information protection label, label policies, auto-labeling - what is the difference?

Hi, Darkwing,

Thank you for posting your question here. I understand you're looking for clarification on the different label options such as auto-labeling and label policies.

These are actually two different functions. When you're creating a label, the auto-labeling options you see there is known as client-side labeling. This auto-labeling is applied when a user creates a new file or when they modify an existing file. The built-in labeling client within your office applications will scan the file for the content you specified when creating the label and if a match is found, it will apply the label, or recommend the user apply it, based on which option you set within the label. These labels are assigned and made available to users through label policies, where you set settings such as a default label or requiring a label on all files/emails.

Then you have service-side labeling, which is the "auto-labeling" option within the admin center. This refers to applying labels to data-at-rest (or as it is sent for Exchange) based on conditions you specify. Once you create the policy, crawlers will scan files in the locations specified within the policy and if they match your conditions, it will apply the label you specified. These are very helpful when ran in simulation mode first so you may work to identify areas with high counts of sensitive data, rule out false positives, fine-tune your conditions for less false positives, etc.

I wrote a few blogs around sensitivity labels that may help explain this in more detail, especially my labels overview blog, linked below. On my page you will also find a mini-series running through all the options available with labels.

Microsoft 365 Sensitivity Labels Overview – Cloudy Security (cloudy-sec.com)