Working with sensitivity labels

Overview

Microsoft's Purview Information Protection is a centralized data governance service that helps organizations manage and control their data. Sensitivity labels in Microsoft Purview work by applying labels to files and data. Labels allow you to classify and protect your organization's data, while making sure that your productivity and ability to collaborate isn't hindered. Learn more from Microsoft's official documentation: Learn about sensitivity labels.

Briefly, you can use sensitivity labels to:

• Control access to files and folders.
• Define which users and groups have permissions to perform different actions (read, write, modify, share) on said files and folders.

Sensitivity labels in Office Desktop activities

The following packages and activities offer support for sensitivity labels:

Excel:

• Excel Application Scope
• Use Excel File
• Get Excel Sensitivity Label: Retrieve the sensitivity label from the selected Excel workbook.
• Add or Update Excel Sensitivity Label: Add or update a sensitivity label of the selected file.

Word:

• Word Application Scope
• Get Word Sensitivity Label: Retrieve the sensitivity label of the selected document file.
• Add or Update Word Sensitivity Label: Add or update a sensitivity label of the selected file.

Presentations:

• Use PowerPoint Presentation
• Get Powerpoint Sensitivity Label: Retrieve the sensitivity label of the selected presentation file.
• Add or Update Powerpoint Sensitivity Label: Add or update a sensitivity label of the selected file.

You can use the rest of the Office Desktop activities to work with files that have sensitivity labels applied only if you set up the correct permissions. For example, you can retrieve files with a Confidential HR sensitivity label using the Get Cell or Get Table Range activity if your user account, the one running the automation, has the permission to read files labeled Confidential HR. If the connection doesn't have access to read or write a file, an exception is thrown.

Sensitivity labels in Microsoft 365 activities

The Microsoft 365 activity package offers support for custom sensitivity labels with two activities:

• Get Sensitivity Labels: Retrieve a file's sensitivity labels. This allows you to check if you can work with a file or not.
• Assign Sensitivity Label: Assign a sensitivity label to a specified file. Make sure you have the right permissions to work with the respective labels.

You can use the rest of Microsoft 365 activities to work with files that have sensitivity labels applied only if you set up the correct permissions. For example, you can retrieve files with a Confidential HR sensitivity label using the Get File or Folder activity if the user or service account running the automation (the one for which the connection is made) has the permission to read files labeled Confidential HR. If the connection doesn't have access to read or write a file, an exception is thrown.

Working with labels

Your organization's admin is responsible with defining and configuring labels. Each label has a different set of permissions, which range from least restrictive to the most restrictive. You can learn more about this process from Create and configure sensitivity labels.

Note: Assign Sensitivity Label works with label IDs. Contact your administrator to get the list of IDs for the sensitivity labels used across your organization.

Limitations

• The Microsoft Graph API and Outlook COM (Outlook desktop app) do not support adding a sensitivity label to an email when using the Send Email activity. As a workaround, set up an auto-labeling organization policy to apply a label by default to all emails. Also, reading the sensitivity labels from an email is not supported.
• The Microsoft Graph API does not support adding a sensitivity label to a new workbook when using the Create Workbook activity. You must first create the workbook, then use the Assign Sensitivity Label activity to add a label.
• A COM error occurs for the Excel, Word, and Presentations packages when an automation attempts to update a file without a required sensitivity label, as mandated by company policy.