Sensitivity label policy

Define your organisation's sensitivity labels (for example Public, Internal, Confidential, Highly Confidential), set mandatory use and a default label per domain, and report on label usage.

Global administratorAdmin console › Tools and Migration › Profelis Sensitivity Labels

User side: Sensitivity labels.

The screen

1. In the admin console click Tools and Migration › Profelis Sensitivity Labels. Label counts appear at the top and the Taxonomy list (order, display name, MSIP name, subject prefix, external recipient policy, status) below.
2. The buttons above the list: New Label... (1), Edit... for the selected label (2), Settings... for the domain policy (3) and Audit Report... (4).

Sensitivity labels: taxonomy and buttons

Adding a label

1. Click New Label....
2. Display name (1) is the name users see in compose (for example PERSONAL DATA).
3. Name (MSIP _Name) (2) is the technical name matched against Microsoft labels; do not change it after saving.
4. Subject prefix (3) is added in front of the subject when outbound stamping is on (for example [PERSONAL]). You can also fill in Body header stamp and Body footer stamp.
5. External recipient policy (4): Allow or Warn. With Warn, the user must confirm when a recipient is outside your domains.
6. OK (5).

New label dialog

To change an existing label, select it in the list and click Edit.... Archive an unused label in the edit dialog instead of deleting it; archived labels are still recognised on older messages.

Per label you can define single recipient only, no CC/BCC, recipient lock, and restrictions on forwarding, saving as and printing. Microsoft-compatible MSIP_Labels and Sensitivity headers are added to outgoing messages.

Mandatory label and default label

1. Click Settings...; the Domain Policy dialog opens.
2. Choose the domain in Domain (1). The * (default for all domains) row is the default for every domain without its own setting.
3. Tick Label selection required (2). It is enforced in the Classic Web client.
4. Choose Default label (3). It is applied when the user picks no label, and to IMAP/ActiveSync/mobile sends.
5. Leave Stamp outbound messages, Read inbound labels and Keep audit log as needed.
6. OK (4). A user who sends without a label gets a warning and the message is not sent.

Domain policy: mandatory label

To remove a domain's own setting, select the domain and click Delete domain setting; the domain falls back to the * setting.

The default label cannot be deleted

A domain's default label cannot be deleted from the taxonomy. Change the domain's default or archive the label first.

Audit report

1. Click Audit Report....
2. Choose the From and To dates (1).
3. Load (2). Total labelled messages, the deliberate-labelling ratio, the label distribution and rows with sender, label, method, recipients and external domains are listed.
4. Download the list with Download CSV (3).

Audit report

Scope

Messages sent from webmail are labelled and reported. Sends from IMAP and ActiveSync clients are not stamped in this phase. A label does not encrypt content.