What a sensitivity label does and does not do
A label is a visible and technical mark: users see the name in Word, Excel, PowerPoint, or Outlook, and Microsoft 365 can attach policy to it (for example restrict forwarding, or encrypt the content). It is not a magic wall around all data. Without an agreement on which labels exist and when to choose them, they become a button nobody uses consistently — or an overload of ten labels nobody understands.
Labels are also different from retention (how long something stays) and different from SharePoint site permissions (who may open the library). You can label a contract Confidential and still overshare if guest access or anonymous links remain open. So do not start with labels while external sharing and guest accounts are still messy — see guest accounts and external sharing first.
When an SME should start labeling
A small label set pays off when at least one of these is true:
- Clear sensitive types: contracts, payroll or HR files, customer lists with personal data, or pricing that should not sit on every shared drive.
- Regular external sharing: staff send files to customers or partners; you want “Confidential” visible and, if you choose, harder to forward freely.
- Several teams on one tenant: without marks everything looks the same — labels help search, training, and conversations (“this is Confidential, not Internal”).
You can wait on labels if mail is mostly internal, sharing is already tight, and nobody would follow a classification scheme. Then MFA, audit logging, and clear sharing rules deliver more than a half-finished label tree.
A small label set an SME can run
Three to four labels usually beat a large-enterprise matrix:
- Public — fine outside the company (website, brochure, approved marketing).
- Internal — default for daily mail and team documents; not meant for casual external forwarding.
- Confidential — contracts, personal data, financial detail; often with stricter sharing or encryption.
- Optional: Highly confidential — only if you truly have a rare category (for example due diligence); otherwise it stays empty and confusing.
Write one page: what each label means, who may apply it (everyone or certain roles), and whether encryption travels with Confidential by default. Train briefly — labels without explanation end as “always Internal”.
What Floor ICT configures — and what you decide
In the Microsoft 365 tenant we typically: publish the agreed labels to the right user groups; set whether users must pick a label on save or send (where that fits); apply default labels on SharePoint sites you name; and explain what staff see in Outlook and Office. We turn on encryption and “block forward” only when you ask for it — too strict too early frustrates an SME and pushes people to private email workarounds.
You still decide: label names and meaning, which content types count as Confidential, and whether automatic labeling (keywords or types) is allowed at all. Essential, Advanced, or Elite say nothing about sensitivity labels; that is tenant configuration beside the MSP package. Labels work best next to external sharing, retention policies, and a working audit log.
More depth
Checklist for SME directors
1) List three content types that truly need different handling. 2) Pick three to four label names with one-line definitions. 3) Fix external sharing and guests first. 4) Decide whether encryption is default on Confidential. 5) Have Floor ICT publish and briefly brief users. 6) Review after a quarter if everyone picks “always Internal” — then the briefing or the set is too heavy.
Label versus site permissions
Permissions decide who may open a library; a label rides with the document and can travel when the file is downloaded or emailed. You need both: a tight site without labels fails when someone forwards the attachment; a label without permissions fails when the whole folder is open to everyone.
Relation to app consent
Labels protect content; they do not stop every app that asks for Microsoft Graph access. Keep app consent (OAuth) as a separate control — see app consent.
Questions
Frequently asked questions
Do we need labels if we almost never share externally?
Often not yet. Fix sharing rules, guest accounts, and MFA first. Labels help most when you must mark sensitive types or external sharing is common.
Do labels replace a password or multifactor authentication?
No. Labels classify and can encrypt content; signing in with multifactor authentication (MFA) remains the baseline against stolen passwords. Use both where needed — see our piece on turning on MFA.
Must users pick a label on every email?
Only if you configure it that way. For an SME a common pattern is: default Internal, and choose Confidential deliberately for contracts or personal data. Too many forced choices lead to random picks.
Does Floor ICT do this by default with Microsoft 365 management?
At intake or when Microsoft 365 is in scope, we ask whether classification already matters and propose a small label set. Which labels and whether encryption is on stays your call. The MSP package says nothing about labels; that is separate tenant configuration.