Data Sensitivity Labels

Tags software

This article explains how to apply data classification labels to files stored or created in Microsoft 365 apps.

Data sensitivity labels are digital tags used to classify and protect SUNY Geneseo’s information in alignment with our security policies.

Applying these labels in Microsoft 365 (Word, Excel, PowerPoint and SharePoint/OneDrive) ensuring institutional data is handled with the appropriate level of security.

Before You Start

Summary of classification levels

🔒 Confidential - Highest security.
Data regulated by law, contract, or policy that requires strict controls. Unauthorized disclosure could cause legal, financial, or identity‑theft harm. (SSNs, bank account numbers, health records, driver’s license numbers)

🛡️ Sensitive
Internal data with reputational, operational, or privacy risk. (Grades, G‑numbers, performance evaluations)

📁 General - default label
Internal college information not intended for public release but not regulated. (Syllabi, meeting agendas, internal procedures)

📢 Public
Approved information intended for external audiences. (Press releases, recruitment materials, published research)

Not sure which to use? Start with General and check the [full policy matrix] for details.

Quick Reference Decision Helper

Regulated data? → 🔒Confidential.
Not regulated, but would be damaging if leaked? → 🛡️ Sensitive.
Internal but routine? → 📁General (Default).
Meant for anyone outside Geneseo? → 📢Public.

Avoid over-labeling! The General label will be sufficient for most files.

1. Open your document in Word, Excel, or PowerPoint

 

You can apply a label to:

  • New or existing documents

  • Files stored in OneDrive

  • Files shared or stored in SharePoint sites

2. Click the Sensitivity button

You’ll find it on the Home menu ribbon or next to the file name in the title bar.

3. Hover over each label to view its definition “hint”

When you hover your mouse over a label (e.g., Public, General, Sensitive, Confidential), Microsoft 365 displays a short description explaining what that classification means.
This helps quickly choose the correct label without leaving the app to lookup the definitions.

4. Select the appropriate label

Once selected, the label:

  • Travels with the file, across devices and services.

  • Applies any pre-programmed protections.

  • Displays in the document banner or next to the file name.

Save the file if prompted. Some protections activate only after saving.

ℹ️ If your file contains easily identified sensitive or confidential data and is not labeled as such, you may receive a pop-up from Microsoft suggesting a different label. You may chose whether or not to accept the suggestion.

5. Changing or removing a label

  • You may upgrade or downgrade labels depending the permissions on the file and/or SharePoint site.

  • If you do not have permission to lower/remove a label, Office will block the action.

  • If you receive a blocked message that you believe to be in error, contact the file or site owner or Ask CIT!

6. Applying or checking labels in SharePoint/OneDrive online

You can label a file without opening it:

  1. Select the file and click the 3 dots next to the file name.

  2. Select Details or Properties near the end of the list of options that appears.

  3. A Properties panel will appear showing the file name, title, and other fields. Choose a label under Sensitivity.

Nesting Labels

Because data sensitivity labels can be applied at various levels, which label takes precedence can be confusing.

Generally label can be assign at a SharePoint document library or to an individual file.

If a document library has a data sensitivity label, SharePoint automatically applies this label to:

  • New files uploaded to the library

  • Existing files edited in the library if they have no label (or a lower‑priority automatically applied label)

When does a document library label override the file’s label?

  • Manually applied labels (any priority) → NOT overridden

  • Automatically applied labels with lower priority → Overridden by library’s default

  • Automatically applied labels with higher priority → NOT overridden

  • Default labels from other libraries (lower priority) → Overridden by the library default

Examples

  • If you upload a file already labeled Confidential, and the library default is General, your file keeps Confidential.

  • If your file is unlabeled or labeled General, and the library default is Sensitive, your file will become Sensitive.

  • Library defaults never downgrade manually chosen labels.

Notes

  • Don’t apply labels if the data in the files does not meet the classification criteria. Correcting labels can be difficult and cause unforeseen complications. For example, sensitivity labels may affect document permissions and ownership, making it more difficult to change access or transfer responsibility for a file later. Ask CIT if you need help changing a file's label or owner.

  • Because Geneseo uses Gmail, labeling features apply only to files and SharePoint sites, not email messages or calendar invites.

  • Some protections vary depending on whether you use desktop, web, or mobile apps.

  • Microsoft’s broader documentation on sensitivity labels:
    https://learn.microsoft.com/microsoft-365/compliance/sensitivity-labels

 

Still Need Help?

Ask CIT! 📞 (585) 245-5588 | 📧 Email | 💬 Chat | 📝 Submit a Request and we'll be happy to assist you.

 

 

Print Article