Sensitivity Labels
Measure what your Microsoft Purview labels actually cover - real file and email counts per label, which labels truly protect, and where classification exists only on paper.
Sensitivity Labels
The Sensitivity Labels screen answers a question your labeling policy can't: "How much of our data is actually labeled - and does the label actually protect it?" Organizations invest months designing Purview taxonomies, then never measure deployment. This screen shows the ground truth: for every label, how many real files, emails, and groups carry it - and whether it enforces protection or just decorates the ribbon.
What You Can Achieve
Measure real label coverage
Live counts of files, emails, and groups per label. A 'Highly Confidential' label applied to 12 files isn't a data protection program - now you can see that, and fix it.
Separate protection from decoration
Some labels encrypt and watermark; others only display a name. The Has Protection flag tells you which of your labels would actually stop a leaked file from being read.
Audit the taxonomy itself
Inactive labels still applied to content, priority orders that no longer make sense, labels scoped to formats nobody uses - the configuration drift Purview accumulates silently.
Prove coverage to auditors
Replace 'we have a labeling policy' with per-label deployment numbers - evidence of a control operating, not just designed.
Working With Purview, Not Against It
The labels themselves are Microsoft Purview's - 1Security syncs them natively, so everything here always agrees with your Purview configuration. What 1Security adds is the measurement layer Purview doesn't have:
- Ground-truth deployment. Live per-label counts across real files, emails, and groups - not the policy as designed, but where labels actually landed.
- The unlabeled side. The coverage-gap analysis (sensitive data carrying no label) is powered by 1Security's own scanning engine, so it works even where Purview detections don't reach.
- Cross-estate context. Labels join the same graph as sites, users, groups, and apps, so a label's real reach is one pivot away.
No special licensing is required on 1Security's side - a Business Basic tenant is enough for every insight 1Security produces itself, including the sensitivity detections behind the coverage-gap view. Purview enhances the picture with its labels and detections, and remediation stays where it belongs: taxonomy, auto-labeling, and enforcement are configured in Purview - 1Security shows you exactly where they're needed.
The Label List
Each row is one label synced from Microsoft Purview: its real usage counts across files, emails, and groups, whether it enforces protection (encryption, watermarking), whether it's currently active in the tenant, the content formats it applies to, and its Purview priority. Click a label to drill into the resources carrying it.
Investigative Patterns
The false-comfort check: find your highest-priority labels without protection but with high file counts. Thousands of documents marked "Confidential" that any recipient can open and forward - the gap between labeled and protected is where leaks live.
Coverage has two sides, and this screen shows only the labeled one. For the other side - sensitive data carrying no label - go to the Files screen and filter with sensitive info + without label. Together the two views turn "are we protected?" into a number you can track quarter over quarter.