Sensitivity labels are metadata attached to files, emails, and other content to signal how that data should be handled. A label can mark something as public, internal, confidential, or highly restricted, and the platform can use that tag to apply controls such as encryption, watermarking, access limits, or warning prompts. In Microsoft 365-style environments, labels often travel with the content so the protection follows the document instead of staying tied to one storage location.
They matter because classification only helps when it changes behavior. Good labels reduce accidental sharing, guide users before they send sensitive material, and let security teams automate policy enforcement. In defense, labels can drive DLP rules, block external forwarding, or require stronger permissions. In attacks, weak or missing labels create blind spots: sensitive files may be shared too broadly, copied into shadow repositories, or excluded from policy because they were never tagged correctly. Consistent labeling is therefore both a governance control and a security control.