How to set up document classification with Sensitivity labels

This article explains how to set up document classification with Sensitivity labels. 
Sensitivity labels from Microsoft Purview Information Protection (formerly known as Microsoft Information Protection or MIP) let you classify and govern your organization's sensitive information.

In this article the sensitivity is configured for Word, but the same way it can be configured for PowerPoint and Excel.

By default the Sensitivity button on the Office ribbon is disabled:

To enable sensitivity, you need to configure this in the Microsoft Purview compliance portal.

After you've configured the sensitivity labels the button is enabled and the menu will show the available labels:

Find the sensitivity label keys

The first step is to find the unique keys for each sensitivity label. Follow the steps below:

1. Start Word (the default 'Document1' is opened).
2. Select the sensitivity label for which you want to find the key. In the example below the label 'Public' is selected:
   
3. On the File tab in Word, click Info, open the Properties form and select the Custom tab.
4. The Properties field will now show the unique keys for the selected label ('Public'):
   
5. Multiple attributes are shown, but only the attributes with the names MSIP_..._Enabled and MSIP_..._SiteId are mandatory. You need both the name (marked red in the image above) and value (marked green) for the data source.
6. Repeat steps 2-5 for the other labels 'Internal' and 'Secret'. Note that while the values (marked green) are the same for both labels, the names (marked red) are unique for the attributes of each label:
   
   
   

   Important More information about the label metadata can be found on this page from Microsoft. Note that the names (marked red - the screenshots show only part of the name) and values (marked green) in the examples above are unique, so they will have different values in your environment! Note that in the examples above the name values 'InternalLabel' and 'SecretLabel' are shown, while in the example from step 4 it shows 'defa4170-0d19...' instead of e.g. 'PublicLabel'. This is because the field shows the label unique name within the tenant, but it doesn't necessarily correspond to display name.

Creating a data source

The next step is to create a data source that contains the data for all labels. Follow the steps below:

1. Create a data source with the name Classification (or any other name) and add text fields named Enabled_Public, Enabled_Internal, Enabled_Secret, SiteId_Public, SiteId_Internal, and SiteId_Secret (or any other names) to the schema of the data source. The result looks like this:
   
2. Create a data source item with the value '* No label *' in the Name column. Leave the other fields empty.
3. Create a data source item with the values 'Internal' in the Name column, 'true' in the Enabled_Internal column and the site id (in this example '84ab469d-f429-4bc7-11df-223344') in the SiteId_Internal column. Leave the other fields empty.
4. Create a data source item with the values 'Public' in the Name column, 'true' in the Enabled_Public column and the site id (the same as above) in the SiteId_Public column. Leave the other fields empty.
5. Create a data source item with the values 'Secret' in the Name column, 'true' in the Enabled_Secret column and the site id (the same as above) in the SiteId_Secret column. Leave the other fields empty.
   
   The result looks like this:
   

Configure the template

In the template create a dropdown where the user can select a classification and configure the template to save the values as custom document properties.

1. Create a Dropdown form field named 'Classification' (or any other name), make the field required and link it to the Name column of the Classification data source:
   
2. Add the 'Classification' smart field to the template, for example to the footer:
   
3. On the Advanced tab create a Custom Document Property field with the Property Name 'MSIP_Label_defa4170-0d19-1234567_Enabled' (marked red in step 4 of 'Find the sensitivity label keys') and Property Value '{{Form.Classification.Enabled_Public}}' for the 'Public' label. The result looks like this:
   
4. Click Add to document.
5. Create another Custom Document Property field with the Property Name 'MSIP_Label_defa4170-0d19-1234567_SiteId' (marked red in step 4 of 'Find the sensitivity label keys') and Property Value '{{Form.Classification.SiteId_Public}}'.
6. Repeat steps 3-5 for the 'Internal' and 'Secret' labels (use the values marked red in step 6 of 'Find the sensitivity label keys' - note that in the screenshots only part of the name is visible), with these values:
   
   

   	Property Name	Property Value
   Internal	MSIP_Label_0bdd6ad6-f91e-7654321_Enabled	{{Form.Classification.Enabled_Internal}}
   	MSIP_Label_0bdd6ad6-f91e-7654321_SiteId	{{Form.Classification.SiteId_Internal}}
   Secret	MSIP_Label_407ccbdf-cb75-11223344_Enabled	{{Form.Classification.Enabled_Internal}}
   	MSIP_Label_407ccbdf-cb75-11223344_SiteId	{{Form.Classification.SiteId_Secret}}

7. The result looks like this:
   
8. Save the template and upload it to the Admin Center.
9. Now when a user creates a document and for example selects 'Internal' in the dropdown...
   
   
   ...then not only this value will be shown in the footer of the document...
   
   
   ...but it will also be selected in the Sensitivity menu:
   

Limitations

Some labels might not only show the MSIP_... attributes as custom document property (see screenshot in step 4 of 'Find the sensitivity label keys'), but could also show extra attributes like ClassificationWatermarkText, ClassificationWatermarkFontProps or ClassificationWatermarkShapeIds.

• ClassificationWatermarkFontProps: This contains the value for the font color, size and name like  '#000000,10,Calibri'.
• ClassificationWatermarkText: This contains watermark text like 'CONFIDENTIAL FINANCIAL DATA'. This watermark text will only be shown in the document when the label is set to the specific sensitivity via Word (or PowerPoint, Excel), but not when it's set via Templafy. Also the document will only be protected when the specific sensitivity is set via Word (or PowerPoint, Excel), but not when it's set via Templafy:
  
• ClassificationWatermarkShapeIds: This contains a value like '22037a59' or '19385b42'. This field will not work with Templafy as every time unique numbers are generated (and values in a Templafy data source are static).