►
Description
In this 45-minute administrator/developer focused tour of the latest security controls and sensitivity labeling capabilities available today or soon in SharePoint, OneDrive and Microsoft Teams, Microsoft (GPM), Sesha Mani, shows protective capabilities aligned to 4 data security pivots - users, devices, locations, and information. There are demos of manually creating a sensitivity label in the Microsoft 365 Compliance Center, configuring automatic (rules-based) classification/labeling policies, auditing capabilities available in Content Explorer, and of a capability called: “Protect sensitive information from the get-go” - block external access to newly published content by default until a Data Loss Prevention (DLP) scan verifies sensitivity. The session concludes with Roadmap and Q&A.
This PnP community demo is taken from the monthly SharePoint Community (PnP) call recorded on May 12, 2020.
Presenter: Sesha Mani (Microsoft) | @SeshaManiS
Supporting materials:
• Sensitivity Labels with protection in SharePoint and OneDrive (GA) | https://aka.ms/M365FilesLabelsGA
• Sensitivity Labels to protect content in SharePoint sites, Microsoft Teams and Microsoft 365 groups (Public Preview) | https://aka.ms/M365SitesLabels
• Automatic Classification of content with Sensitivity Labels (Public Preview) | https://aka.ms/SPOAutoClassification
All SharePoint PnP Developer Community demos: https://www.youtube.com/playlist?list=PLR9nK3mnD-OWSbg0o9a7mx_E7s2u7h_o2
Learn more about the SharePoint developer community at: http://aka.ms/m365pnp.
A
Thank
you
all.
What
is
a
great
opportunity
to
share
with
you,
whatever
team
is
up
to
in
the
context
of
security
and
compliance,
and
today
I'm
going
to
focus
on
specifically
around
securing
your
data
in
SharePoint,
onedrive
and
teams
with
the
sensitivity
labels.
Some
of
you
might
already
know
me:
Sasha
mani,
I'm,
a
principal
group,
product
manager
at
Microsoft,
I've
been
in
this
security
and
compliance
industry
for
many
many
years
and
specifically
with
the
SharePoint
team
for
almost
11
years.
A
Now,
let
me
go
ahead
and
they
share
with
you
the
agenda
that
I
was
planning
to
walk
you
through
the
door.
Today,
I'll
briefly
mention
what
the
trend
we
are
seeing
in
the
security
landscape
and
then
top
level.
What
are
the
security
pivots
that
we
use
to
sharpen
our
protection
story
and
then
we'll
get
into
the?
What
are
the
new
controls
specifically
around
sensitivity?
Labels
and
I
have
lots
of
demos
to
walk
you
through
and
then
finally,
we'll
finish
up
with
a
quick
roadmap
slide
and
Q&A
session
as
well.
A
A
Now,
if
you
double-click
on
the
Information
Security,
one
of
the
trend,
we're
really
seeing
is
what's
called
the
zero
trust
model
like
gone
are
the
days
where
you
had
to
work
inside
your
firewall.
Your
corporate
content
also
always
live
within
your
corporate
network,
and
you
need
to
VPN
in
to
access
your
corporate
data
these
days.
The
data
lives
in
the
cloud.
Are
the
users
are
actually
expecting
to
access
the
data
from
anywhere
from
any
devices
from
any
applications?
A
That's
the
new
norm
that
we
are
living
in,
and
this
is
exactly
what
we
mean
by
zero
trust
model
in
the
sense
that
we
need
to
define
the
security
strategy
of
protecting
your
data
in
a
way
that
all
the
different
layers
that
you
think
through
and
then
corporate
data
is
accessible
at
the
same
time
from
anywhere
and
any
devices
and
any
locations
as
well.
So
really
it
comes
to
four
major
aspects.
One
is
having
a
strong
user
identity
so
make
sure
that
when
the
users
are
authenticating,
we
have
a
strong
way
of
protecting
that.
A
Second
of
all,
what
devices
that
users
are
using
to
access
your
corporate
data
so
being
able
to
manage
it
or
even
if
they
come
from
unmanaged
devices
providing
them
productivity
at
the
same
time
to
some
level
securing
your
corporate
data
and
then
what
apps
that
they
use
or
services
they
use
to
access
your
corporate
data
and
then,
finally,
in
the
context
of
access,
you
always
want
to
follow
the
least
privileged
access
principle,
so
that
you
provide
the
access
to
the
corporate
data,
but
only
to
the
extent
whatever
needed.
Privileges
are,
but
not
giving
them.
A
So
much
access
super
admin,
access
and
so
on.
If
they
don't
need
it,
so
really,
if
they
need
to
get
a
job
done,
just
provide
the
limited
privileges
that
they
need
to
access
that
particular
corporate
data.
So
that's
why
this
is
around
the
zero
trust
model,
and
this
is
a
very
common
pattern
across
the
industry
and
even
within
Microsoft.
We
take
that
into
really
consideration,
while
they
think
about
our
security,
pivots
and
our
security
strategies
moving
forward.
A
Now,
let
me
briefly
spend
some
time
on
security
pivots
that
we
normally
think
about
and
providing
our
controls
for
each
of
the
security
pivot
I
would
put
them
in
four
major
pivots.
The
first
is
all
about
users.
So
in
this
category
of
divet,
as
you
know,
we
have
both
internal
employees
who
are
full-time
employees.
A
They
have
contractual
agreement
with
us
and
they
follow
the
corporate
rules
and
so
on
the
from
ethical
boundary
as
well,
and
then
also
you
have
extra
users
which
are
loosely
referred
as
guest
users
that
come
and
collaborate
with
your
internal
employees
on
a
specific
project
purposes.
So
you
need
to
be
mindful
of
this
segments
between
internal
employees
versus
the
external
users.
A
Perhaps
you
have
specific
policies
needs
to
be
in
place
when
external
users
come
in
and
accessing
your
corporate
data,
ensuring
they
get
to
access
only
the
content
or
projects
collaterals
that
are
intended
for
those
external
users.
Then
the
second
aspect
is
MFA
policy.
So
MFA
here
stands
for
multi-factor
authentication.
A
It's
really
passwords
are
good,
but
the
same
time
we're
actually
moving
into
the
password
les
model
and
MFA
multi-factor
authentication
is
becoming
a
new
norm
and
it
has
to
be
because
you
really
want
to
have
stronger
authentications
as
a
first
gate
of
your
security
when
users
beat
both
internal
or
external
users,
accessing
your
corporate
data
and
then
finally
sharing
policies.
As
many
of
you
know,
we
have
a
SharePoint
and
onedrive,
and
teams
has
many
sharing
Polly
policy
capabilities.
A
You
can
configure
your
site
collection,
all
the
way
from
only
accessible
by
internal
employees
to
authenticated
guest
users
and
then
all
the
way
into
the
anyone
users
as
well,
meaning
anybody
who
has
the
link
can
access
the
data,
which
is
most
permissive
capability,
and
you
can
share
a
file
with
that
particular
most
permissive
control
as
well.
So
that's
under
the
users
pivot,
the
one
moving
on
to
the
devices
limit
as
you
as
we
all
access
our
corporate
data
from
mobile
devices.
Managing
those
mobile
devices
is
super
super
critical.
A
So
this
is
where
products
like
Intune
comes
into
play
so
that
you
can
manage
your
own
employees.
Devices
at
the
same
time
have
unmanaged
device
policy,
which
is
the
fine-grained
conditional
access
policy
that
we
have
in
office.
365
such
that,
if
an
employee
or
an
external
user
accesses
the
corporate
data
from
unmanaged
devices,
you
provide
them
the
appropriate
access
based
on
the
sensitivity
of
the
content,
for
example,
you
allow
them
full
access
if
it
is
a
general
training
material,
you
allow
them
limited
access
if
there
is
confidential
material
or
you
completely
block
them.
A
If
it
is
a
top-secret
site
that
they
are
trying
to
access
from
unmanaged
device
and
then
the
third
one
I
would
call,
it
is
the
idle
session
timeout,
which
is
in
the
unmanaged
devices
you
want
to
ensure
that
if
the
user
is
inactive
for
a
certain
period
of
time
and
the
user
forgets
to
click
the
sign
out
button,
you
will
be
able
to
kick
them
out
of
the
signing
session
so
that
inadvertently,
some
unauthorized
user
doesn't
come
and
start
taking
over
the
session.
So
this
is
what
we
refer
as
idle
session
timeout.
A
This
is
something
you
can
configure
in
the
SharePoint
and
onedrive
experience.
Then
moving
on
to
the
third
pivot
round
locations-
and
in
this
case
we
specifically
focus
around
the
IP
address.
So
you
could
create
a
control
such
that
if
the
user
is
accessing
my
corporate
data
only
from
within
this
IP
address
range
only
then
they
can
access
my
corporate
data.
So
this
is
most
security,
centric
customers.
They
prefer
this
kind
of
approach,
because
that
way
they
have
a
definitive
network
range
IP
address
range
from
which
they
know
that
the
corporate
access
is
only
allowed.
A
A
All
these
policies
are
available
generally
available,
except
the
two
items
that
I
have
those
are
available
as
public
preview.
So
you
will
be
able
to
take
advantage
or
try
out
these
security
policies
and
I
have
shot
you
coming
up
so
that
I
can
walk
you
through
on
where
you
can
go
and
learn
about
these
policies.
Sincerity.
Labels
are
really
about
helping
you
to
easily
classify
your
data
and
detect
and
label
your
sensitive
content
in
your
enterprise
corpus.
A
As
every
company
going
through
the
digital
transformation,
we
are
seeing
ever-increasing
digital
data,
so
classification
becomes
even
more
important
in
this
digital
world.
Second
of
all,
with
these
labels
you
can
associate
a
richer
policies,
both
security
and
access
policies,
such
that,
if
a
label
is
applied
to
a
file
or
to
a
team
on
a
site,
the
appropriate
policy
will
automatically
get
honored.
A
Third
of
all,
these
policies
are
actually
consistent
across
sites
teams
and
office
365
groups,
so
you
don't
have
to
worry
about
having
managing
multiple
places
to
to
provide
a
consistent
and
unified
policies
for
your
ecosystem.
And,
finally,
these
are
unified
labels
across
em
365
and
what
I
mean
by
that
is
you
create
them
at
the
m36
Microsoft
365
compliance
center
and
all
the
Microsoft
365
resources,
such
as
SharePoint
sites?
Onedrive
teams
files
experience
in
office
apps-
all
of
them
will
now
able
to
expose
these
labels
so
that
the
end
user
will
have
a
consistent
experience.
A
Let
me
actually
get
into
some
demos
of
this
particular
experience
so
that
you
can
see
them
in
action.
So
I'm
going
to
go
to
the
demo
machine
here.
So
here
I
am
in
the
n
365
compliance
center,
as
you
can
see,
I
have
created
general
confidential
MLA
legal
top
secret
top
secret
and
financial
department,
specific
labels.
So,
for
example,
if
I
go
and
click
on
the
confidential
label,
I
can
see
the
policies
that
are
configured
for
this
labels.
A
So,
for
example,
I
have
sites
and
group
settings
are
configured
as
private
and
then
allow
limited
and
their
only
access.
So
let
me
actually
go
ahead
and
click
the
Edit
label
here,
so
it
allows
you
to
pick
a
name.
You
can
describe,
provide
a
description
for
this
label
that
is
visible
to
your
end-user,
so
this
is,
as
per
your
organization
schema.
You
can
provide
the
tooltip
that
you
want
to
show
to
the
end-users
and
then
you
can
go
ahead
and
click
Next.
A
A
If
this
confidential
label
gets
applied
to
the
file
and
then
specifically
around
sites
and
groups,
settings
for
team
sites
and
group
settings,
you
can
set
three
different
categories:
three
different
policies:
one
is
what's
the
privacy
you
want
for
this
office
if
I
group,
so
you
have
a
choice
of
private
or
public
and
then
second
of
all,
external
user
access.
Do
you
want
allow
external
guest
users
to
be
added
as
members
for
this
office
by
groups
or
not?
A
So
you
can
select
them
right
here
and
then
the
third
one
is
a
very
interesting
policy
where
unmanaged
device
policy,
if
a
resource
is
being
accessed
from
an
unmanaged
device
with
this
label,
which
is
the
confidential
label?
What's
the
experience
you
want
to
provide
them,
you
can
say
I
want,
allow
full
access
or
allow
limited
access,
limited
they're
going
to
access.
That
means
user
can
see
the
site,
but
they
cannot
download
the
files
or
you
can
completely
block
access.
A
Let's
say:
I'm,
creating
a
emanate
legal
top-secret
as
a
label,
then,
of
course
I
would
want
to
Sue's
block
access
because
I
don't
want
users
to
access
those
top-secret
content
from
my
unmanaged
devices.
So
by
setting
all
these
policies
under
that
one
label
and
if
we
go
ahead
and
finish
this
label
setting.
So
here
is
the
another
auto
labeling,
HIPPA
and
capabilities
which
I
will
talk
about
it
in
a
minute.
A
So
this
is
it
so
you
basically
have
configured
all
the
relevant
policies
for
this
label
and
let's
actually
go
ahead
and
see
how
the
label
experience
looks
like
from
an
end-user
perspective.
So
here
I
am
in
a
team's
experience.
I
am
logged
in
to
my
investment
bankers
team
and
for
this
demo
sessions
purpose
I'm
an
employee
in
contoso,
a
bank
corporation
I'm
part
of
the
investment
banking
team.
So
you
can
first
of
all
see
the
sensitivity
as
the
first
class
experience
right
here
in
the
team's
files
experience.
A
A
As
you
can
see
here,
this
particular
file
is
marked
with
confidential
as
the
watermark
here,
and
this
watermark
is
being
added
here,
mainly
because
this
particular
file
is
flagged
as
confidential
and
that's
the
reason
the
file
watermark
is
saying
confidential
and,
as
you
can
see,
the
rest
of
the
labels
are
also
available
for
me,
under
the
sensitivity
experience
and
at
the
status
bar
you
right
here
at
the
bottom,
you
can
see
that
the
labels
show
up
as
well.
So
if
the
label
has
encryption
policy
attached
to
it,
then
you
will
see
that
lock.
A
Icons
show
up
in
this
particular
experience.
So
that's
how
easy
it
is
for
the
end-user
to
be
able
to
select
a
label
and
across
the
files
experience,
be
it
Word,
Excel
or
PowerPoint.
Now
the
appropriate
watermark,
header
and
footer
will
also
get
applied.
Now,
let's
take
a
look
at
quickly
on
the
container
sites
experience
so,
for
example,
here
I
am
in
the
SharePoint
home
and
if
I
go
ahead
and
click
create
a
site
and,
let's
say
I'm,
going
to
create
a
team
site
and
let's
me
give
it
a
big
site
name
for
it.
A
You
can
be
demo
site
and,
as
you
can
see,
first
of
all,
the
options
right
here
available
for
me
to
pick
the
sensitivity
of
this
particular
site
and
the
same
list
available
for
me:
general
confidential,
M&A,
legal
top
secret
top
secret
and
none
and
if
I,
want
to
know
if
I
want
to
decide,
which
is
the
right
label.
For
me,
I
can
click
on
this
eye
icon
right
here.
That
shows
me
as
an
end-user.
What
my
admin
has
configured
are
informing
me
right
here.
A
It
tells
me
general
confidential
and
you
can
tailor
this
experience
text
whatever
the
specific
appropriate
text
is
for
your
organization.
So
in
this
particular
case,
I
can
go
ahead
and
create
confidential,
and
the
moment
I
select
conference,
you'll
notice,
that
that
is
the
option
laid
out,
and
it
shows
me
automatically
that
private
is
being
applied
for
this
particular
group.
So
that's
how,
from
a
induced
perspective,
they
just
pick
their
label
between
the
seam.
A
The
rest
of
the
security
policies
will
get
applied
now
in
the
interest
of
time,
I
actually
have
created
already
at
site,
which
is
the
investment
bankers
site.
I
told
you
with
the
confid
as
the
label,
so
you
can
see
at
the
top
here.
We
also
show
you
right
in
the
navigation
bar
that
the
confidential
label
is
an
apply
for
this
site
collection
and
because
I'm
logging
in
from
an
unmanaged
device
and
the
unmanaged
device
policy,
is
enabled
for
this
label.
A
You
can
see
that
ello
information
bar
that
shows
up
at
the
top,
and
it
clearly
tells
me
that
my
organization
doesn't
allow
me
to
download
print
or
sync
using
this
unmanaged
device,
and
that's
why,
on
this
files,
experience
I
don't
have
the
option
to
download
these
files
into
my
local
device,
because
this
device
is
an
unmanaged
device.
So
that
kind
of
shows
you
an
idea
of
how
the
policies,
both
at
the
file
level,
as
well
as
at
the
team
and
decide
collection
level,
are
being
seamlessly
shown
to
the
end-user
and
taken
to
account.
A
Okay,
so
let's
go
up
to
be
search
experience
in
their
SharePoint
home,
go
to
click
on
cancel
here,
so
imagine
that
the
multis
protected
files
that
I
have
and
I
have
access
to
some
of
them
already
right,
and
these
are
encrypted
files
that
are
sitting
in
SharePoint
and
onedrive
and
I
have
only
I
have
access
to
them
in
the
previous
era.
Before
we
enable
this
experience,
you
cannot
search
for
those
protected
files.
Now
we
have
we're
glad
to
let
you
know
that
we
have
enabled
that
capability
as
well.
A
So,
for
example,
I
have
a
top-secret
project
called
red
zone.
That
is
one
of
the
top-secret
files
that
is
always
encrypted
and
I
have
access
to
those
files.
Now,
when
I
search
for
that
in
my
enterprise
search
experience,
red
zone,
I
can
see
the
files
showed
up
for
me
and
this
particular
file,
if
I
go
and
click
on
it,
it
will
actually
show
me
up
that
the
file
from
my
branding
site-
and
it
actually
has
the
text
the
red
zone.
A
It's
a
top
secret
labeled
as
file
itself,
so
you
can
see
at
the
bottom
status
bar
that
it
has
the
lock
icon.
That
means
the
encryption
policy
is
actually
applied
for
it.
So
what
it
shows
you
is
as
an
end
user.
Now
you
can
search
for
these
encryption,
protected
files
in
SharePoint,
onedrive
and
teams
as
well,
and
this
is
a
huge
step
forward
from
a
Productivity
experience.
Point
of
view.
For
this
end
users,
I'm
glad
I'm,
hope
you
guys
you
fall
ops
files
will
love
this
experience.
A
Now,
let
me
go
back
to
the
PowerPoint,
so
I'm
sure
many
of
you
are
thrilled
to
try
this
out.
So
if
you
are
gonna
be
like
I
would
like
to
let
you
know
that
we
have
made
generally
available
their
sensitivity,
labels
with
protection
for
files
in
the
SharePoint,
onedrive
and
teams,
as
of
May
4th,
and
you
can
go
to
this
aka
door.
Ms
/m
365
files,
labels
GA
for
the
announcement,
as
well
as
the
link
to
the
product
documentation
and
how
to
get
this
enabled
in
your
tenant
and
then
start
working.
A
You
know
start
working
through
this.
Also.
We
have
made
the
public
preview
for
sensitivity,
labels
for
teams,
sites
and
office
365
groups
and
we're
also
looking
at
enabling
this
for
general
availability
in
the
next
few
months.
You
can
learn
more
about
this
particular
feature
at
AKA
dot,
ms
/m
365
sites
labels.
B
A
A
licensing
point
of
view
you
really
need
for
just
getting
the
basic
labels
available
for
your
tenant.
You
need
to
have
an
e
license.
Key
one
or
III
license.
You
will
be
able
to
then
create
the
appropriate
labels,
but
then
the
policies
that
you
want
to
apply
to
the
label
so,
for
example,
for
encryption
policy,
you
need
to
have
the
RMS
service
license,
then,
for
the
device
policy,
the
unmanaged
device
policy
that
I
showed
you
you
need
to
have
as
your
Active
Directory
premium
plan.
One
license.
B
A
B
A
Absolutely
we
do
have
partials
and
API
is
available.
Both
ms
graph
api
is
and
rest
api
is
in
sharepoint,
and
I
will
share
the
article
link
to
that.
It's
that
way
you
can
get
the
labels
on
file
or
on
this
particular
site
you
can
get
them
and
set
the
labels
as
well
at
a
specific
site
level.
Basically,
this
is
another
SP
site
property
that
we
and
then
you
can
basically
enumerate
them
or
set
them
as
well.
At
that
site,
collection,
level,
cool.
B
A
Good,
okay,
thank
you!
Visa
yeah.
Okay,
so,
let's
say
a
continue
on
the
next
trip
topic
that
I
want
to
cover
is
automatic
classification
with
sensitivity
labels.
So
what
I
showed
you
in
the
previous
demos
is
manually,
the
users
can
go
into
the
file,
are
going
to
the
SharePoint
site
creation
time
and
pick
a
label
right.
A
As
you
know,
we
have
over
100
sensitive
information
types
that
is
out-of-the-box
available
in
our
system
in
our
service,
and
you
can
use
those
to
create
these
auto
labeling
policies.
So,
for
example,
you
can
imagine
if
the
file
has
more
than
10
credit
card
numbers
in
it,
then
you
want
to
label
the
file
automatically
as
confidential
right.
So
you
can
create
policies
like
that
job
rules
based
using
these
hundred
plus
sensitive
information
types.
A
Also,
these
automatic
automatic
classification
policies
we
do
want
to
help
you
to
simulate
them
first
and
fine-tune
the
policies
before
you
actually
publish
these
automatic
labeling
policies
in
your
service
and
that's
where
policy
simulator
comes
into
play.
So
now.
Let
me
actually
quickly
show
you
what
that
experience
looks
like
so
we'll
go
back
to
my
browser
here.
A
This
con
right
here
so
here
I
am
in
the
information
production
tab
again
where
I
have
paid
on
the
labels
and
if
you
notice,
on
the
top,
we
have
a
new
tab
called
automatic
labeling
Trivium
and
if
you
click
on
that
particular
tab
here
is
where
you
can
create
these
auto
labeling
policies
for
SharePoint
and
onedrive,
and
also
teams,
basically,
all
the
data
that
is
residing
in
these
services
files
data.
You
can
now
create
auto
labeling
policy
here.
A
So,
as
you
can
see
here,
I
have
created
a
couple
of
policies
and
three
of
them
are
under
simulation
right
now
and
then
two
of
them
are
already
enabled
and
working
in
my
in
my
tenant
itself.
So,
for
example,
if
I
take
the
US
financial
data
in
one
drives
or
let
me
go
ahead
and
take
the
click
on
that,
and
you
can
see
that
it
basically
ran
the
simulation
and
it
came
back
to
me.
There
is
not
specific
matches
found
and
I
can
actually
target
specific
sites.
A
So
in
this
particular
case,
I
have
targeted
one
drive
of
a
specific
users.
In
this
case
the
Sascha
user
account
is
what
I
have
targeted
and,
of
course
you
can
target
many
onedrive
sites
as
well.
So
you
can
select
the
high
profile
users
onedrive.
If
you
wanted
to
target
those
as
the
onedrive
location.
Also,
you
can
target
SharePoint
sites
as
well,
not
just
onedrive
sites,
so
you
can
select
the
specific
SharePoint
sites
URLs
and
then
being
able
to
target
that
as
well.
A
So,
for
example,
if
I
click
on
edit
option,
let
me
quickly
show
you
what
that
experience
looks
like
so
here,
I
am
onedrive
accounts,
I
can
choose
the
accounts,
as
I
just
talked
about
and
I
can
click
on
SharePoint
sites,
and
then
I
can
go
ahead
and
click
on
choose
sites
and
which
will
let
me
select
specific
sites.
Urls
I
can
type
it
in
and
then
add
them
to
my
policy
as
well,
and
also
we
do
that
for
exchange
mailboxes.
A
As
you
can
see
here-
and
this
is
mainly
for
data
in
transit
and
you
send
a
mail-
these
rules
will
be
applied
for
that.
So
that
is
how
easy
it
is
to
create
a
policy
or
select
a
location
specifically
for
your
auto
labeling
policy.
Then
the
next
thing
you
select
is
the
rules
for
this
policy.
So,
for
example,
here
I
have
created
US
financial
data
credit
card
data,
so
the
condition
is
if
the
file
contains
credit
card
number,
US
bank
account
number
and
ABA
routing
number
and
the
content
is
shared
with
the
external
users.
A
Then
it
will
be
picked
up
in
this
particular
role
or
I
can
then
select
high
volume,
low
volume
in
the
sense,
how
many
number
of
specific,
how
many
number
of
occurrences
of
this
credit
card
number
needs
to
be
there
in
a
given
file
to
trigger
this
particular
policy
so
for
high-volume,
I've,
set
it
up
as
10
for
high
for
a
low
volume
for
high
volume,
I
set
it
up
as
I
think
20
in
this
particular
case.
So
that's
how
you
configure
these
rules.
A
If
you
want
to
create
an
add
a
new
rule,
you
just
click
on
create
rule.
You
add
your
name
here
and
then
you
can
add
the
condition.
I
want
to
look
for
specific,
sensitive
types.
So
you
can
add
the
specific
sensitive
types
like
I
said
there
are
100,
plus
sensitive
information
types
available
out
of
the
box
for
you
to
pick
from
so
you
can
select
them
here
so,
for
example,
Finland
national
ID
or
you
get
the
idea
here.
A
So
you
can
pick
any
of
the
available
sensitive
information
types
and
also,
if
you
have
a
custom
sensor,
information
types,
you
can
add
them
as
well
and
then
those
will
become
available
for
you
for
selection
as
well,
so
I'm
going
to
go
ahead
and
click
Next
here
and
that's
basically
the
experience
to
pick
the
location
pick
the
rules
and
then
finally,
you
need
to
pick
the
label
that
you
want
to
apply.
So
in
this
case,
I
can
pick
top
secret
or
highly
confidential
or
the
other
labels
that
I
have
in
my
organization.
A
A
A
Micro,
banking
strategies
is
the
site
collection
that
I
have
targeted
this
Auto
labeling
policy
and,
as
you
can
see,
I
have
a
sensitivity
column
there
in
all
the
top
secret
confidential
labels
for
showing
up
for
these
labels,
and
if
you
hover
over
and
leave
it
there,
you
can
see
it
says
that
this
file
has
been
automatically
labeled.
So
we
also
tell
you
for
a
given
file.
If
it
is
labeled,
is
it
labeled
automatically
or
is
it
labeled
manually?
A
So
in
this
case,
this
file
customer
credit
card
numbers
is
automatically
labeled
because
the
user
forget
to
label
it.
That's
why
the
system
picked
up
and
labeled
it
and,
on
the
other
hand,
I
think
there
are
other
items
like,
for
example,
this
particular
new
product
overview.
Powerpoint
is
actually
labeled
manually
as
well.
Okay,
so
we
give
you
that
flavor,
whether
it
is
automatically
or
manually
label,
and
also
it
shows
you
that,
even
if
the
users
neglect
system
will
pick
up
and
ensure
that
a
sensitive
content
is
protected.
A
A
B
A
The
team
itself,
when
you
create
a
team,
you
can
pick
a
sensitivity
label
and
that's
the
what
we
call
the
holistic
view.
Then
that
label
protects
everything
that
inside
the
team,
including
the
files
experience
that
I
talked
about.
We
don't
have
the
capability
where
a
specific
chat
or
a
specific
channel
within
the
team.
You
can
set
the
label.
We
don't
have
that
capability
yet
once
the
good
feedback
will
definitely
take
that
into
consideration.
B
A
If
you
set
it
at
the
site
level,
only
then
that
site
collection
policies
such
as
the
device
policy
that
I
mentioned
and
the
external
yes
taxes
and
the
privacy
policy,
those
are
the
policies
that
will
get
honored.
We
are
looking
at
one
of
the
road
map
feature,
which
is,
if
you
set
it
at
the
site,
collection
level,
then
then
the
corresponding
entry
policy.
If
the
label
has
an
encryption
policy,
those
will
get
honored
by
all
the
files
underneath
the
site
collection
as
well.
That
is
one
of
our
roadmap
item.
We
are
looking
at
it.
B
A
A
great
question:
yes,
you
can
apply
the
sensitivity
label
on
a
classic
site
as
well.
However,
like
I
said
the
policies
which
is
the
device
policy
corresponding
policies.
If
it
is
available,
only
those
policies
will
get
honored
in
the
classic
sites.
Typically,
you
know
you
don't
need
to
have
a
groups
connected
site.
Let
me
put
it
that
way
in
order
to
apply
this
label
any
you
know
simple,
modern
SharePoint,
site
or
communication
site.
For
example,
you
can
apply
that
same
sensitivity,
label.
B
Great
and
then
last
one
because
I
know
that
you
have
still
have
some
content,
sir,
and
we'll
get
back
on
hopefully
in
the
end,
and
is
it
possible
to
sorry
do
we
have
any
options
to
automate
all
the
label
policy
using
a
partial
or
any
SDK?
So
again,
people
are
thinking
on
automating
this
to
multiple
tenants,
yeah.
A
So
I
think
so
this
is
mainly
we
do
have
an
MIP
SDK
and,
as
I
said,
there
are
API
is
available
in
SharePoint
and
in
ms
graph,
and
we
are,
you
know,
increasing
that
API
surface
I
wouldn't
say
that
everything
is
available
as
of
today.
There
are
a
few
API
is
available
to
retrieve
the
labels
of
the
sites
or
files,
and
we
are
working
on
adding
more
capabilities
in
that
regard.
The
automatic
classification
that
I
just
walked
you
through
the
demo,
with
the
auto
labeling
policy
and
so
on.
We
don't
have
those
as
API.
A
Yet,
in
fact
that
is,
as
you
can
see,
it
has
more
I
would
say
closer
in
terms
of
extensive
files.
It
could
potentially
just
touch
all
the
files
in
your
tenant.
So
that's
why
we
are
starting
in
a
very
thoughtful
fashion,
giving
you
that
control
through
our
auto
labeling
simulation
experience,
and
then
we
will
look
at
how
to
gradually
increase
it
into
exposing
as
a
programmatic,
API,
eventually
sure.
A
A
We
want
to
give
you
ability
to
look
at
the
whole
enterprise
corpus
and
say
how
many
files
are
actually
labeled
and
in
what
category
or
the
top
secret,
confidential
or
general
and
more
importantly,
are
there
site
collections
that
are
not
labeled,
and
perhaps
those
are
your
weakest
to
link
where
you
do
need
to
run
the
order
classification
like
a
premium
future
to
protect
to
detect
the
sensitive
files
and
then
also
do
auto
label
them
as
well.
So
this
is
where
the
content
Explorer
view
come
into
play.
A
So
we
provide
you
a
full
holistic
view
of
all
the
files
and
the
citations
that
are
labeled
here.
Also,
you
can
look
at
in
office
e65
audit
logs
the
full
experience
there
as
well.
So,
for
example,
if
I
go
back
to
my
slide,
my
demo
mission
here,
real
quick,
so
I
can
show
you
here.
Here
is
the
data
classification
content
Explorer
view
so
right
here
you
can
immediately
see
what
are
the
sensitive
information
types
used
in
your
tenant.
This
is
across
the
tenant
and
you
can
also
see
what
labels
are
heavily
used.
A
So,
in
my
case,
in
this
particular
demo,
tenant
I
have
top
secret
label
heavily
used,
followed
by
a
confidential,
followed
by
illegal
top-secret.
So
we
show
you
this
activity
and
if
you
go
into
the
content
Explorer,
you
get
even
much
richer,
granularity
on
insights
across
sensitive
information
types,
sensitivity,
labels
like
what
labels
are
being
used
and
so
on
so
here
I
can
see
that
credit
card
number
is
around
28
files
in
my
tenant
are
using
or
having
credit
card
numbers
in
them:
EU
debit
card
number,
25
files
or
having
them.
A
On
the
other
hand,
if
I
wanted
to
see
by
sensitivity,
label,
I
can
see
them
as
well
and
of
course,
as
you
look
at
these,
let's
say
top
secret.
If
you
want
to
double
click
on
it,
and
if
you
wanted
to
know
exactly
which
side
collections
or
having
those
files,
you
can
now
drill
down
them
as
well,
and
similarly
activity
explorer
gives
you
the
complete
activity
which
user
labelled,
which
file
or
which
particular
site
collection.
A
You
can
get
that
few
as
well,
so
not
only
here
in
also
in
office,
it
5
audit
log,
you
get
that
full
capability
as
well.
So
if
you
go
for
activity
type
like
sensitivity,
you
get
the
activity
officer.
For
example,
say:
Jie
has
removed
sensitivity
label
from
a
site,
he
applied
the
label
to
a
file,
and
then,
when
you
click
on
a
specific
activity,
it
will
tell
you
exactly
which
site
that
item
that
particular
label
activity
got
got
done.
So
we
explain
sure
that
the
end-to-end
you
can
see
the
full
visibility
as
well.
A
The
idea
here
is
that
if
you
are
a
very
security,
centric
enterprise
corpus,
every
upload
that
happens
to
the
far
to
the
service
until
an
DOP
scan
happens
on
the
file,
you
don't
want
that
file
to
be
a
turn
Alicia,
because
that
avoids
and
protects
your
content
from
leaking
to
wrong
hands.
Of
course,
once
a
DLP
scan
has
run
and
an
auto
labeling
policy
has
applied
auto
label
to
it,
then
it's
okay.
Now
you
know
that
continent
the
file
has
no
sensitive
content
or
it
has
little
content.
Now
the
appropriate
DLP
policy
has
been
applied.
A
So
that's
why
we
brought
this
feature
called
protect
sensitive
information
from
the
get-go,
so
this
is
one
other
feature.
I
want
to
highlight
it.
So,
just
to
summarize
I
know:
I
covered
a
lot
of
ground
on
this
topic
and
labels.
Protection
for
files,
I
showed
you,
the
HS
perience,
also
labels
protection
labels
for
sites
and
teams,
experienced
automatic
classification,
and
then
I
showed
you
quickly
the
content,
explorer
and
office
if
I
ordered
log
view
and
I
finished,
with
D
of
P
block
external
access
by
default
as
well.
So
that's
the
overall
view
there.
A
The
content,
like
teams
or
SharePoint
site
associated
with
advisers
are
only
accessible
by
advisory
users
and
the
user
who
sits
in
the
middle
like
the
general
users.
They
cannot
access
none
of
those
to
content,
and
this
is
the
very
I
would
say,
compliance
heavy
security,
heavy
feature
or
competitors
who
really
want
to
ensure
the
investment
banking
content.
Our
sites
are
only
SSL
by
investment
bankers,
the
advisory
content.
Our
sites
are
accessible
only
by
advisory
users.
A
So
that's
how
you
bring
in
the
barrier,
even
within
your
own
organization,
to
ensure
that,
for
example,
insider
trading,
like
scenarios
cannot
happen
in
the
organization.
It's
a
very
big,
especially
in
financial
industry,
is
the
very
big,
very
big
compliance
need,
and
this
is
called
information
barrier.
So
you
can
create
an
information
barrier,
create
some
segments
in
your
organization
and
then
create,
like
the
UX,
shows
here:
barrier
between
investment
bankers
and
advisory
bankers.
As
the
picture
shows
here,
you
are
actually
blocking
the
communication
and
collaboration
between
these
two
user
segments
and
an
example
scenario
here.
A
Just
to
be
clear.
This
is
not
just
for
financial
customers.
There
are
a
lot
of
energy
customers
and
healthcare
customers
where
they
need
such
a
advanced
security
scenario.
One
example
references
I,
always
use,
is
a
friend
Rock'em
'pliance
in
the
financial
and
FSI
SEC
star.
That's
where
this
is
heavily
used
and
I
know
I'm
getting
to
the
closer
to
the
to
the
time
so
I'm
going
to
skip
that
particular
demo.
I'm
going
to
go
right
into
the
roadmap
slide
and
I
will
leave
it
here
for
questions.
A
So
real
quick
I've
showed
you
the
sensitivity,
labels
for
teams
and
sites,
that's
already
in
preview,
and
it's
going
to
GA
this
summer
censored.
Labels
with
protection
for
files
is
already
g8.
As
of
last
week,
automatic
classification
with
sensitivity
labels,
the
demo
I,
showed
you
it's
in
public
preview.
We
plan
to
GA
that
in
the
summer
as
well
the
block
external
access
by
default.
This
is
to
protect
your
sensitive
data
from
the
get-go
it's
actually
available
as
GA
for
SharePoint
sites,
so
you
can
normally
use
them
now
for
onedrive.
A
B
A
Finally,
expiring
permissions
for
external
Isis
I
didn't
get
a
chance
to
try
it
out.
I'll
show
it
to
you
today,
but
we
have
this
cool
feature
for
if
the
external
users
today
invite
you
invite
them
to
a
SharePoint
site
or
a
file,
they
get
access
until
you
go
and
revoke
them
right
now
that
brings
up
the
problem
of
stale
permissions
that
are
being
there
and
we
are
now
providing
you
a
way
to
say
any
external
access
users
that
are
coming
trying
to
access
content
in
your
tenant.
A
You
can
say
after
60
days
that
axis
goes
away
and
if
the
site
owner
or
the
if
the
site
owner
wants
to,
he
can
extend
that
access.
So
that's
what
is
expiring
permissions
for
external
users.
He
looks
like
so
those
are
the
availab
things
that
are
coming
up
in
this
summer
through
summer,
and
then
we
also
have
few
items
by
the
end
of
the
calendar
year.
A
The
count
Explorer
the
view
that
I've
showed
you
I
think
that
will
very
soon
GA
as
well
the
co-op
experience
which,
adding
in
a
chance
to
show
it
to
you
today,
but
the
protected
files.
You
can
actually
co-author
them
in
office
on
the
web
as
well,
but
for
office
which
client
we
are
working
on,
bringing
that
forward
and
then
also
the
multi-factor
authentication
at
a
site
level.
So
imagine
you
have
a
top-secret
site
and
now
you
want
to
enforce
multi-factor
authentication.
You
can
use
that
you
can
do
that
as
well.
A
That's
something
we
are
working
on
in
our
roadmap
item
and
finally,
instant
session
revocation.
So
if
you
have
a
compromised
user
account,
you
can
instantly
they
work
their
session
and
that
will
get
Harnett
across
sharepoint,
onedrive
and
teams
as
well.
So
that's
my
roadmap
slide.
I!
Think
it's
a
good
slide
to
be
open
and
then
I
will
take
a
few
more
questions
back
to
you,
Alyssa
any
questions.
Yeah.
B
B
Take
actually
interesting
right
here,
that's
that's
clever,
but
then
they
will
say
quite
a
few
different
kind
of
questions.
So
that's
office,
office,
2016
and
office
2019
have
integration
in
there
or
MS
and
the
sensitivity
labels
out
of
the
box.
So
do
you
need
to
install
something,
or
is
the
office
clients
automatically
native
support
for
this
yeah.
A
Office,
clients
as
the
desktop
clients,
the
Office
ProPlus
and
the
2019
that
you
mentioned
automatically,
has
this
negative
support.
Now,
that's
actually
the
biggest
work
that
we
have
done
on
the
client
side
itself,
so
they
do
have
the
negative
support
and
of
course
it
doesn't.
You
know
it
doesn't
go
all
the
way
into
like
2013,
client
or
2010
client
like
that,
but
only
for
the
Pro
Plus
and
the
2019
client.
A
It
will
have
it
and,
as
I
can
see,
as
you
can
see
here,
one
other
item
I
called
out
is
office,
rich
client
coatt
for
protected
files.
That's
a
specific
feature
that
we
are
working
on.
That
is
not
yet,
but
you
can
open
the
file
in
pro
class
or
in
2019.
You
can
see
the
sensitivity
label
and
you
can
apply
the
label
on
the
file
good.
B
Good
now,
I'm
gonna
ask
one
more
question:
I
do
apologize,
you
missed
quite
a
few
of
the
questions.
Thank
you
by
the
way
for
those
who
were
answering
and
helping
other
questions
in
the
chat
as
well.
But
there
is
a
tech,
Community
Links
which
David
Warner
already
shared
on
the
chat
as
well,
and
if
you
go
to
them
in
the
SharePoint
blog
as
an
example
and
those
are
messages
from
xuxia
and
he
can
probably
answer
if
there's
any
questions
related
on
which
we
did
an
answer.
A
That's
the
great
great
thinking
and
the
feedback
there
are.
We
haven't
yet
finished
the
integration
with
the
power
automate
and
ability
to
set
these
properties
in
the
files
in
SharePoint,
and
definitely
that
is
one
of
the
integrations
that
we
are
looking
into
it
and
we'll
keep
you
posted
as
we
progress
on
that
excellent.