Forum Discussion
information protection label, label policies, auto-labeling - what is the difference?
plz help me understand the functionality of the partitions, because when creating a label, I have the opportunity to choose auto-assignment. At the same time there is a separate section for auto-labeling where, as far as I understand, are there more advanced settings, but do I need to remove the auto-assignment of the label when creating a label? At the same time, Label Policies uses the same label with individual policies. How do they interact? Why did you divide similar functionality into different sections?))
- miller34mike
Microsoft
Hi, Darkwing,
Thank you for posting your question here. I understand you're looking for clarification on the different label options such as auto-labeling and label policies.
These are actually two different functions. When you're creating a label, the auto-labeling options you see there is known as client-side labeling. This auto-labeling is applied when a user creates a new file or when they modify an existing file. The built-in labeling client within your office applications will scan the file for the content you specified when creating the label and if a match is found, it will apply the label, or recommend the user apply it, based on which option you set within the label. These labels are assigned and made available to users through label policies, where you set settings such as a default label or requiring a label on all files/emails.
Then you have service-side labeling, which is the "auto-labeling" option within the admin center. This refers to applying labels to data-at-rest (or as it is sent for Exchange) based on conditions you specify. Once you create the policy, crawlers will scan files in the locations specified within the policy and if they match your conditions, it will apply the label you specified. These are very helpful when ran in simulation mode first so you may work to identify areas with high counts of sensitive data, rule out false positives, fine-tune your conditions for less false positives, etc.
I wrote a few blogs around sensitivity labels that may help explain this in more detail, especially my labels overview blog, linked below. On my page you will also find a mini-series running through all the options available with labels.
Microsoft 365 Sensitivity Labels Overview – Cloudy Security (cloudy-sec.com)
- that is, to simplify, the auto-assignment in "Labels" is when a label is assigned at the time of creating or editing a document. And "Auto-labeling" is the assignment of labels to documents that have already been created. Correctly?
I apologize for any strange questions 🙂- miller34mike
yes, client-side is real-time auto labeling during creation or modification. Service-side is existing content at rest.
Once you’re ready for auto-labeling, you’d use the two consecutively as service-side has a limitation of only labeling 25,000 files per 24 hours. So you’d want client-side labeling to help the process by labeling any modified or new document that has not yet been labeled.
- miller34mike
Hi, Darkwing,
Just wanted to follow up and see if there was anything else you needed for this specific question? If you feel any of the answers solved or answered your question clearly, please remember to mark it as solved so others who have the same question may benefit from your thread.
miller34mike The original question contained 3 questions about 3 functions:
1. When creating a label there is an option to apply the label automatically.2. Label policies
3. Auto-labeling
You clarified questions 2 and 3, but not the question 1. Could you please clarify the question number 1? When I create a label and choose the option to apply label automatically, then what happens and how it is related to Label policies and Auto-labeling?
- miller34mike
Hi zlelik,
When you create a label and configure the auto-labelling feature within the label, this will apply to data in real-time, as the user interacts with the content with their office apps. For instance, if I tell the label to auto-apply to all files containing 5 credit card numbers, then deploy the label to users, any file that user opens or creates that has 5 credit card numbers or if the user enters 5 credit card numbers, the document will automatically have the label applied to it. In my initial response, I explained this as "client-side" labelling. I've pasted that portion of my response below.
These are actually two different functions. When you're creating a label, the auto-labeling options you see there is known as client-side labeling. This auto-labeling is applied when a user creates a new file or when they modify an existing file. The built-in labeling client within your office applications will scan the file for the content you specified when creating the label and if a match is found, it will apply the label, or recommend the user apply it, based on which option you set within the label. These labels are assigned and made available to users through label policies, where you set settings such as a default label or requiring a label on all files/emails.
I also recommend checking out the below blog on sensitivity labels, which is part 1 of a 5-part series, for a full overview of sensitivity labels.
Microsoft Purview Sensitivity Labels – Part 1 – Cloudy Security (cloudy-sec.com)
