{"id":13935,"date":"2024-04-03T16:02:52","date_gmt":"2024-04-03T23:02:52","guid":{"rendered":"https:\/\/cm-edgetun.pages.dev\/insidetrack\/blog\/?p=13935"},"modified":"2025-12-10T11:14:15","modified_gmt":"2025-12-10T19:14:15","slug":"empowering-employee-self-service-with-guardrails-how-were-using-sensitivity-labels-to-make-microsoft-more-secure","status":"publish","type":"post","link":"https:\/\/cm-edgetun.pages.dev\/insidetrack\/blog\/empowering-employee-self-service-with-guardrails-how-were-using-sensitivity-labels-to-make-microsoft-more-secure\/","title":{"rendered":"Empowering employee self-service with guardrails: How we\u2019re using sensitivity labels to make Microsoft more secure"},"content":{"rendered":"

At Microsoft, empowering our employees to do their best work means trusting them with self-determination. But to do that safely, we need clear data loss prevention systems in place.<\/p>\n

We describe it as self-service with guardrails.<\/p>\n

Giving employees that level of freedom relies on a robust governance strategy across our data estate that features employee-facing sensitivity labels for Microsoft 365 groups, SharePoint sites, Microsoft Teams, Viva Engage communities, and any other workspace or file employees create and use. The result of good governance is that employees can confidently take action in a self-service environment without the risk of revealing sensitive information.<\/p>\n

If you\u2019re considering updating your organization\u2019s governance strategy, our work in this space can be a roadmap for your journey.<\/p>\n

[<\/em>Learn how we\u2019re using sensitivity labeling to secure our meetings in Microsoft Teams Premium<\/em><\/a>. <\/em>Find out how we use self-service sensitivity labels in Microsoft 365<\/em><\/a>. <\/em>Check out how we\u2019re getting the most out of generative AI at Microsoft with good Governance<\/em><\/a>.] <\/em><\/p>\n

We had to really step back and think about data delineation in a way that\u2019s meaningful to the business and our employees. Labeling provides a way for us to impose policies onto objects and containers to prevent or contain any oversharing of sensitive content.<\/p>\n

\u2014 David Johnson, principal PM architect, Microsoft Digital<\/p>\n<\/blockquote>\n

What\u2019s at stake: The importance of getting self-service right<\/strong><\/h2>\n

To operate according to zero trust principles, we need a coherent system that lets us see, label, and protect data. Otherwise, the burden of data loss prevention falls solely on employees, who would have to exercise individual discretion whenever they\u2019re deciding how to house and share potentially sensitive content.<\/p>\n

That\u2019s a heavy burden to put on people every time they deal with working files.<\/p>\n

\u201cWe had to really step back and think about data delineation in a way that\u2019s meaningful to the business and our employees,\u201d says David Johnson, principal PM architect for Microsoft Digital (MSD), the company\u2019s IT organization. \u201cLabeling provides a way for us to impose policies onto objects and containers to prevent or contain any oversharing of sensitive content.\u201d<\/p>\n

Aside from protecting internal content, customer data, and proprietary information, the principal risk is introducing vulnerability into our data estate by leaving access credentials out in the open. For example, internal documentation might include intellectual property, like source code.<\/p>\n

\u201cWe have a lot of security investments in protecting our data centers and sources because they\u2019re where our most sensitive information lives, and credentials are a big part of accessing them,\u201d says Maithili Dandige, partner group product manager with Microsoft Security and Compliance.<\/p>\n

If malicious actors can access those credentials or other sensitive information, they can do a lot of damage. Properly classifying, labeling, and protecting files and containers is the best way to ensure sensitive information and credentials don\u2019t get compromised.<\/p>\n

User-centric sensitivity labels<\/h2>\n

Our IT professionals within MSD\u2014the organization that supports, protects, and empowers the company through technology\u2014collaborated with a cross-disciplinary team to get our governance structures right.<\/p>\n

\u201cWe spent a massive amount of time with the oversight committee,\u201d says Faye Harold, principal program manager for information protection services within Microsoft Security and Risk. \u201cThat involved our legal team, HR, security, and MSD to define what each label meant.\u201d<\/p>\n

It\u2019s important to strike a balance between the depth necessary for supporting an array of data governance controls and the simplicity to ensure labeling isn\u2019t burdensome for users.<\/p>\n

At Microsoft, we use four labels for container and file classification:<\/p>\n