Before Copilot is switched on for anyone, someone asks whether the business should label its documents first. Most businesses have labelled almost nothing, and the instinct is either to skip labels entirely or to try to label everything. Neither extreme is needed, because a small number of labels, applied first to the places that hold your most sensitive material, does most of the work.
We are a Microsoft Solutions Partner for Microsoft 365 Copilot, and Cardonet is Certified in the Claude Partner Network.
What a label changes for Copilot
Microsoft's sensitivity labels mark a document or email with how sensitive it is, and can add protection such as encryption. Copilot respects them in three ways, according to Microsoft's own guidance:
- Where a label encrypts a file, Copilot returns its content only to people whose rights include both viewing it and extracting from it. A label can therefore let someone read a document while keeping Copilot from reusing it on their behalf.
- When Copilot creates something new from labelled sources, such as a summary or a draft, the new content inherits the most restrictive label among them. A summary of a confidential board paper is itself confidential.
- A data loss prevention rule scoped to Copilot can exclude files with chosen labels from being processed in its answers. Those files may still appear in its list of sources, but their content is not used.
Labels do not replace permissions
A label travels with a file, and it does not decide who can open it in the first place. In a folder shared with the whole business, a confidential spreadsheet is still open to everyone, label or no label, and Copilot will still find it for anyone who can open it.
A scheme small enough to use
Four labels are enough for most businesses of 50 to 500 people, and each needs a one-line meaning in your own words:
- Public: material already published or meant for anyone.
- General: everyday internal work. This should be the default, so most documents need no decision at all.
- Confidential: client material, contracts, pricing and anything under a confidentiality agreement.
- Highly confidential: the small set of material that very few people should see, such as payroll, board papers, unannounced deals and HR cases.
What to label first
- The places that hold highly confidential material. HR and payroll, board papers, finance before publication, legal matters and any client work a contract singles out usually live in a handful of SharePoint sites and libraries. Set a default label on those libraries, so everything in them is labelled without anyone choosing file by file.
- The templates for documents that are always sensitive, such as the board pack or the payroll export, so new copies start labelled.
- A default of General for everything else, so the business has a baseline without asking everyone to classify their work.
- Decide which label Copilot should never process, usually Highly confidential, and set the data loss prevention rule for it. People with access to those files lose Copilot's help on them, and for that material the loss is deliberate.
Check what your plan includes
Applying labels by hand is available in more Microsoft 365 plans than applying them automatically, and some Copilot-specific controls sit in higher plans still. Before designing around a feature you do not have, check what yours includes, because the gap can mean a plan change for some or all of your people. What Microsoft 365 Copilot costs covers that part of the bill.
Teach the labels in a minute
People need to know what each label means, when to choose a higher one and that anything Copilot makes from a labelled source carries the label with it. That fits on the acceptable use page and in the first week of Copilot training.
Where this fits
The order is permissions first, then labels on the sensitive places, then Copilot seats for the first team. The permissions review is described in Guardrails and sits inside Track. As people and sites change, keeping the label scheme and the rules current is part of Trackside.