This article describes why an automatic label of High- or Moderate- Risk got applied to your document and what you can do if you think the label was applied incorrectly.

A sensitivity label may be automatically applied when Microsoft or Google detects certain types of sensitive information. Locations scanned include employees’ OneDrive, My Drive, department shared resources (teams, shared drives, and sites), and mailboxes. Students are not included in the automatic scanning. However, students with a position that requires them to have an employee affiliation are an exception.

Examples of Items Detected

Automated Label Assignment Examples: High Risk (Internal Use Only)

• Credit card number
• U.S. Social Security number
• U.S. bank account number
• ABA routing number
• U.S. driver’s license number
• U.S. / U.K. passport number
• U.S. ITIN
• Medicare Beneficiary Identifier (not in Google)

Automated Label Assignment Examples: Moderate Risk (Internal Use Only)

• VT ID numbers

What to do if you think it’s wrong

If you believe a label has been applied incorrectly:

• Re-check the content for items that look like numbers/identifiers (sometimes test data or sample values trigger detection).
• If you still believe it’s incorrect, you can manually change the label. You may need to provide justification when reducing protections in Microsoft. We recommend using the label designated for low risk instead of removing the label altogether. Content in the file triggered a sensitive info detection and resulted in a high or moderate label being auto applied. Using the Low Risk label will prevent the system from reapplying the incorrect label.