A friendly guide to the new Sensitivity button in Word, Excel, PowerPoint and Outlook — and what happens when you label a file or email.
TL;DR — Your IT team is turning on Microsoft's standard data-protection features. You'll see a new Sensitivity button in Office apps. For the first 30 days nothing is blocked — IT is just watching. After 30 days, files and emails labelled Confidential or Highly Confidential can no longer be shared with people outside the company. General and Public work as normal — no change to your day-to-day inbox.
Most of the changes don't actually block anything until Day 30. Until then, everything still works exactly as it does today.
Word, Excel, PowerPoint and Outlook get a Sensitivity button. New emails default to General. New documents default to Confidential — All Employees. Nothing is blocked.
Microsoft Purview is in simulation mode. You won't be blocked from anything, no pop-ups, no policy tips. IT collects telemetry on what would have been blocked so they can tune the rules.
If you try to send or share Confidential or Highly Confidential content externally, you'll see a banner explaining the block. Internal sharing keeps working normally.
Your IT may publish more labels later (e.g. sub-labels for specific people), but these four cover almost everything you do day-to-day. The colored dot beside each label matches the color you'll see in the Sensitivity button in Word, Excel, PowerPoint and Outlook.
Use for marketing material, press releases — anything explicitly approved for the world to see.
Nothing is added to the file or email.
Routine internal email and documents you might share with trusted external partners (vendors, customers under NDA).
Nothing is added to the file or email.
Default for new emailsInternal-only content: contracts, plans, customer data, anything regulated.
A footer "Classified as Confidential" may appear; external sharing is blocked after Day 30.
Default for new documentsSource code, pre-announce financials, employee PII, payroll, M&A.
File is encrypted — only people in our organisation can open it. Watermark "HIGHLY CONFIDENTIAL" and footer added. External sharing blocked after Day 30. Microsoft 365 Copilot will not summarise or ground on these files.
Three things start showing up in Office, Outlook and SharePoint. Here's a preview so it isn't a surprise.
Labels live on a single Sensitivity button at the top of every Office app. Picking one takes about three seconds.
Only externally addressed shares of Confidential or Highly Confidential content are blocked. Everything else works as normal.
A yellow banner explains the block. Click Send and the message is stopped. The file owner and site admin are notified.
Internal email flows normally. The footer marking is preserved.
The Share dialog blocks the action with a message. Internal sharing remains available.
Routine work email and public material flow normally. No tip, no block, no change.
The file is encrypted — it can't be opened without a Microsoft 365 identity in our organisation.
Every employee can collaborate on encrypted files inside the organisation. Co-authoring may be limited if IT chose the conservative profile — ask helpdesk if you hit a co-author issue.
If your tenant has Microsoft 365 Copilot, one extra rule applies.
Workaround. If you legitimately need Copilot to read the content, either relabel the file to Confidential — All Employees (with downgrade justification, if the content allows it) or open and summarise the file yourself.
If your IT team enabled the optional 7-year retention policy:
.msg or .pdf in a SharePoint library, move the file into a team site, or ask IT for a longer retention policy on your team's mailbox.
Print this section or pin it on your desktop — it covers 95% of day-to-day questions.
No. Existing content is not relabelled automatically. The default only applies to new content created after the rollout. You can choose to label old content manually.
No. Only emails you have explicitly labelled Confidential or Highly Confidential are blocked externally. Routine General email flows normally — this is the majority of what you send.
This is expected: "inherit label from attachments" is on by default. If an attachment carries a higher-priority label than the email, Outlook silently upgrades the email's label to match before it's sent — no prompt, no action needed from you. It's a safety net so a sensitive attachment can't leave under a lower-sensitivity email label.
Open the document, click Sensitivity → General (or Public), provide a brief justification when prompted, then share normally.
Yes — the protections are tied to your Microsoft 365 identity, not the office network. They follow you wherever you sign in to Office.
Yes. Outlook mobile (iOS and Android) supports applying and viewing sensitivity labels.
Yes for Office apps (Word/Excel/PowerPoint/Outlook on Mac, iOS, Android and the web). Third-party apps that don't understand Microsoft Information Protection may struggle with encrypted (Highly Confidential) files.
After Day 30, blocked. During the first 30-day monitoring window, allowed but logged.
No — under a retention policy, items "deleted" by you are kept in a hidden recoverable-items area until the 7-year mark. After 7 years they're hard-deleted.
Files shared in Teams chat live in OneDrive and inherit the same DLP rules as direct OneDrive shares. So a Confidential file dropped into a Teams chat with an external guest will be blocked the same way as a direct external share.
You'll see three choices — General, Confidential — All Employees, and Highly Confidential — All Employees. Pick the one that matches the most sensitive content you expect to keep in that workspace. Most everyday team sites are General. Use Confidential — All Employees for sites with employee or customer PII, financials, or contracts. Use Highly Confidential — All Employees for source code, M&A material, or anything regulated. You can change it later if you guess wrong.
Your manager or the helpdesk. As a rule of thumb: if it contains employee or customer PII, financials, source code, contracts, or anything regulated — use Confidential or higher.
Encrypted files re-check your access every 30 days. If you're offline for longer than that, the file locks until you reconnect. Sign in once on a connected device and you're back in.
This guide describes only what the Microsoft Purview baseline deploys. Your IT team may layer additional controls (Conditional Access, device compliance, MFA, mailbox auto-forward blocks, external-link expiry, etc.). If you encounter behaviour that's not described here, it's likely one of those — start with the helpdesk.
Official Microsoft documentation if you want to dig deeper.