---
title: Sensitivity Labels
description: Measure what your Microsoft Purview labels actually cover - real file and email counts per label, which labels truly protect, and where classification exists only on paper.
icon: Tag
---

# Sensitivity Labels

The Sensitivity Labels screen answers a question your labeling policy can't: **"How much of our data is actually labeled - and does the label actually protect it?"** Organizations invest months designing Purview taxonomies, then never measure deployment. This screen shows the ground truth: for every label, how many real files, emails, and groups carry it - and whether it enforces protection or just decorates the ribbon.

## What You Can Achieve

<Cards>
  <Card
    title="Measure real label coverage"
    description="Live counts of files, emails, and groups per label. A 'Highly Confidential' label applied to 12 files isn't a data protection program - now you can see that, and fix it."
  />
  <Card
    title="Separate protection from decoration"
    description="Some labels encrypt and watermark; others only display a name. The Has Protection flag tells you which of your labels would actually stop a leaked file from being read."
  />
  <Card
    title="Audit the taxonomy itself"
    description="Inactive labels still applied to content, priority orders that no longer make sense, labels scoped to formats nobody uses - the configuration drift Purview accumulates silently."
  />
  <Card
    title="Prove coverage to auditors"
    description="Replace 'we have a labeling policy' with per-label deployment numbers - evidence of a control operating, not just designed."
  />
</Cards>

## Working With Purview, Not Against It

The labels themselves are Microsoft Purview's - 1Security syncs them natively, so everything here always agrees with your Purview configuration. What 1Security adds is the measurement layer Purview doesn't have:

- **Ground-truth deployment.** Live per-label counts across real files, emails, and groups - not the policy as designed, but where labels actually landed.
- **The unlabeled side.** The coverage-gap analysis (sensitive data carrying no label) is powered by 1Security's own scanning engine, so it works even where Purview detections don't reach.
- **Cross-estate context.** Labels join the same graph as sites, users, groups, and apps, so a label's real reach is one pivot away.

No special licensing is required on 1Security's side - a Business Basic tenant is enough for every insight 1Security produces itself, including the sensitivity detections behind the coverage-gap view. Purview enhances the picture with its labels and detections, and remediation stays where it belongs: taxonomy, auto-labeling, and enforcement are configured in Purview - 1Security shows you exactly where they're needed.

## The Label List

Each row is one label synced from Microsoft Purview: its real usage counts across **files**, **emails**, and **groups**, whether it enforces **protection** (encryption, watermarking), whether it's currently **active** in the tenant, the **content formats** it applies to, and its Purview **priority**. Click a label to drill into the resources carrying it.

## Investigative Patterns

<Callout type="info">
  **The false-comfort check**: find your highest-priority labels **without
  protection** but with high file counts. Thousands of documents marked
  "Confidential" that any recipient can open and forward - the gap between
  labeled and protected is where leaks live.
</Callout>

Coverage has two sides, and this screen shows only the labeled one. For the other side - sensitive data carrying **no** label - go to the [Files screen](/en/docs/screens/files) and filter **with sensitive info** + **without label**. Together the two views turn "are we protected?" into a number you can track quarter over quarter.