Knowledge Article View - Service Portal

Introduction

Sensitivity labels are Microsoft and Google classifications that can be automatically or manually applied to emails and files to help people handle information appropriately.

Explanation

A label can:

Visually mark content (so recipients understand the risk level),
Prevent accidental sharing of sensitive content outside of the university (default high and moderate risk labels limit sharing to inside the university only)
Prevent the forwarding of sensitive emails to new recipients
Enforce encryption when content is shared outside of the university (Microsoft 365 only)

Labels are intended to identify and protect high or moderate risk data at Virginia Tech. To understand these types of data and how to protect them, please visit the IT Security Office (ITSO) at Virginia Tech Risk Classifications and Protecting Sensitive Data.

What protections do the labels apply?

Labels	Microsoft Protections	Google Protections
High Risk: Internal Use Only	Notifies users that the content is "high risk" Only invited VT recipients can open the email or document Prevents email forwarding Enforces encryption if the content is downloaded or shared by email External editors cannot change the label Forces Teams and SharePoint sites to become Private Can work with file in offline mode for up to 14 days	Notifies users that the content is "high risk" External sharing is blocked Can work with file in offline mode for up to 14 days Protections end if the document is downloaded
High Risk: Specific Users	Notifies users that the content is "high risk" All invited recipients can open the email or document Prevents email forwarding Enforces encryption if the content is downloaded or shared externally by email or direct link External editors cannot change the label Forces Teams and SharePoint sites to become Private Can work with file in offline mode for up to 14 days	Notifies users that the content is "high risk" All invited recipients can open the document Can work with file in offline mode for up to 14 days Protections end if the document is downloaded or shared externally by direct link
Moderate Risk: Internal Use Only	Notifies users that the content is "moderate risk" Only invited VT recipients can open the email or document Prevents email forwarding Enforces encryption if the content is downloaded or shared by email External editors cannot change the label Forces Teams and SharePoint sites to become Private Can work with file in offline mode for up to 14 days	Notifies users that the content is "moderate risk" External sharing is blocked Can work with file in offline mode for up to 14 days Protections end if the document is downloaded
Moderate Risk: Specific Users	Notifies users that the content is "moderate risk" All invited recipients can open the email or document Prevents email forwarding Enforces encryption if the content is downloaded or shared externally by email or direct link External editors cannot change the label Forces Teams and SharePoint sites to become Private Can work with file in offline mode for up to 14 days	Notifies users that the content is "moderate risk" All invited recipients can open the document Can work with file in offline mode for up to 14 days Protections end if the document is downloaded or shared externally by direct link
Low Risk	No additional protections or notifications provided	No additional protections or notifications provided

Where will I see them?

Sensitivity labels can appear or be applied in:

Microsoft Office apps (Word, Excel, PowerPoint, etc.)
Google Workspace apps (Docs, Sheets, Slides, etc.)
Outlook (desktop and web)
OneDrive
My Drive
Shared resources (shared drives, SharePoint, Teams, etc.)
Microsoft 365 Groups
Viva Engage Communities
Loop Workspaces
Power BI
Fabric

Are my documents protected outside of Virginia Tech?

These protections within the M365 environment “travel with the content,” so that even if a file or message is copied or moved, it remains protected. This only applies to Microsoft items. Google Workspace protections do not persist outside of the Virginia Tech environment.

What can you do next?

Create a shared space where content can be protected.
If you need to share with someone who is blocked, confirm whether the label you chose is the correct one for the audience.
If your work requires less restrictive sharing, attempt to change the label (you may be prompted for justification in Microsoft), or use a label designed for specific authorized recipients when available.

What are Sensitivity Labels?