In this task, you’ll create a service-side auto-labeling policy. Service-side auto-labels are applied by cloud services like SharePoint, Exchange, and OneDrive after content is uploaded or received, ensuring that sensitive data is protected even if users don’t manually classify it.

You should still be on the Sensitivity labels page in the Microsoft Purview portal. If not, navigate to https://purview.microsoft.com > Solutions > Information Protection > Sensitivity labels.
Expand the Internal label, then select the Confidential Research Data sublabel you created in a previous task.
In the Confidential Research Data flyout panel, you’ll see the properties for the auto-label you created in a previous task. In this panel, select Create auto-labeling policy.
On the Name your policy page, enter:
- Name: R&D Confidential Data Container Policy
- Enter a description for your sensitivity label policy: Automatically applies the Confidential Research Data label to content in SharePoint, Exchange, and OneDrive.
Select Next.
On the Assign admin units page, select Next.
On the Choose locations where you want to apply the label page, leave Exchange email, SharePoint sites, and OneDrive accounts selected, then select Next.
On the Set up common or advanced rules page, leave Common rules selected, then select Next.
On the Define rules for content in all locations page, edit the Confidential Research Data rule.
In the New rule flyout panel, under Conditions > Content contains select the dropdown for Add, then select Trainable classifiers.
In the Trainable classifiers flyout panel, add these trainable classifiers:
- Source code
- Project documents
- Software Product Development Files
This ensures consistent protection between client-side and service-side labels.
Select Add at the bottom of the panel to add these trainable classifiers.
Back on the Define rules for content in all locations page, select Next.
On the Choose a label to auto-apply, leave the Internal/Confidential Research Data chosen, then select Next.
On the Decide if you want to test out the policy now or later page, select Run policy in simulation mode, and select the checkbox for Automatically turn on policy if not modified after 7 days in simulation, then select Next.
On the Review and finish page, select Create policy.
On the Your auto-labeling policy was created page, select Done.

You have successfully created a service-side auto-labeling policy that will automatically apply the Confidential Research Data label to content stored or shared in SharePoint, Exchange, and OneDrive. It might take up to 24 hours for the policy to take effect.