Sensitivity labels in the Microsoft Purview Data Map FAQ

To use sensitivity labels in the Microsoft Purview Data Map, you'll need at least one Microsoft 365 license/account within the same Microsoft Entra tenant as your Microsoft Purview account.

The following Microsoft 365 licenses are required to automatically apply sensitivity labels to your assets in Microsoft 365 and the Microsoft Purview Data Map:

• Microsoft 365 E5/A5/G5
• Microsoft 365 E5/A5/G5 Compliance
• Microsoft 365 E5/A5/G5 Information Protection, and Governance
• Office 365 E5, Enterprise Mobility + Security E5/A5/G5, and AIP Plan 2

For more information, see Microsoft 365 service descriptions.

No. When you extend sensitivity labels to the Microsoft Purview Data Map, those labels are extended to all the accounts in your tenant.

Extending the labels to the data map doesn't affect your existing setup for Microsoft Purview Information Protection or modify your assets in any way, including files and databases.

• When you extend sensitivity labels to the Microsoft Purview Data Map, your Microsoft Purview Information Protection setup will continue to work in the same way as before.
• Extending the sensitivity labels to the data map allows Microsoft Purview to apply those labels to your Azure and multicloud assets in the Microsoft Purview Data Map. The data map is a metadata store and can be deleted by you at any time, and you can browse it using the Microsoft Purview Data Catalog.
• Sensitivity labels are applied only to the asset metadata in the Microsoft Purview Data Map and aren't applied to the actual files and database columns. These sensitivity labels don't modify your files and databases in any way.
  
  

Only compliance administrators, global administrators of the tenant, or a custom role that has access to the Set-PolicyConfig cmdlet can enable labels for the Microsoft Purview Data Map. To verify whether an administrator has extended labeling to the Microsoft Purview Data Map, connect to Exchange Online PowerShell and run the Get-PolicyConfig cmdlet. For example:

Get-PolicyConfig | format-list Purview*

When labeling has been extended to the Microsoft Purview Data Map, you'll see True for the PurviewLabelConsent parameter and a timestamp indicating when consent was activated and an ObjectId of who activated consent.

PurviewLabelConsent        : True
PurviewLabelConsentCaller  : d8675309-1111-2222-3333-1234567890ab
PurviewLabelConsentTime    : 9/28/2021 6:04:45 PM
PurviewLabelConsentDetails : {"Consent":true,"Caller":"d8675309-1111-2222-3333-1234567890ab","Time":"9/28/2021 6:04:45 PM"}

When labeling has not been extended, you'll see False for PurviewLabelConsent like the example below:

PurviewLabelConsent        : False
PurviewLabelConsentCaller  : 
PurviewLabelConsentTime    : 
PurviewLabelConsentDetails :

This is different than auditing the action of adding the Microsoft Purview Data Map to the scope of a sensitivity label. That activity can be found in the unified audit logs. For example,

Search-UnifiedAuditLog -Operations "Set-Label" -StartDate 10/05/2021 -EndDate 10/16/2021

For more information, see Search the audit log in the Microsoft Purview compliance portal.

The following table lists the differences between classifications and sensitivity labels:

While classifications and SITs are fundamentally the same things, classifications are a Microsoft Purview Data Map concept and SITs are a Microsoft Purview Information Protection concept. Both classifications and SITs are used by their respective services to identify the type of data found in an asset.

You can apply sensitivity labels to all the data sources listed under Supported data sources for sensitivity labels in the Microsoft Purview Data Map.

You can apply sensitivity labels to all Microsoft Purview Data Map supported file types.

No, custom sensitive information types are not supported in the Microsoft Purview Data Map at this time. The Microsoft Purview Data Map currently only supports Microsoft Purview Information Protection built-in sensitive information types.

No, advanced classifiers aren't currently supported in the Microsoft Purview Data Map and won't appear.

The Microsoft Purview Data Map supports automatic labeling only. Labels are automatically applied to assets in the data map based on the classifications found on the assets and the autolabeling rules for the labels.

The Microsoft Purview Data Map doesn't currently support manually applying a label, modifying, or removing a label from an asset.

The Microsoft Purview Data Map currently doesn't support scanning for credentials. When the Data Map supports scanning for credentials, you should be able to apply labels based on credentials found.

No, although the sensitivity label might be configured for these protection actions, we don't currently support encryption and content marking for files in the Microsoft Purview Data Map.

No, the Microsoft Purview Data Map doesn't currently provide data loss prevention (DLP) capabilities. Data Loss Prevention is currently supported only for Microsoft 365 apps and services.

Sensitivity labels are managed only in the Microsoft Purview compliance portal. For more information, see How to create sensitivity labels in Microsoft Purview Information Protection.

Support for managing sensitivity labels within the Microsoft Purview governance portal isn't currently available.

The following built-in admin roles include permissions to manage sensitivity labels in the compliance portal:

• Global Administrator
• Compliance Administrator

For more information, see Permissions required to create and manage sensitivity labels. After you have compliance and global administrators configured, those administrators can give access to individual users.

All users with at least data reader access to the Microsoft Purview Data Map have permissions to search and browse assets with sensitivity labels in the data catalog.

All users with the insights reader role and at least data reader permissions on applicable collections will have permissions to view sensitivity label insights reports in Microsoft Purview Data Estate Insights.

The Microsoft Purview scanner samples the data. For more information, see sampling data for classification and autolabeling.

Sensitivity labels have a priority 'order' and the Microsoft Purview Data Map uses this order to assign labels. If there are multiple labels meeting the classification criteria, the Microsoft Purview Data Map selects the label with the highest order.

For more information, see Label priority order matters.

Microsoft Purview provides a classification and labeling experience for all your Azure assets including SQL databases. Microsoft Purview is intended for organizations that want to manage their entire data estate in a single place with the power of classification, labeling, alerting, and more. Microsoft Purview uses sensitivity labels, which have a global scope and travel with your data no matter where it moves to or what it transforms into.

In contrast, SQL data discovery and classification is built into SQL. SQL data discovery and classification existed before Microsoft Purview as a way to provide basic capabilities for discovering, classifying, labeling, and reporting the sensitive data in your SQL databases. SQL data discovery and classification use local labels that don't have a global scope and don't support sensitivity labels.

SQL classification uses local labels, while Microsoft Purview uses sensitivity labels. Labels applied in the SQL classification experience won't show up in Microsoft Purview. For more information, see Labeling for SQL databases.

For more information, see: