Articles in this section

See more

How to set up document classification with Sensitivity labels

Updated
Follow

About this article

This article will explain how to set up document classification with Sensitivity labels.

Sensitivity labels from Microsoft Purview Information Protection (formerly known as Microsoft Information Protection or MIP) let you classify and govern your organization's sensitive information.

In this article the sensitivity is configured for Word, but the same way it can be configured for PowerPoint and Excel.

 

Prerequisites

 

 

Creating and configuring sensitivity labels

By default the 'Sensitivity' button on the Office ribbon is disabled:

wd_sensitivitydisabled.png

 

To enable sensitivity, you need to configure this in the Microsoft Purview compliance portal.

 
  • Creating and configuring sensitivity labels and their policies in the Microsoft Purview compliance portal is beyond this help article. Information about this can be found on this page from Microsoft.

 

After you've configured the sensitivity labels the button is enabled and the menu will show the available labels:

wd_sensitivityenabled.png

 

Configuration in Templafy

 

Find the sensitivity label keys

The first step is to find the unique keys for each sensitivity label. Follow the steps below:

  1. Start Word (the default 'Document1' is opened).

  2. Select the sensitivity label for which you want to find the key. In the example below the label 'Public' is selected:

    wd_sensitivitypublic.png

  3. On the File tab in Word, click Info, open the Properties form and select the Custom tab.

  4. The Properties field will now show the unique keys for the selected label ('Public'):

    wd_propertiesmsiplabel.png

  5. Multiple attributes are shown, but only the attributes with the names MSIP_..._Enabled and MSIP_..._SiteId are mandatory. You need both the name (marked red in the image above) and value (marked green) for the data source.

  6. Repeat steps 2-5 for the other labels 'Internal' and 'Secret'. Note that while the values (marked green) are the same for both labels, the names (marked red) are unique for the attributes of each label:

    wd_propertiesmsiplabels.png

     

     
    • More information about the label metadata can be found on this page from Microsoft.
    • Note that the names (marked red - the screenshots show only part of the name) and values (marked green) in the examples above are unique, so they will have different values in your environment!
    • Note that in the examples above the name values 'InternalLabel' and 'SecretLabel' are shown, while in the example from step 4 it shows 'defa4170-0d19...' instead of e.g. 'PublicLabel'. This is because the field shows the label unique name within the tenant, but it doesn't necessarily correspond to display name.

 

Creating a data source

The next step is to create a data source that contains the data for all labels. Follow the steps below:

  1. Create a data source with the name 'Classification' (or any other name) and add text fields named Enabled_Public, Enabled_Internal, Enabled_Secret, SiteId_Public, SiteId_Internal and SiteId_Secret (or any other names) to the schema of the data source. The result looks like this:

    wd_classificationschema.png

  2. Create a data source item with the value '* No label *' in the Name column. Leave the other fields empty.

  3. Create a data source item with the values 'Internal' in the Name column, 'true' in the Enabled_Internal column and the site id (in this example '84ab469d-f429-4bc7-11df-223344') in the SiteId_Internal column. Leave the other fields empty.

  4. Create a data source item with the values 'Public' in the Name column, 'true' in the Enabled_Public column and the site id (the same as above) in the SiteId_Public column. Leave the other fields empty.

  5. Create a data source item with the values 'Secret' in the Name column, 'true' in the Enabled_Secret column and the site id (the same as above) in the SiteId_Secret column. Leave the other fields empty.

    The result looks like this:

    wd_classificationdatasource.png

Configure the template

In the template create a dropdown where the user can select a classification and configure the template to save the values as custom document properties.

  1. Create a Dropdown form field named 'Classification' (or any other name), make the field required and link it to the Name column of the 'Classification' data source:

    wd_dropdownclassification.png

  2. Add the 'Classification' smart field to the template, for example to the footer:

    wd_classificationfooter.png

  3. On the Advanced tab create a Custom Document Property field with the Property Name 'MSIP_Label_defa4170-0d19-1234567_Enabled' (marked red in step 4) and Property Value '{{Form.Classification.Enabled_Public}}' for the 'Public' label. The result looks like this:

    wd_customdocumentproperty.png

  4. Click Add to document.

  5. Create another Custom Document Property field with the Property Name 'MSIP_Label_defa4170-0d19-1234567_SiteId' (marked red in step 4) and Property Value '{{Form.Classification.SiteId_Public}}'.

  6. Repeat steps 14-16 for the 'Internal' and 'Secret' labels (use the values marked red in step 6 - note that in the screenshots only part of the name is visible), with these values:

    - Internal: Property Name 'MSIP_Label_0bdd6ad6-f91e-7654321_Enabled' and Property Value '{{Form.Classification.Enabled_Internal}}'.
    - Internal: Property Name 'MSIP_Label_0bdd6ad6-f91e-7654321_SiteId' and Property Value '{{Form.Classification.SiteId_Internal}}'.

    - Secret: Property Name 'MSIP_Label_407ccbdf-cb75-11223344_Enabled' and Property Value '{{Form.Classification.Enabled_Secret}}'.
    - Secret: Property Name 'MSIP_Label_407ccbdf-cb75-11223344_SiteId' and Property Value '{{Form.Classification.SiteId_Secret}}'.

  7. The result looks like this:

    wd_customdocumentproperties.png

  8. Save the template and upload it to the Admin Center.

  9. Now when a user creates a document and for example selects 'Internal' in the dropdown...

    wd_classificationdropdown.png

    ...then not only this value will be shown in the footer of the document...

    wd_classificationinternal.png

    ...but it will also be selected in the Sensitivity menu:

    wd_sensitivityinternal.png

 

 
  • Templafy can be used to set the sensitivity of the document (so when a classification is selected in the dropdown in Templafy, this option will also be set in the Sensitivity menu in the Office ribbon above), but note that the other way around is not supported: if you select an option in the Sensitivity menu, this does not set that option in the dropdown.

 

Limitations

Some labels might not only show the MSIP_... attributes as custom document property (see screenshot in step 4), but could also show extra attributes like ClassificationWatermarkText, ClassificationWatermarkFontProps or ClassificationWatermarkShapeIds.

  • ClassificationWatermarkFontProps: This contains the value for the font color, size and name like  '#000000,10,Calibri'.
  • ClassificationWatermarkText: This contains watermark text like 'CONFIDENTIAL FINANCIAL DATA'. This watermark text will only be shown in the document when the label is set to the specific sensitivity via Word (or PowerPoint, Excel), but not when it's set via Templafy. Also the document will only be protected when the specific sensitivity is set via Word (or PowerPoint, Excel), but not when it's set via Templafy:

    wd_protectdocument.png

  • ClassificationWatermarkShapeIds: This contains a value like '22037a59' or '19385b42'. This field will not work with Templafy as every time unique numbers are generated (and values in a Templafy data source are static).

 

Related articles

 

 

Related articles

Comments

0 comments

Article is closed for comments.