Senior Infrastructure Engineer lab demonstrating Microsoft Purview Information Protection — covering sensitivity label taxonomy, manual and automatic labeling, encryption-based access control, and label policy publishing across Microsoft 365 workloads.
Organizations generate sensitive data across Microsoft 365 every day — emails, Word documents, Excel files, SharePoint content, and Teams messages. Without a formal classification and protection framework, that data is exposed to:
- Accidental external sharing
- Unauthorized downloads and access
- Data exfiltration via unprotected email
- Regulatory non-compliance (GDPR, ISO 27001, industry standards)
- Inconsistent protection across workloads
Manual controls alone are not scalable. Users forget to apply labels, apply incorrect classifications, or work without awareness of what is sensitive.
The organization requires a data classification and protection framework that:
- Classifies sensitive information using a consistent, enterprise-standard taxonomy
- Applies encryption and access control to confidential content
- Enables manual user-driven labeling for day-to-day classification
- Automates detection and labeling of sensitive information patterns (financial, personal, legal)
- Covers all primary Microsoft 365 workloads: Exchange Online, SharePoint, OneDrive, Teams, and Office apps
- Provides a foundation for downstream DLP and compliance controls
Microsoft Purview Information Protection — the information governance and data protection layer built into Microsoft 365 and the Microsoft Purview compliance portal.
| Capability | Purpose |
|---|---|
| Sensitivity Labels | Classify and protect content with named tiers |
| Label Policies | Publish labels to users and workloads |
| Manual Labeling | User-driven classification via Office apps and Outlook |
| Auto-Labeling Policies | Automatic detection using Sensitive Information Types |
| Encryption (IRM) | Restrict access by authorized users and groups |
| Content Marking | Visual headers, footers, and watermarks |
| Trainable Classifiers | AI-powered document-type detection |
| Area | Status |
|---|---|
| Purview portal access (compliance.microsoft.com) | ✅ Verified |
| Default sensitivity label taxonomy reviewed | ✅ Verified |
| Custom sensitivity labels created | ✅ Configured |
| Label scope: Files and Emails | ✅ Configured |
| Protection settings: Encryption + Access Control | ✅ Configured |
| Label policy published to all users | ✅ Published |
| Auto-labeling policy: Credit Card detection | ✅ Configured |
| Auto-labeling label: Finance Confidential | ✅ Configured |
| Groups & Sites scope | |
| Content marking (watermarks/headers) | |
| Cloud Discovery / MCAS integration | Out of scope for this repo |
| Label | Scope | Protection |
|---|---|---|
| Public | Files, Emails | No encryption |
| General | Files, Emails | No encryption |
| Confidential | Files, Emails | Encryption + access control |
| Highly Confidential | Files, Emails | Encryption + restricted permissions |
| Internal Projects | Files, Emails | Encryption for internal audience |
| Client Confidential | Files, Emails | Encryption + customer-scoped permissions |
| Finance Restricted | Files, Emails | Encryption + finance-scoped permissions |
| Executive Confidential | Files, Emails | Encryption + leadership-only permissions |
Auto-Labeling Target:
Finance Confidentiallabel applied automatically when Credit Card Number (Sensitive Information Type) is detected.
| Stage | Detail |
|---|---|
| Business Problem | Unclassified sensitive data across Microsoft 365 — exposed to accidental sharing and regulatory risk |
| Business Requirement | Consistent classification taxonomy + encryption-based protection across all M365 workloads |
| Microsoft Solution | Microsoft Purview Sensitivity Labels + Auto-Labeling Policies |
| Configuration | Label taxonomy created, policies published, auto-labeling rule for Credit Card Numbers |
| Validation | Label availability confirmed in Office apps; auto-label policy reviewed in Purview portal |
| Outcome | Sensitive content automatically classified and protected — reducing human error and governance gaps |
Microsoft 365 Tenant (Patchthecloud.onmicrosoft.com)
│
├── compliance.microsoft.com (Microsoft Purview Portal)
│ └── Information Protection
│ ├── Sensitivity Labels
│ │ ├── Public / General (no encryption)
│ │ ├── Confidential / Highly Confidential (encryption)
│ │ ├── Internal Projects / Client Confidential
│ │ ├── Finance Restricted / Executive Confidential
│ │ └── Finance Confidential (auto-label target)
│ │
│ ├── Label Policies
│ │ └── Published to: All Users — "Require labeling" enabled
│ │
│ └── Auto-Labeling Policies
│ └── Rule: Detect Credit Card Number (≥1 instance)
│ └── Apply: Finance Confidential
│
├── Protected Workloads
│ ├── Exchange Online (email protection)
│ ├── SharePoint Online (file protection)
│ ├── OneDrive (document protection)
│ ├── Microsoft Teams (collaboration protection)
│ └── Office Apps (Word, Excel, PowerPoint, PDF)
│
└── downstream integrations
├── Microsoft Purview DLP (uses label as condition)
├── Microsoft Purview Audit (label activity logged)
└── Microsoft Defender for Cloud Apps (label-aware CASB)
Microsoft-Purview-Information-Protection/
├── README.md
├── .gitignore
├── LICENSE
├── GITHUB-METADATA.md
├── WEBSITE-PORTFOLIO-CARD.md
├── docs/
│ ├── 01-purview-information-protection-overview.md
│ ├── 02-sensitivity-labels-taxonomy.md
│ ├── 03-label-policies-publishing.md
│ ├── 04-manual-sensitivity-labels.md
│ ├── 05-automatic-sensitivity-labels.md
│ ├── 06-protection-settings-encryption.md
│ ├── 07-validation-testing.md
│ └── screenshots-placement-guide.md
├── scripts/
│ ├── New-SensitivityLabels.ps1
│ ├── New-AutoLabelingPolicy.ps1
│ └── Get-SensitivityLabelReport.ps1
└── architecture/
└── purview-information-protection.md
| Script | Purpose |
|---|---|
New-SensitivityLabels.ps1 |
Creates full enterprise sensitivity label taxonomy via Microsoft Graph |
New-AutoLabelingPolicy.ps1 |
Creates auto-labeling policy with Sensitive Information Type detection |
Get-SensitivityLabelReport.ps1 |
Reports label usage, policy configuration, and labeling activity |
This lab covers the following MS-102: Microsoft 365 Administrator exam objectives:
- Configure and manage sensitivity labels in Microsoft Purview
- Publish sensitivity label policies to users and groups
- Configure auto-labeling policies using Sensitive Information Types
- Apply encryption and access control using sensitivity labels
- Understand label scopes: Files, Emails, Groups & Sites
- Differentiate manual vs. automatic vs. recommended labeling
- Understand Trainable Classifiers vs. Sensitive Information Types
| Zero Trust Principle | Implementation |
|---|---|
| Verify Explicitly | Every piece of content is classified before protection is applied |
| Least Privilege | Encryption restricts access to only authorized users and groups |
| Assume Breach | Labels persist with content — protection survives location changes |
| Project | Technology | Link |
|---|---|---|
| P1 — Zero Trust Identity Perimeter | Conditional Access, MFA, SSPR | View |
| P3 — Zero Trust Email Security | Defender for Office 365, Safe Links | View |
| P6 — Entra ID Protection | Risk-based Conditional Access | View |
| P7 — SaaS & Data Visibility | Defender for Cloud Apps | View |
- Microsoft Information Protection: Sensitivity Labels & Data Classification
- Manual Sensitivity Labels in Microsoft Purview
- Automatic Sensitivity Labels in Microsoft Purview
Lokesh Karnam — Senior Infrastructure Engineer | Microsoft 365 | 9+ years enterprise experience
All configurations documented in this repository were implemented in a real Microsoft 365 E5 trial tenant (Patchthecloud.onmicrosoft.com). No configurations have been fabricated.