Cloud & Microsoft 365
Information classification and labelling for Microsoft 365: sensitive information recognisable and protected
We set up information classification for your Microsoft 365 environment: a few clear labels, such as Public, Internal and Confidential, with rules that protect confidential documents and emails. That way everyone knows how sensitive information is, and it stays where it belongs.
The problem
In every organisation, information circulates that is not meant for everyone: personnel data, customer files, quotes and contracts. In Microsoft 365, that information is spread across OneDrive, SharePoint, Teams and the mailbox, and a file is shared in a few clicks. Often an employee does not even know that a document is confidential.
With information classification and labelling, you give every document and every email a label that says how sensitive it is, for example Public, Internal or Confidential. We link rules to those labels that protect the information, wherever it goes. We also encrypt email containing sensitive information, with one click or automatically, so that only the recipient can read it. We set it up as a project: a simple labelling scheme, the right settings in Microsoft 365, encrypted email, a pilot and clear explanations for your team.
What will you notice?
In Word, Excel, Outlook and Teams you choose a label with one click. Employees know what is confidential and what is not, and a confidential file stays protected, even if it accidentally goes to the wrong person.
What it does for you
How Information classification and labelling helps you
- 01
Everyone can see how sensitive something is
A label on a document or email makes it clear at a glance whether something is public, internal or confidential. Employees do not have to guess what they can and cannot share.
- 02
Protection that travels along
We link rules to a label, such as encryption or a warning when sharing outside the organisation. That protection stays attached to the file, even when it is downloaded or forwarded.
- 03
Ready for GDPR, NIS2 and Copilot
You show that you deliberately protect sensitive information. And Copilot takes labels into account, so confidential information does not simply turn up in answers.
How it works
How we arrange it
Not a technical story, but what happens and who does what.
Plan an introduction- Step 1
Inventory
Together we map out what information you have, where it is stored and what is truly confidential: personnel files, customer data, financial documents or contracts.
- Step 2
Labels and agreements
We draw up a short and understandable labelling scheme, usually three or four labels, with what each label means and when you use it. Better a few labels that everyone understands than a long list.
- Step 3
Setting up in Microsoft 365
We create the labels in Microsoft Purview and link the rules: encryption, sharing restrictions and a marking in the document. We set a default label and, where it fits, labels for entire Teams and SharePoint sites.
- Step 4
Encrypted email
We make sure employees can encrypt an email in Outlook with one click, and that the Confidential label encrypts an email automatically. With rules it also happens automatically, for example when an outgoing email contains a citizen service number (BSN) or bank account number. The recipient opens the email securely with a one-time code.
- Step 5
Testing with a pilot group
A small group works with the labels in Word, Excel, Outlook and Teams for a few weeks. We process their experiences before the rest of the team follows.
- Step 6
Rollout and explanation
We roll out the labels to everyone, with a short explanation in plain language. Then we look at the usage together and fine-tune where needed.
Frequently asked questions
Questions about Information classification and labelling
Is your question not listed? Feel free to call us, we are happy to think along with you.
Which licence do I need?
With Microsoft 365 Business Premium, the standard within Modern Workplace, you can let people choose sensitivity labels manually, set a default label and link rules such as encryption. Automatic labelling based on content requires a more extensive licence; we look together at whether that is needed.
Can I also encrypt email?
Yes. Part of it is already taken care of: email travels encrypted between mail servers and is stored encrypted. But if you want only the recipient to be able to read an email, you have to encrypt it yourself. With Business Premium, you can do that with the Encrypt button in Outlook. We set things up so that the Confidential label encrypts an email automatically, and that outgoing emails containing, for example, a citizen service number (BSN) are encrypted automatically. The recipient opens the email with a one-time code; a Microsoft account of their own is not needed.
Do employees have to label every document?
No. We set a default label, for example Internal, so only sensitive documents need a different label. With labels on Teams and SharePoint sites, everything in that location automatically gets the right protection.
What is the difference with the protection I already have?
Security such as MFA and device management protects access to your environment. Labels protect the information itself: also outside your environment, for example when a document is forwarded or ends up on a USB stick.
Why a project?
Setting up labels, agreements and rules is one-off work with a clear beginning and end. That is why we do it as a project, with clear agreements in advance. After that, maintenance falls under regular management.
Does this also help with Copilot?
Yes. Copilot takes labels and encryption into account: information that someone is not allowed to open does not appear in their answers either. That is why labelling is a fixed part of good Copilot readiness.