This article describes why an automatic label of High- or Moderate- Risk got applied to your document and what you can do if you think the label was applied incorrectly.

A sensitivity label may be automatically applied when Microsoft or Google detects certain types of sensitive information. Locations scanned include employees’ OneDrive, My Drive, department shared resources (teams, shared drives, and sites), and mailboxes. Students are not included in the automatic scanning. However, students with a position that requires them to have an employee affiliation are an exception.

Examples of Items Detected

Automated Label Assignment Examples: High Risk (Internal Use Only)

• Credit card number
• U.S. Social Security number
• U.S. bank account number
• ABA routing number
• U.S. driver’s license number
• U.S. / U.K. passport number
• U.S. ITIN
• Medicare Beneficiary Identifier (not in Google)

Automated Label Assignment Examples: Moderate Risk (Internal Use Only)

• VT ID numbers
• Content referencing FARs or performance evaluations/reviews

What to do if you think it’s wrong

If you believe a label has been applied incorrectly:

• Re-check the content for items that look like numbers/identifiers (sometimes test data or sample values trigger detection).
• If you still believe it’s incorrect, you can manually change the label. You may need to provide justification when reducing protections in Microsoft.