Office365 Sensitivity Label | JiJi Technologies

What is sensitivity Label?

Sensitivity Label is classifying and protecting document/email using the
label. Now sensitivity Label available from Office 365 Security and
compliance and it requires Office 365 E3/E5 license. Previously, same
functionality available in Azure Information Protection (Still Azure
Information Protection is available in Azure) and that required Azure
Information Protection premium license.

Why sensitivity label come into Office 365

Previously Azure Information Protection used to protect Office document
(Word, Excel, PowerPoint, Email) from the windows machine. Now it’s one
of part office 365 to help to protect the document from SharePoint
Online, OneDrive, Exchange Online, Office Online. So, Labeling moving
from Azure to Office 365 With E3/E5 License.

How to migrate AIP to Sensitivity label.

By default, when you create a new sensitivity label from Office 365
Security and compliance, it will create the same label into AIP. If you
modify existing label in AIP, you can update modification to Sensitivity
label using publish option. But if you modify existing sensitivity
label, it will not update to AIP.

How sensitivity label is working?

The administrator needs to create the label and publish label to
Users/Group from office 365 Security and compliance. After publishing
the label, the user can apply the label in Document/Email usingAzure
information Protection Unified label client. You can download the
Unified label client from
thislink
(download theAzInfoProtection_ul.exe file ). Coming soon
sensitivity label option default along with office apps on Windows and
Office online, so unified label client no longer required.

Note: Already inbuild sensitivity label option available in Mac (V
16.21.0+), iOS (V 2.21+), Android (V 16.0.11231+)

How to Configure Sensitivity Label

Create Label

Administrator needs to create the label from Office 365 Security and
compliance Classification label. And label orders are an important one,
higher sensitive label in the lower order and low sensitive label in
higher order. For Example: If you want only content marking with footer
or header to classify the document (Without Encryption, DLP), so this
label is low sensitivity label, that label must be in higher order.

Sensitivity label has the following features.

Encryption
Content marking
Endpoint data loss prevention
Auto labeling

Note: Depends on the need, we can skip any above feature during the
creation of Sensitivity Label.

Encryption

Sensitivity Label usingAzure Rights management to encrypt the data.
Other than encryption it also has some important features that are
Access duration, Offline access, File access permission. If document not
more sensitive, we can skip the disable the Encryption. Azure
Information Protection is also using Azure Rights managementto
encrypt the data.

What we can encrypt

We can encrypt an only email or email and documents

Define access duration

We can define how long the labeled file can be accessed. After specific
days file access has been expired, so user access has been disabled for
this labeled file.

Offline access

We can define user can access the offline for Never, Always or only for
a number of days. if we define the number of days, user’s need to
re-authenticate to file access after specific days.

Who can access the encrypted file?

We can define which users can access the file with specific permission.

Also, it has the following option to define the users to access the
file.

All tenant members

(All users in your tenant. This setting excludes guest accounts)
Add users and groups

(Any specific user or email-enabled security group, distribution

group, Office 365 group, or dynamic distribution group)
Add these email address or domains

(Any email address or domain outside your organization, such as

gmail.com, hotmail.com, or outlook.com)

It has following predefined permission level and we can define custom
permission to access the file.

Co-owner

(View, Open, Read, Save, Edit Content, Edit, Copy, View Rights,

Change Rights, Allow Macros, Save As, Export, Print, Reply, Reply

All, Forward, Full Control)
Co-author

(View, Open, Read, Save, Edit Content, Edit, Copy, View Rights,

Allow Macros, Save As, Export, Print, Reply, Reply All, Forward)
Reviewer

(View, Open, Read, Save, Edit Content, Edit, View Rights, Reply,

Reply All, Forward, Allow Macros)
Reader

(View, Open, Read, View Rights, Reply, Reply All, Allow Macros)
Custom

Content marking

Mark the content used for classifying the documents (Word, Excel,
PowerPoint) and email. It’s used by Header, Footer, Watermarking

Header and footer are available for documents and email. Watermarking
only available for documents and not for email.

Endpoint data loss prevention

Data loss prevention (DLP) is used by Windows information protection to
prevent the document accidental leakage, with or without applying
encryption. WIP to prevent the copying to USB drives and prevent to
sharing of the data to any non-work location Like a personal OneDrive,
personal email accounts, social media.

This example prevents to send a file from the personal Gmail account.

Prerequisites

Before going to see the DLP (WIP) in Sensitivity label, we need to check
prerequisites of DLP (WIP) in Sensitivity label.

This example prevents to send a file from the personal Gmail account.

Create a label with DLP enabled from office 365 Security and

compliance
Windows 10 machine with 1089 update and more.
Windows 10 Machine need Windows Defender ATP, it will help to find

the labeled file and apply the WIP policy.

How WIP works with Sensitivity Label

If you create a sensitivity label with Data loss prevention enabled.
That label can be applied manually or apply automatically using auto
labeling to document. Once label applied to document in windows 10
machine, Windows Defender Advanced Threat Protection automatically scan
any DLP enabled document. Windows Defender ATP triggers the WIP policy.
WIP policy protects the document.

Auto labeling

Before going to see the auto labeling, we need to check prerequisites of
auto labeling.

Prerequisites

Create a label with Auto labeling enabled from office 365 Security

and compliance.
Auto labeling required Azure Information Protection P2 license.
Windows 10 Machine with Azure information protection unified

labeling client tool.

Note: Auto labeling function not available in other then windows OS
like Mac, iOS, Android

How auto labeling is works

Auto labeling working based on sensitive type information store (Credit
card number, Account number) in the label. Unified labeling client will
check when open the file, it will apply the label automatically or show
the recommended message to change the label. It based on the
configuration in the sensitivity label.

Label policies

Now Label is created successfully, but that label will not reach the
users in your organization. So, we need to publish the label and define
who can access the label. This process called label policies. Using
label policy, we can publish one or more label and we need to define
which user can access this label and we can define which label is
default label. Another important feature in label policy is User
Justification if the user removes label or change label to low
classification level, the user needs to provide the justification
regarding this action.

Note: When you define label policy permission, you need to ensure
label encryption permission users/group is existing in label policy
permission.

Label policies order

It’s like to sensitivity label, Label policies order is help to
priorities the policy. Higher priority label policy is shown in low
order and lowest priority label is shown in higher order in the label
policies.

How to protect the document in third-party apps using sensitivity label

Already Microsoft cloud app security is used for discovering and
auditing the document from third-party apps like Box, Dropbox, Google
suite. Now cloud app security supports sensitivity labeling. Using cloud
app security (file policy), it will automatically apply the sensitivity
label to documents in the third-party app. Based on the sensitivity
label, it’s automatically applying the encryption to the document, so it
will help to more protect your document in the third-party app location

How to create cloud app security policy with the sensitivity label

We need to create new file policy from Control Policy File policy
Governance and select the required app (Box, Dropbox, Google suite) and
enable classification and select the required label.

How to protect the SharePoint site Documents using sensitivity label

Microsoft recently announced sensitivity label supporting SharePoint
Online Document and this feature under private preview. In this private
preview, it has the following features.

We can access the labeled (sensitivity labeled) documents from

SharePoint online and OneDrive.
Sensitivity label will continue when downloading the labeled

document from SharePoint online and OneDrive.
Now user can open, edit the labeled document from SharePoint online/

OneDrive using Office online. (support sensitivity labels from

Office online is already in plan)
Office 365 eDiscovery supports the full-text search of protected

documents. Data Loss Prevention (DLP) policies can now work with the

contents of these documents (such as credit card numbers within

documents).

How to protect the SharePoint site using sensitivity label

Microsoft recently announced sensitivity label supporting SharePoint
Online site and this feature under private preview. In this private
preview, we can classify site using the sensitivity label.

Sensitivity label supporting the following features in SharePoint Site.

Label the entire site for the user to identify how the site is more

important.
Using this Label, we can define the site type (Public or Private).
We can manage external access using this label.
We can manage device access using this label. (If this setting is

enabled with Block access, after that user access from the unmanaged

device, site access is automatically blocked.)

How to apply sensitivity label to SharePoint site

You can apply the sensitivity label during site creation. Also, you can
manage site sensitivity from SharePoint admin centerActive sites Select
required site site properties Sensitivity.