Step‑by‑Step Implementation

1. Create the Entra ID groups

   Create mail‑enabled security groups (or Microsoft 365 groups) for Label‑Confidential‑Users, Label‑HighConfidential‑Users, and Label‑Finance‑Users. You will use these to (a) publish labels only to people who can apply them, and (b) assign encryption permissions to control who can open labeled content. [3](https://learn.microsoft.com/en-us/purview/create-sensitivity-labels)[14](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels)

   Tip: If you also plan to govern Teams/SharePoint privacy/external sharing with container labels, enable sensitivity labels for Groups & Sites and sync labels to Entra. [15](https://learn.microsoft.com/en-us/entra/identity/users/groups-assign-sensitivity-labels)

   # Enable sensitivity labels for Groups & Sites (if needed)
   # Ref: Assign sensitivity labels to M365 groups (Entra ID)
   Connect-MgGraph -Scopes "Directory.ReadWrite.All"
   # Check and set EnableMIPLabels = True as per docs
   # ...follow steps in Microsoft guidance...
   

   Follow Microsoft Entra guidance to turn on EnableMIPLabels for Groups & Sites and (if applicable) sync labels. [15](https://learn.microsoft.com/en-us/entra/identity/users/groups-assign-sensitivity-labels)

2. Create the five sensitivity labels in Microsoft Purview

   In Purview portal → Solutions → Information Protection → Sensitivity labels → + Create a label. Repeat per label; see detailed settings below. [3](https://learn.microsoft.com/en-us/purview/create-sensitivity-labels)

3. Configure each label

   1) Internal

   • Scope: Items (Files & Emails). No encryption. Add content marking Header, align Right, color Orange, text: Internal. [1](https://learn.microsoft.com/en-us/purview/sensitivity-labels)[5](https://m365admin.handsontek.net/header-and-footer-content-mark-changes-for-microsoft-purview-information-protection-in-word/)
   • Policy goal: Make this the default label for new docs and emails via a label publishing policy. [4](https://learn.microsoft.com/en-us/purview/default-sensitivity-labels-policies)
   • Block external sends (mail or attachments labeled “Internal”):
     1. Preferred: Create a DLP policy for Exchange with condition Content contains sensitivity label → Internal AND Recipient is outside organization → Block and show policy tip. [8](https://learn.microsoft.com/en-us/purview/dlp-sensitivity-label-as-condition)[9](https://learn.microsoft.com/en-us/purview/dlp-exchange-conditions-and-actions)
     2. Optional fallback: A mail flow (transport) rule can block messages to external recipients—with a custom rejection reason to inform users—though it’s broader and not label‑aware. [16](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)[17](https://www.codetwo.com/admins-blog/how-to-prevent-office-365-users-from-sending-emails-outside-organization/)

   2) External

   • Scope: Items (Files & Emails). No encryption. [1](https://learn.microsoft.com/en-us/purview/sensitivity-labels)
   • Content marking: Header, align Right, color Blue, text: Public. [5](https://m365admin.handsontek.net/header-and-footer-content-mark-changes-for-microsoft-purview-information-protection-in-word/)
   • Sending externally: Allowed (no DLP rule for this label). [1](https://learn.microsoft.com/en-us/purview/sensitivity-labels)

   3) Confidential

   • Scope: Items (Files & Emails). Enable Encryption and Assign permissions now to the Label‑Confidential‑Users group (e.g., Viewer/Editor as needed). [14](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels)
   • Content marking: Header, align Right, color Red, text: Confidential. [1](https://learn.microsoft.com/en-us/purview/sensitivity-labels)
   • Who can apply/open: Publish the label only to approved users and use encryption to limit who can open content. [3](https://learn.microsoft.com/en-us/purview/create-sensitivity-labels)[14](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels)

   4) High Confidential

   • Scope: Items (Files & Emails). Enable Encryption; assign permissions to Label‑HighConfidential‑Users. In Encryption → Allow offline access, set to Never so content cannot be opened offline. [14](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels)
   • Content marking: Add two markings—Header (Right) and Footer (Left)—both text High Confidential, color Red. [5](https://m365admin.handsontek.net/header-and-footer-content-mark-changes-for-microsoft-purview-information-protection-in-word/)
   • Email behavior: In the label’s email settings, apply encryption (e.g., “Do Not Forward” equivalent) to ensure protected send. [14](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels)
   • Only on compliant, managed devices:
     1. Create a Conditional Access policy that Requires device to be marked as compliant for SharePoint/OneDrive access. [10](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-device-compliance)
     2. Bind CA to high‑risk sites via Authentication context (assign to sites or container labels). [11](https://learn.microsoft.com/en-us/sharepoint/authentication-context-example)
     3. Optional defense‑in‑depth: Use Endpoint DLP to block copying High Confidential files to USB/unapproved cloud on Windows/macOS. [12](https://learn.microsoft.com/en-us/purview/dlp-configure-endpoint-settings)[13](https://learn.microsoft.com/en-us/purview/endpoint-dlp-learn-about)

   5) Finance

   • Scope: Items (Files & Emails). Enable Encryption; assign permissions to Label‑Finance‑Users. [14](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels)
   • Content marking: Header, align Right, color Gray, text: Finance. [1](https://learn.microsoft.com/en-us/purview/sensitivity-labels)
   • Email behavior: Apply encryption when the label is used on email. [14](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels)
   • Auto‑label Finance content:
     1. Client‑side (Office apps): configure the label to auto‑apply or recommend when patterns match. [6](https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically)
     2. Service‑side: create an Auto‑labeling policy for Exchange/SPO/OneDrive to detect built‑in SITs like Credit Card Number and apply the Finance label automatically. [6](https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically)[7](https://learn.microsoft.com/en-us/purview/sit-defn-credit-card-number)

4. Publish the labels (and make “Internal” the default)

   Create a label publishing policy that includes all five labels for the appropriate audiences. In policy settings, set Default label to Internal for documents and emails so new content starts with the right baseline. [3](https://learn.microsoft.com/en-us/purview/create-sensitivity-labels)[4](https://learn.microsoft.com/en-us/purview/default-sensitivity-labels-policies)

   You can also enforce mandatory labeling or require justification to lower classifications if you want stricter governance. [18](https://www.amdhservicesltd.com/sensitivity-labels-default-mandatory-and-recommended-labels)

5. Create DLP policies to enforce “Internal must not go external”

   In Purview → Data loss prevention → Policies, create a policy for Exchange email with a rule:

   • Conditions: Content contains → Sensitivity label = Internal AND Recipient is outside organization. [8](https://learn.microsoft.com/en-us/purview/dlp-sensitivity-label-as-condition)[9](https://learn.microsoft.com/en-us/purview/dlp-exchange-conditions-and-actions)
   • Actions: Block (reject) and Show policy tip with a user‑friendly explanation. [9](https://learn.microsoft.com/en-us/purview/dlp-exchange-conditions-and-actions)[19](https://learn.microsoft.com/en-us/purview/dlp-policy-reference)

   DLP can also detect sensitivity labels on attachments (Office & PDF) to prevent sending labeled docs externally. [8](https://learn.microsoft.com/en-us/purview/dlp-sensitivity-label-as-condition)[20](https://m365admin.handsontek.net/sensitivity-label-as-a-condition-support-for-pdf-on-exchange-online/)

6. (Optional) Add a transport rule as a safety net

   In Exchange admin center → Mail flow → Rules, add a rule for recipients “outside the organization” → Block the message and include a clear explanation. Use sparingly (it’s not label‑aware but is immediate and effective). [16](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)[17](https://www.codetwo.com/admins-blog/how-to-prevent-office-365-users-from-sending-emails-outside-organization/)

7. Enable SharePoint/OneDrive processing for labeled content

   Turn on Enable sensitivity labels for files in SharePoint and OneDrive so co‑authoring/search/eDiscovery work with encrypted files and so service‑side auto‑labeling can function correctly. [21](https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-onedrive-files)

8. Validate and pilot

   • Test content markings in Office (header/footer placement and styles). [5](https://m365admin.handsontek.net/header-and-footer-content-mark-changes-for-microsoft-purview-information-protection-in-word/)
   • Send test emails externally with “Internal” label (expect block with policy tip/NDR). [8](https://learn.microsoft.com/en-us/purview/dlp-sensitivity-label-as-condition)[9](https://learn.microsoft.com/en-us/purview/dlp-exchange-conditions-and-actions)
   • Open High Confidential docs offline (expect denied). [14](https://learn.microsoft.com/en-us/purview/encryption-sensitivity-labels)
   • Attempt to access High Confidential sites/files from non‑compliant devices (expect CA block). [10](https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-device-compliance)[11](https://learn.microsoft.com/en-us/sharepoint/authentication-context-example)
   • Validate Finance auto‑label on credit card test numbers (Luhn‑valid). [6](https://learn.microsoft.com/en-us/purview/apply-sensitivity-label-automatically)[7](https://learn.microsoft.com/en-us/purview/sit-defn-credit-card-number)