Microsoft Purview Sensitivity Labeling

0:00Sensitivity labels keep your content safe by making sure only the right people

0:05in your organization can edit it and also that you're following company

0:09policies and regulations.

0:11We're talking about content here.

0:14We're talking about teams.

0:16Our meetings.

0:19Along with chats files and emails.

0:27Let's say you and I work for an organization called would you ink.

0:31They say we have data throughout our infrastructure.

0:36They have to do a product launch announcements.

0:38Or maybe quarter to sales performance reports.

0:41Or customer contracts and pricing agreements.

0:45So many data here could be critical and very important and should be kept

0:49confidential.

0:51And sensitivity labels can help us accomplish this.

0:56So let's say we had these labels.

0:58We have public internal and also confidential.

1:01Let's say this data here.

1:04The product launch announcements.

1:06Is public information and available on our websites for anyone can get to it.

1:11Or in other words, there are no secrets here.

1:14So we could sign a public label to that data.

1:17Now our quarter to sales performance reports is a different story.

1:23Customers or the public should never see that.

1:26So maybe we assign that data a label of internal.

1:30Then we have customer contracts and pricing agreements.

1:34Which you can imagine should be kept confidential and away from prime ice.

1:39So maybe we assign this type of data a confidential label.

1:43So here any users there are assigned this internal label.

1:48We'll have the ability to see that sales performance report.

1:52Maybe your leadership team has access to that confidential label.

1:57And therefore they will be the only ones that would see that customer contract

2:01or pricing agreements data.

2:03So again, we're keeping our content safe by ensuring that only certain people

2:08can access certain data.

2:10So why are sensitivity labels important?

2:15We saw in a previous scenario they protect sensitive data.

2:20So we have the ability to apply encryption, apply watermarking,

2:25along with restriction actions by preventing the copying of any sensitive data.

2:30Sensitivity labels also ensure that any sensitive information is handled

2:36accordingly to any internal policies or regulations.

2:39We also can regulate or have control of access.

2:43So here we can control who can access the label content or maybe participate in

2:48label beings.

2:50These labels also provide visual indicators.

2:53So the user can see the label applied.

2:55So in the event that they see confidential, it allows that user to understand

3:00the sensitivity of the information they're handling.

3:04Our focus is Microsoft Teams.

3:09Sensitivity labels can be applied using several different key areas of the

3:13Microsoft environment for just focusing on teams.

3:17One of them being a team itself.

3:19So here we can control who can access all the content within that team.

3:24We can also use these labels to protect our meetings.

3:27We can't protect our meeting invites, along with the team's meetings and chat.

3:34Our sensitivity labels can also be used within SharePoint sites and also One

3:39Drive accounts.

3:42So for our users, any files that are shared in private chats are stored within

3:51OneDrive.

3:53Any files shared in a team channel are stored within SharePoint.

4:02So we can definitely use sensitivity labels to protect the data in both One

4:08Drive and also SharePoint.

4:11They can also be used in meeting templates.

4:13So a meeting template is a bunch of settings that are pre-configured for a

4:17meeting that user could use.

4:19So let's say this was our template here.

4:22Maybe this template has a sensitivity label of internal.

4:27When a user creates a meeting with this template, the label of internal is

4:32automatically applied to that meeting.

4:35And finally we can use sensitivity labels to encrypt our voicemail messages.

4:41Now the creation of these sensitivity labels is done through Microsoft PerView.

4:45So here we go on the solutions and on the solutions, the option that we want to

4:50go with is this information protection.

4:53Then we should see an option to create this sensitivity label.

4:58You and I would definitely do that in a future video.

5:03In order for the user's environment to be able to use these sensitivity labels,

5:07our first step is to create these labels.

5:10But then labels must be published via label policies to those users.

5:17To those users that will be using these labels.

5:20You also see documentation that these labels can be applied manually or

5:25automatically.

5:28So manually a user will select and apply and label themselves.

5:36So automatically as you would assume the user is not doing this, policies are

5:42used to determine if that data should be labeled or not based on certain

5:47criteria.

5:48As usual there is licensing involved.

5:53Let's go to a document here and now we show this link below this video.

5:57We have a section here, let me expand our table so it's easy to see.

6:03So we can see the licenses that are needed in order to enable manual

6:07sensitivity labeling.

6:09If we go back to our document here we see other licenses that are required for

6:12certain features.

6:14Like for schedule meetings, if we scroll down a bit, for team online meetings.

6:22And that's what I look for, the automatic sensitivity labeling.

6:26We can see that the license requirement is different for the automatic

6:30sensitivity labeling.

6:32So in this video we discuss sensitivity labels along with the functionality

6:36within Microsoft Teams, along with the licensing requirements.

6:41In the following video you and I will go to the creation of a sensitivity label

6:45.

6:45[BLANK_AUDIO]

0:00All right, next we'll go to the creation of a sensitivity label with the

0:03Microsoft purview.

0:04All right, here we go on the solutions.

0:07We'll go to information protection and we go on the sensitivity labels.

0:14All right, we see some here.

0:20The super top secret one is one that was playing with offline.

0:23So what we're going to do is create a label.

0:26We'll call this internal use only.

0:28We'll also give that the name or display name of the label.

0:32So name is what the admin will see in the admin portal.

0:37And display name is the name that your users will see.

0:40All right, so let's scroll down a bit.

0:44We see for label priority, there by default, this label of internal use only

0:49will have the

0:50highest priority.

0:52This comes into play for us.

0:53We have multiple sensitivity labels that could apply to a document or an email,

0:58for example.

1:00So here we can put a description for users.

1:02So I'll put that there so we can see what it says there.

1:06And for the demo, I'll do the same for admins.

1:08And I'll give it a color, that one there.

1:12And at this point, we're nuts.

1:17So next we have to define our scope.

1:19We'll determine both the settings that we can configure for a label and also

1:27where that

1:27label will be available to what apps and services.

1:31We see here that labels can be applied to data assets and also containers.

1:35And to explain what a container is, I have this slide.

1:40So Microsoft Teams, a team is treated as a container.

1:45So when you and I apply a sensitivity label to a team, we're setting the

1:49security and

1:50compliance controls for the entire team container, imagine individual measures

1:55or files.

1:56So meaning that our container includes items like the team itself, channel

2:01chats and posts,

2:02the associated SharePoint sites, those files stored in those team channels.

2:07And also the associated Microsoft 365 group, which really gives us the group

2:11membership

2:12to that team.

2:15So our data can be applied to files along with other data assets.

2:19So here we're talking about the files within the office applications, word,

2:23cell, PowerPoint,

2:24along with other Microsoft services.

2:27Our labels can also apply to emails.

2:29And our labels can also be applied to meetings.

2:32We also can apply labels to groups and sites.

2:36Now in your environment, this may be grayed out.

2:39And that would be because we have enabled sensitivity labels for containers.

2:44In the following video, we'll go over how we can enable sensitivity labels.

2:48So therefore groups and sites is an option for you.

2:52All right.

2:53So we'll go ahead and choose nuts.

2:55So here we can configure our protection settings.

2:58So one being control access.

3:00This setting is really for emails or media invites or documents.

3:04So here we're trying to prevent someone or really unauthorized people from

3:08accessing the

3:09data that has this label.

3:12We also have the ability to apply content marking.

3:15So here we can add watermarks, headers, or footers to content for our users

3:19when they're

3:20using the office applications.

3:23We also have protect team meetings and chats.

3:26So here we're going to label parent events team meeting options along with team

3:30chat.

3:31All right.

3:32We choose nuts.

3:33So let's be configured access control settings, which really allows us to

3:37enable you and I

3:38to define who can access these items.

3:40It does have this label assigned to it.

3:42And also what they can do with the content.

3:44So we have two options here.

3:46I SDM can assign the permission right now.

3:49So I know who exactly can access the content and what permissions they have

3:54when these labels

3:55apply.

3:56We also have the option to let the user decide.

3:59So whoever applies this label at that time can specify the access.

4:03Therefore, given that user that option and that's a baby.

4:07Or for now we'll keep the assigned permissions now.

4:10So here we can set a time limit for how long users can access the content.

4:15But never as you would assume did not expire.

4:17We can specify a certain date or a number of days after the labels apply.

4:23We also have allow offline access.

4:25So here folks will be able to open these files or content, even if their device

4:30is offline.

4:31I can choose never here requiring that user to be online to access that content

4:37.

4:37Or we can choose only for number of days.

4:39You would choose always.

4:44So next we'll assign permissions.

4:46So here we're going to specify what individuals or groups and the permissions

4:50they have.

4:51So here these users or groups are the folks that can open, edit content.

4:56It's a sign is labeled.

4:58From our demo, I'll pick two users.

5:00So I choose add users or groups.

5:04What I'm going to do is choose Pedro.

5:12We'll choose add.

5:13Let me add someone else.

5:15I'll pick Sierra.

5:18Choose add there.

5:19So this point I have two users.

5:24Also have the ability to modify their permissions.

5:28But you save.

5:32You can see those combinations of permissions is co-author.

5:35You also have the option to use dynamic watermarking.

5:39So what this would do is add the user's name to document as a watermark.

5:45So therefore discouraging any leaks or unauthorized sharing of that data.

5:51We also have double key encryption.

5:53So here we're adding an extra layer of encryption by requiring two keys to

5:58access that content.

5:59So one key is held by Microsoft and the other key is held by your organization.

6:04But for now I choose next.

6:06Now here we have different settings we can apply using a sensitivity label.

6:12Now you may already know what these settings do when we go over them later when

6:15we go through

6:16meeting posse.

6:18But for a demo I'm going to choose one.

6:20Just prevent copying and forwarding or meeting content.

6:23So we see here the participants will not be able to copy for meeting chat

6:27messages, links,

6:28live captions, transcripts or the content.

6:30All right.

6:32So we choose next here.

6:34We have the option to all the label files and emails but we'll skip that for

6:37now.

6:38We choose next.

6:39Here we have other protection settings.

6:41We have privacy and external user access.

6:45So here we can control if a team or group is public, meaning anyone can join or

6:49private.

6:50So let's go ahead and choose that one.

6:52We also have external sharing and conditional access.

6:57So here we can control labeled SharePoint sites or teams allow sharing with

7:01users outside

7:02of the organization.

7:03Then we have private teams discover ability and share content settings.

7:09Here we can do things like control if private teams are visible in search

7:12results.

7:13We choose next here.

7:15Now notice wherever options you choose here will influence what you'll see

7:20beneath here

7:21underneath groups and sites.

7:23So if I choose next here we see our options.

7:27So here for privacy we'll go ahead and mark the team as private.

7:32Let's look at external user access.

7:35Here we can allow group owners to add people outside of the organization.

7:39I'll leave that in check for now.

7:41We'll choose next.

7:43We'll go ahead and check this box.

7:44Therefore not allowing users to discover any private teams that have this label

7:52applied.

7:53And here we can control which type of teams can be invited into shared channels

7:57when using

7:57sensitive labels.

7:58So we have internal only to have our block and any external team.

8:04After those outside the organization for being invited to a shared channel.

8:07We also have same label only means the only team that have the same sensitivity

8:12label can

8:13be invited to a shared channel and also private teams.

8:17This blocks any public teams from being invited to a shared channel meaning

8:21only private teams

8:22can be used.

8:23All right for now we'll go ahead and choose internal only.

8:27We'll choose next.

8:28And at this point we'll go ahead and create our label.

8:31All right so we see this currently submitting.

8:37So we see here there are sensitive labels was created.

8:41In order for the sensitivity label to be used by users we have to publish these

8:46labels.

8:47So we definitely will do this later.

8:49For now I'll choose the uncreated policy yet and then we'll hit done.

8:53So now we'll scroll down a bit you see a new label called internal use only.

9:01So we notice here that we have a priority column.

9:04A priority is a time breaker.

9:09In the event we have two more labels that apply to the same object at the same

9:13time.

9:14So here the lower the number means a higher priority.

9:24In this section you now enter the creation of sensitivity labels.

9:28In the following video I want to go over what you need to do in the event that

9:31your groups

9:32and flights option that we saw earlier is grayed out.

9:35[BLANK_AUDIO]

0:00In this video, we'll talk about why the option groups and sites would not be

0:03available when

0:04you're creating a sensitivity label.

0:06Let's get started in 11.

0:08Previously, when you and I went to the creation of a sensitivity label, we have

0:12mentioned

0:13that this option here may be grayed out.

0:15There being groups and sites.

0:17We have a note here.

0:20To apply sensitivity labels to teams, SharePoint sites, and Microsoft 365

0:24groups, you must

0:25complete these steps.

0:28These steps allow us to enable sensitivity labels for containers.

0:34Therefore allowing us to apply security settings at the team level.

0:39Remember, a team is treated as a container.

0:43So our container includes the team itself, for a channel and post, the

0:48associated SharePoint

0:49site with that team, to the file stored in that team, and also the underlying

0:53group

0:53membership, which is the Microsoft 365 group.

0:58You may also see this message here when we go to sensitivity labels with the

1:02Microsoft

1:02Preview, at the same message you and I saw in the previous step.

1:07So again, you may or may not see this message.

1:09But after we complete the steps that we're about to go through, what should

1:13happen is

1:14that you should no longer see that message in groups and sites should then be

1:17available.

1:18All right, so let's go here.

1:21All right, so the document that Microsoft takes you to is this one right here.

1:26So we choose this.

1:28So go ahead and click on here how to enable sensitivity labels for containers

1:31and synchronize

1:32labels.

1:34So we can see here all this is a one time procedure.

1:39So keep in mind someone before you might have done this already.

1:42So we have our first link here that will open up a new tab.

1:46And the first thing that we have to do is to enable sensitivity labels support

1:51with the

1:52Empire shell.

1:53So let's go to step number one here.

1:55If we haven't done so already, the first thing that we have to do is install

1:59the graph

1:59modules in order to run the command list in this documentation.

2:04Now Microsoft Graph is the API or an application programming interface from

2:12Microsoft that

2:13allows us to access data across different Microsoft 365 services.

2:19The Microsoft Graph connects to different services like Android E, Outlook,

2:23Teams, SharePoint,

2:24OneDrive.

2:26So here the first command installs the stable version of the Microsoft Graph

2:31module.

2:32And the second command here where it does versions install the beta version of

2:36the graph

2:37module, which we have newer experimental command letter features.

2:42All right, next we're going to connect to our tenant.

2:45Sorry about that.

2:47My pen jumped.

2:49Here we are connecting our session to Microsoft Graph.

2:53Then here we are requesting permission to read and write directory data like

2:58for example,

2:59users, groups.

3:01Also keep in mind here, you may be prompted to be authenticated.

3:05Now here for number three, we're going to fetch the current group settings to

3:09the Microsoft

3:10Entra organization and also display the current group settings.

3:14You can see here that we're creating a variable.

3:17We are retrieving directory settings.

3:19Let me scroll to the right here.

3:22We want to filter the output here to finally setting that has a property name,

3:27enable,

3:27and my P labels.

3:29This setting if true, sensitivity labels can be applied to Teams, groups, and

3:35SharePoint

3:35sites.

3:36Once, the sensitivity labels cannot be applied.

3:40We will see that when we run this command here, which is place the actual

3:44values of those

3:45settings.

3:46All right, I should run down a bit more.

3:51Now in the event, then no group settings were created for your organization,

3:57then you will

3:57get an empty screen.

3:58If that's the case, you didn't have to create those settings.

4:02So I just browse to this URL to see exactly how it's done.

4:07All right, so we'll scroll down a bit.

4:11We can see here, we have to install those same modules that we saw before.

4:14Then we'll go to this section, create settings at the directory level.

4:19This command will fetch or retrieve all available templates that define

4:24settings that we can

4:25apply at the directory level.

4:29Everything that we want to see the template, they are available that we can use

4:32to configure

4:33settings within the Microsoft 365 environment.

4:36If we scroll down here, we see the expectation of what we should see.

4:45Let me show you what happened to me.

4:47So you can see here, I ran that command, but unfortunately it did not give me

4:56the display

4:56name, as we can see right here.

5:02This could be because new versions of the graph beta module may have changed

5:06the output

5:06formatting, but no big deal because you can add this to the command format

5:13table with

5:14ID display name and description.

5:17And now we see we have the same information as we saw in our document.

5:21This group that unified is our settings template used to control Microsoft 365

5:27groups across

5:28our entire directory.

5:30These Microsoft 365 groups are used behind a curtain for Microsoft Teams, for

5:35all of

5:35the group mailboxes, for SharePoint team sites, and that's the reason these

5:38templates

5:39use.

5:40All right, going down further, in this first line, what we're doing is finding

5:48the ID

5:49of that group unified template.

5:53Then here in our second line, we're getting the full template details by using

6:00that ID.

6:01So here, this variable is going to hold the ID that was found in the previous

6:08step.

6:08And here we see a screenshot of where I executed those same commands previously

6:12in my environment.

6:14All right, going down further.

6:17Here, we're creating a object that contains values to be used for that

6:22directory setting.

6:23What this is doing is creating a PowerShell hash table that is storing

6:28different parameters

6:30like the usage URL we see here.

6:32And also that parameter enable MIP labels.

6:35We're also going to set that to true.

6:37Therefore, enabling those system TIPD labels for Microsoft Teams and SharePoint

6:41sites.

6:42And further down, we're creating our directory setting.

6:47So here we're creating a new directory setting using the object params that we

6:53saw earlier.

6:55So once again, we have our template ID, which has the ID of that group that

7:01unified template

7:03in our organization.

7:04Then we have our two settings that we want to apply.

7:07All right, so I'm going to show you a screenshot.

7:11This is where I create that object.

7:13Now here, we're seeing the ID of the new setting that we just created.

7:18And also the template ID that was used to create that setting.

7:23So we can see here the template ends with three zero four B.

7:27And if I go to a previous slide, we can see the same ID here associated with

7:34that group

7:35that unified template.

7:40And next we want to read those values using these commands here.

7:45So in our first line, we're creating a variable.

7:48We are retrieving other current directory settings.

7:52But we want to filter the output with the display name is equal to group that

7:58unified.

7:58Then we want to see the values with those settings.

8:03And the output should look something like this.

8:06So we can see enable MIP labels.

8:08It's set to true.

8:09And we also have our uses guidelines URL fit to the URL that we defined earlier

8:16.

8:16So again, you may or may not have to perform these steps in the event going

8:20back to our

8:20original document.

8:22You ran this command, let it instead of getting output, you receive an empty

8:26screen.

8:27All right, going back to our first document that we looked at.

8:31But this points that one is complete.

8:33So next we have to synchronize our sensitivity labels to Microsoft inch righty.

8:39So we're doing a synchronizing these labels.

8:41They're available across different services like Microsoft teams, SharePoint,

8:46exchange,

8:46and also Microsoft intro.

8:48All right, so let's go over to this document to see what that looks like.

8:52All right, so let's go ahead and go step one.

8:55We have to import the module to manage a change of mine.

9:00Now documentation states that this is sending you in to the Microsoft purview

9:06security

9:06compliance center, which is not a Microsoft purview compliance portal.

9:11And I want to enter in our username.

9:13So in fact, let me show you a screenshot here.

9:16So here we see where I import the module is where I am logging into my session.

9:22Then once logged in, step two is not completed.

9:28Now we have to complete step three.

9:30And this command will synchronize our existing sensitivity labels from

9:34Microsoft purview into

9:36Microsoft intro ID.

9:37And we see that command right there.

9:43And doing so after period time, we'll make the group and sites option available

9:48when it

9:48comes to creating a sensitivity label.

9:50So in this video, one to the process of enabling sensitivity labels for our

9:55containers and also

9:56synchronizing those labels.

9:58Keep in mind that this may have been done ready by another member of your team

10:01in the

10:02past.

10:03But when I showed this process in the event that you're doing counter that the

10:06option

10:06is without or maybe you say not your lab environment.

10:08[BLANK_AUDIO]

0:00Next, you now go to the process of publishing our labels so they can be used by

0:04users.

0:05In the earlier video, we went to information protection, and then went to

0:12sensitivity labels,

0:14and we made one called internal use only.

0:17Now here, I can check that label, and I have the option here to publish label,

0:24and we see

0:24here that we're creating a policy. This policy is a label publishing policy.

0:30This policy

0:30defines how and to whom the sensitivity label are published.

0:35I'm going to hit cancel here, because I want to show you if we go to label

0:39publishing

0:40policy and go to publish label, we arrive at the same step here with the

0:45exception, we

0:46have to choose a sensitivity label. So here I can choose that internal use only

0:51, choose

0:52add, and now we're at the same place as we were before.

0:56All right, so here I'm going to do the next. I do have the option to assign

1:00this policy

1:01to an admin unit, if I wish, but it will keep for directory, two nets once

1:05again. So here

1:06I can apply this policy to all users and groups. For my demo, I'll go to edit.

1:11We're going

1:11to change this to specific users and groups. Let me go ahead and add a schedule

1:19here. I

1:20will also add Sierra. All right, we see we have to select it there, which is

1:28done and

1:29done again, which is nets. So we have several options here when it comes to

1:34this policy.

1:36So users must provide justifications to remove a label or lower specification.

1:41So in the

1:41event a user tries to remove a label altogether or replace it with a lower

1:45sensitivity or

1:46lower priority, the user will be prompted to give a reason. You also have

1:51required users

1:52to apply a label to their emails and documents. So here we're forcing that user

1:57once again

1:57to choose a label before they can save their document or send that email. Let's

2:04scroll

2:05down a bit here. We have required user to apply a label to their fabric and

2:09power BI

2:09content. And here we're just ensuring any sensitive data on our data analytics

2:15is protected

2:16just like our documents and emails and chats. The mail set provide users with a

2:20link to

2:21our custom help page. So here we can point to a page the user can go over. They

2:26can learn

2:27how we use labels in our organization. All right, so we choose nets here. We do

2:33have the

2:33ability to apply default label produce policy to different elements of the

2:37Microsoft environment.

2:39But for my demo, I'm going to stick with none. So for documents here, we choose

2:44none. The

2:44emails name is document. We have no inheritance, which is nets. This is for our

2:51meetings. So

2:51we don't have a default label for our meetings and calendar events. So we

2:55choose nets there.

2:56We also keep none for our sites and groups. Also choose nets here. And then we

3:02're going

3:02to name this posse. And we'll name it our lab demo internal use only. All right

3:13, so we

3:14have nets and then we'll submit our policy. As we anything else, we have to

3:22hurry up and

3:23wait. So it says here, it can take up to 24 hours to publish these labels to

3:29the users

3:30that were assigned as policy, which was Pedro and Sierra. So at this point, we

3:34'll go ahead

3:34and wait for his policy to take effect. And we'll jump into Pedro's and Sierra

3:38's desk

3:39tops to see what they can do with their labels.

0:00All right, so in this video, we'll go ahead and go through a demo of our

0:03sensitivity labels in action.

0:04So in this scale, we did two things. One, create a sensitivity label, and then

0:12two, publish that

0:13label to users and groups. Before we jump into our demo, I want to point out

0:17two additional items.

0:18We'll go to solutions, back to information protection, and go to sensitivity

0:24labels.

0:27Here we go to our label that we created, and I'll choose edit here.

0:30So we choose nets here, nets again, one more time. I want to talk more about

0:38this section right here.

0:39This step here, we find what the label does. We'll write to these users have,

0:46or groups, when the

0:47label is applied to this content. So in this scenario, president's hero, have

0:52been applied,

0:52we call author permission. So this means any data that's labeled with this

0:57sensitivity label,

0:58these two users, Pedro and Sarah, we have co-authoring access. So we can think

1:04of this of who can do

1:05what when content is labeled with this sensitivity label. All right, so let's

1:10go cancel here.

1:11Let's go policies and to label publishing policies. So we choose the one that

1:18we created in the

1:19previous video, we'll go to edit policy. So here we have another section,

1:26here we go to edit here, we specify Sierra and Pedro. So this step here in our

1:35policy

1:36really defines who can see and apply the label in their Microsoft applications.

1:42So once again, Sierra and Pedro in my demo, I've debated to choose this label

1:49within their applications.

1:50So you can think of this as who has access to use this label within the apps.

1:55So I simply wanted to highlight the differences when it comes to assigning

2:00permissions within a

2:02sensitivity label versus assigning users to our label publishing policy. All

2:08right, so let's go to

2:10Sierra here, let's go toward the stop. When open up teams for like so, we'll go

2:16to calendar.

2:17Now here I'm going to create a new event like so.

2:23Let's go ahead and add a title here. So in our scenario, department reorgan

2:31ization.

2:33Now here I'm going to invite Thomas. Now also I'm going to invite Pedro.

2:40Now notice here I do have the option to apply a sensitivity label.

2:46So here we have internal use only and that's the one you and I created

2:52previously in the skill.

2:53And notice the description we see on left, going back to that sensitivity label

2:58,

2:59let me cancel here and go to sensitivity label, let's put that label of

3:04internal use only,

3:06I'll choose edit. Here we go down to description for users. This is what we see

3:14here. And that's

3:15what we also see for Sierra. We see our description right there. Now remember

3:23that this sensitivity

3:24label has a setting applied to it, which we'll see right here. So here we're

3:30preventing the

3:31copying and forwarding of mini content. Any participants in a meeting with this

3:36label will not be able

3:37to copy a four meeting chat messages, links, live captions or transcripts. So

3:43going back to Sierra.

3:44So here I'm going to change this to internal use only like so. So you can see

3:51our sensitivity

3:52label right there. So at this point I had sent. So now a little Thomas, we'll

3:59go to his teams,

4:00go to calendar,

4:03and then do the same for Pedro. All right, so we see our meeting there. So here

4:12I'm going to have Sierra

4:13start that meeting. So we should join. All right, so we have Pedro join also.

4:20Then we have Thomas join also. All right, so we see the all three folks are in

4:28that meeting.

4:28Let's say Sierra post a message.

4:31That message is being removing the HR department to Texas in September.

4:43So Thomas here, let me see that message.

4:45And say that's pretty juicy. Let me go ahead and copy this like so.

4:51And notice we have a message here due to policy. You can copy meeting chats.

4:57What happens to Pedro

4:58if he does the same thing with the right click copy and the same applies to him

5:07.

5:07But he's in being this meeting was created with that sensitivity label internal

5:12use only.

5:12And that was a setting that we set here when we created that sensitivity label.

5:18So imagine if you will, the different settings that we can apply to this label,

5:23which is later

5:23enforced with someone creates a meeting with this sensitive label. All right,

5:29going back to Sierra

5:30here, let's say she ends that meeting. All right, so that meeting is ended for

5:35everyone. So if I go

5:37back into her meeting. So we see information about the meeting invite, if we go

5:46to chat.

5:47We see a chat that we saw earlier. So if I do a right click here and copy,

5:54notice the same thing applies. So let's go Thomas, let's go back to our meeting

5:59.

6:02Notice here that Thomas cannot see the information because his meeting invite

6:08is protected by that

6:09sensitivity label. And Thomas is not assigned that internal use only label. In

6:15fact, if I try to go

6:16to chat here, the same thing should apply. If I go to copy, I do have the

6:21restriction there.

6:23Let's go back to Sierra. Let's say she wanted to create a new team. Should we

6:29go to chat?

6:32Then here, I can create a new team. So new team. So notice I can create a new

6:39team here. We'll call

6:41it reorg. So let's say wanted this to be public. And I tried to apply the

6:48sensitivity label

6:49of internal use only, nor is the public is grayed out. But only option here is

6:55private.

6:58And that's because going back to our sensitivity label, if I go nuts.

7:03Here, we say an option that the sensitivity label when used will always be set

7:12to private.

7:12So here are only team owners and members can access a group or a team. And only

7:17team owners

7:18can add additional members. So that's the reason that we're seeing this right

7:22here.

7:22All right, so we won't create that team there. So here we see the behavior that

7:28our user

7:28would expect in the event that a sensitivity label is applied to our team's

7:32meaning

7:32or during the creation of a team. But let me show you other scenarios where

7:36that sensitivity

7:37label will come into play. So let's say that Sierra creates a word document

7:42like so.

7:43So we're going to pay some content here. So imagine if you will, this was

7:50intended to be

7:51only seen by internal folks. So here the intention is not to have this document

7:56shared outside of

7:58the organization. All right, so I can do here is add a sensitivity label of

8:03internal use only.

8:04So we should see it updated right there. And I'm going to save this. So we do a

8:09save as.

8:10We also see descriptions here of this label. Let's go ahead and save this

8:16on my desktop for now. We'll call this project revamp like so. We'll hit save.

8:27So let's go teams here. Now I'm going to pick this sales department.

8:31Let me verify that the other users are indeed part of these teams.

8:36And we see everyone is a member here. So going back to our general chat. So let

8:45's say

8:46I posted that file. Do we just created? All right, we're going to add, attach a

8:52file,

8:54upload from this device. We'll go to desktop and there's our file right there.

9:02We're going to go ahead and hit post. Remember now that Pedro and Sierra are

9:07the only two users

9:08that have access to that sensitivity label. So if I go to Pedro.

9:13So general chat, I see the document there. Let me attempt to open it to see

9:22what happens.

9:22And notice Pedro can definitely read that file. Why? Because he also has access

9:31to that sensitivity

9:33label. Let's pick someone else. Let's pick me, for example. Let's go to teams.

9:40We'll go to channels.

9:41General chat. What happens if I were to open this file?

9:49Notice I get this message here. I don't have permission to open this document.

9:53Why? Because I don't have

9:54access to that sensitivity label. All right, so let's also try email. Let's do

10:00Pedro this time.

10:01We'll go to email. We'll go to new email.

10:07Let's go and copy Thomas along with Pedro. Let the body and subject be super

10:18secret stuff.

10:19We'll copy that and put that as subject. But this time we're going to change

10:24this to internal

10:26use only. So we hit send. All right, so let's go to Sierra and wait for that

10:32email.

10:33While you're not waiting for that, let's go to Thomas and do the same. Let's go

10:38to his email.

10:39All right, so we see that email right there.

10:46Right, try to open it. So we see here, Pedro sent a protected message. So if I

10:54try to read that message,

10:56like so. So we see the message that I, being Thomas, do not have sufficient

11:05permissions to

11:06open that mail. Why? Because I do not have the sensitivity label required to

11:11read that email.

11:12If I go to Pedro and where I click on the email there, Pedro can definitely see

11:18the contents

11:18on that email because he does have that sensitivity label. And there we go. We

11:22saw a few examples of

11:23these sensitivity labels being used in Microsoft Teams and also in office

11:27applications, including

11:29Word and Outlook.

11:30[BLANK_AUDIO]

0:00For example, once again, I'm making it to the end of the skill.

0:02As always, we go through a bad asinception,

0:04where we have received some questions, but we're testing your knowledge.

0:07And our first question says, "Please refer to the image above

0:12when creating a sensitive label, which of the following is not an option

0:17when defining a scope?"

0:18All right, so we look at the image here, and let me zoom in.

0:23So why don't you provide a screenshot here in the event that question was not

0:27clear.

0:29The question is asin, "A blog of possible answers,

0:32which one is not an option listed here?"

0:34All right, so let's go ahead and close our image here.

0:37We have our options.

0:38Emails that have been one of them, groups and sites is,

0:43"One drive account," that doesn't sound right.

0:46We have meetings that is there along with files and other data assets.

0:50For the answer here is, "One drive account," we hit submit.

0:54Going to question number two,

0:58we also have another image.

0:59We refer to the image above, what impact does assigning permissions to a label

1:04have?

1:05All right, so just for clarification, if we look at our screenshot here,

1:09it seems they were creating a sensitive label,

1:12and we have the option here to assign permissions.

1:16So going back to our question, what's the impact of these settings?

1:24The answer to this question is this one.

1:27This step defines what the label does,

1:31really what rights users and groups have when it's labels apply to content.

1:36So we choose our correct answer and submit.

1:38Going down to question three here, we have yet another image,

1:42and the question is, "What impact does assigning users or groups

1:46to a label publishing policy have?"

1:49I don't have the word "have" here, but you'll see it by the time you get to

1:53this question.

1:55All right, so just for clarity, we're talking about when we're publishing

2:00sensitive labels.

2:01So let's look at our answers here.

2:04The correct answer being that this step defines who can see and apply the label

2:11in the Microsoft

2:11applications by teams the office applications like Word and Outlook, for

2:16example.

2:16I will pick a correct answer and hit submit.

2:19Then going to our final question here,

2:22folks report not seeing the newly advertised sensitivity labels when scheduling

2:27a team's meeting,

2:28which is a problem to be a possible cause.

2:30So our first possible answer that folks have unclear their team cache

2:34may be, but probably not.

2:36These folks haven't restored their computers after the last Windows update.

2:40That's not the answer.

2:41Check to see if the label was published by trading or adding it to a label

2:46publishing policy.

2:48That sounds good to me.

2:51And our final answer here is that the sensitivity label needs to be

2:54manually installed for the Microsoft Store.

2:55So we'll pick our correct answer and hit submit.

2:58So with that, our validation section is complete.

3:01I hope you did well, and I will see you in the next skill.