Why four tiers
Public bodies tend to inherit classification schemes with too many levels, sub-markings and caveats. People cannot tell adjacent levels apart, so they pick whichever looks safest or whichever is first in the list. A four-tier scheme works because each tier answers a practical question: can this leave the organisation, and if not, who inside it can see it.
The tiers we use as a starting point:
- Public: approved for release outside the organisation, with no handling restriction.
- Internal Use Only: anyone in the organisation can see it, but it should not go outside without a reason.
- Confidential: restricted to a defined group, typically because it contains personal data or commercially sensitive material.
- Strictly Confidential: a small, named audience, where disclosure would cause serious harm, such as special category data in volume, legal advice or investigations.
Mapping to what you already use
If you also handle material under the Government Security Classifications, decide how these tiers relate to OFFICIAL and the OFFICIAL-SENSITIVE marking, document it, and have your SIRO or head of information governance sign it off. That decision belongs in a policy, not in the label configuration screen.
Write a one-paragraph definition for each tier with two or three real examples from your own organisation. Those definitions become the label descriptions and tooltips, and they are what people will read when they are unsure. If information governance cannot agree the examples, the labels will not be applied consistently by people or by policies.
Client-side and service-side are different tools
Purview offers automatic labelling in two places. Client-side labelling runs in Office apps as someone works, and can recommend a label or apply one when content matches a condition. Service-side labelling runs in Microsoft 365 itself: auto-labelling policies evaluate files at rest in SharePoint and OneDrive, and email in transit through Exchange, without anyone opening them.
Service-side is what deals with the backlog: years of documents nobody will ever open again. Its limits matter. It works on supported file types, it applies labels rather than recommending them, and in general it does not overwrite a label someone applied manually. That last point is a feature. A person's judgement should usually beat a pattern match.
The two work best together. Client-side labelling, set to recommend, catches new documents while the author is still there to make the call. Service-side labelling sweeps up what already exists and what slips past. Use the same conditions in both where you can, so a document is not recommended one label in Word and given another by the service a week later.
Auto-labelling policies carry premium licensing requirements. Licensing changes, so confirm the current position for your users with Microsoft before you plan the rollout.
Which tiers to automate
Do not try to auto-label every tier. Public is a decision a person makes when something is approved for release, and a pattern cannot tell a draft from the published version. Internal Use Only works best as the default label, applied to new documents through the label policy and as a library default where that is available.
Auto-labelling earns its place at Confidential, where content contains things a classifier can recognise. Purview's built-in sensitive information types include UK identifiers such as National Insurance numbers, NHS numbers and passport numbers, and you can create custom types for your own reference formats, such as case, claim or tenancy references.
Be careful at the top tier. If Strictly Confidential applies encryption, labelling a file automatically changes who can open it and how other tools and partners can work with it. We usually recommend automatic labelling up to Confidential, and keeping Strictly Confidential as a deliberate human choice except for narrow, well-tested conditions.
Prepare before you simulate
A few settings need to be in place before a policy is worth simulating.
- Publish the four labels with plain-English descriptions and tooltips drawn from the agreed definitions.
- Enable sensitivity labels for Office files in SharePoint and OneDrive, so the service can work with labelled and encrypted files.
- Order the labels so Public is the least sensitive and Strictly Confidential the most, since Purview uses that order to judge downgrades and to choose between matching labels.
- Require a justification when someone lowers a label or removes it.
- Choose a small set of sites with known content for the first policy.
Simulation is the real work
Auto-labelling policies start in simulation mode. Purview evaluates content against the policy and shows what it would label, without changing anything. Treat this as the main phase of the work, not a formality before switching on.
Expect false positives. Number patterns match things that are not personal data: invoice numbers, internal identifiers, phone numbers. One National Insurance number in a template can push every document built from it into Confidential. Tune with confidence levels, instance counts and supporting evidence so the policy matches content that genuinely holds personal data, not a single stray match.
Custom sensitive information types need extra care. A pattern for your own case references may also match dates, postcodes or order numbers. Test each custom type against a sample of real documents that should match and a sample that should not, before it goes anywhere near a policy.
Review samples with someone who knows the content, ideally the information asset owner for that area. Adjust, rerun the simulation and review again. Simulations take time on large sites, so plan for several cycles rather than one.
Roll out by location
Turn the policy on for the pilot sites first, check results in activity explorer and content explorer, then widen the scope. Large estates are processed over time, so do not expect a library to be labelled the moment a policy is enabled.
Tell people before labels appear. Staff who open a document and see Confidential on it for the first time, with no explanation, will either ignore it or raise a ticket. A short note from information governance explaining the four tiers, and what changes for them in practice, saves a lot of support time.
Treat Exchange as a separate phase with its own simulation. Patterns that work well on documents often misfire on email threads, signatures and forwarded chains.
Expect disagreement. Some staff will think a document has been labelled too high, others too low. Give them a route: they can change the label with a justification, and information governance reviews the justifications. Patterns in those reviews are the best evidence you will get for tuning the next version of the policy.
Who owns what
The SIRO or head of information governance owns the scheme and decides what each tier means. The DPO advises on the personal data conditions. Information asset owners confirm whether simulation results are right for their areas. IT configures and monitors labels and policies. Records management should be involved from the start, because sensitivity and retention are often confused: sensitivity labels control access and handling, retention labels control how long content is kept.
Keep a short decision log: which conditions were tried, what the simulation showed, who approved the change and when. When someone later asks why a set of documents is Confidential, or why it is not, the log answers the question without anyone having to reconstruct the reasoning from memory.
What to check after go-live
Labelling is not finished when the policy is switched on. Build a short monthly routine.
- Review label downgrades and removals in activity explorer.
- Use content explorer to find content holding in-scope sensitive information types that is still unlabelled.
- Investigate reports of partners unable to open files, which usually point to encryption on a tier shared externally.
- Rerun simulation before changing any condition on a live policy.
- Revisit the tier definitions with information governance at least once a year.