How to Use Sensitivity Labels by Matter in Microsoft 365

Should a law firm create a sensitivity label for every matter?

No. Microsoft recommends keeping labels to a minimum, and a firm with hundreds of open matters would bury attorneys in choices. Sensitivity labels for law firms work best as a short list that describes how sensitive a document is, with the matter workspace deciding which label applies.

Microsoft's overview of sensitivity labels says real-world deployments lose effectiveness when users see more than five main labels or more than five sublabels under one main label. It also caps labels that apply encryption with specified users and permissions at 500 per tenant. A matter-by-matter label scheme hits both problems quickly.

The better model is a matter workspace in SharePoint or Teams that carries the protection, with a firm-wide label set applied to the documents inside it. Attorneys pick the matter. The system picks the label.

Why do labels matter more now that attorneys use AI?

Labels matter more because AI tools inside Microsoft 365 read what a user can open, and labels are one of the few controls that travel with a document. A label tells Copilot, DLP and other services how to treat a file, wherever it is saved.

Microsoft states that Microsoft 365 Copilot only surfaces data a user already has at least view permission to, and honors the usage rights set by label encryption. A DLP policy for the Copilot location can go further and exclude files with a chosen label from Copilot processing entirely. Neither works well if privileged documents carry no label.

The ethics rules give this weight. California Business and Professions Code section 6068(e)(1) requires an attorney to maintain inviolate the confidence, and at every peril to preserve the secrets, of a client. The State Bar's practical guidance on generative AI says a lawyer must not put confidential client information into an AI tool without adequate confidentiality and security protections, and that managerial lawyers should set clear policies. ABA Formal Opinion 512 makes similar points and is persuasive authority in California. Rules 5.1 and 5.3 of the California Rules of Professional Conduct put the duty to build those measures on lawyers with managerial authority.

What sensitivity labels should a law firm use?

A small or midsize law firm should use a short set of four or five labels, ordered from least to most restrictive, which stays within Microsoft's guidance. Microsoft puts the most restrictive label at the bottom of the priority list, and a document can carry only one label at a time.

• General: firm administration, marketing and anything meant for wide internal use.
• Confidential, Client: the default for client work. Adds a header or footer marking, no encryption.
• Highly Confidential, Privileged: attorney work product and privileged communications. Adds a visible marking and is the label DLP and Copilot policies key on.
• Highly Confidential, Restricted Matter: encryption limited to a named security group, used only for walled or unusually sensitive matters.

Microsoft's guidance says it is usually not a good idea to make a label that applies encryption the default for documents. Keep the default unencrypted and reserve encryption for the restricted label.

How do you apply labels by matter, step by step?

Give each matter, or each client for smaller practices, its own SharePoint site or Team, label the workspace, and set a default label on its document library. Documents then pick up the right label when they are saved.

• Create the labels and publish them in a label policy, with the scope set to files and the scope for groups and sites turned on.
• Turn on sensitivity labels for Office files in SharePoint and OneDrive, so labels work on stored documents and in Office for the web.
• Create a container label for matter workspaces. A container label can make the site private, control whether owners can add guests, limit external sharing and restrict access from unmanaged devices through Conditional Access. Microsoft notes that items in the site do not inherit the container label, so the files still need their own labels.
• Set a default sensitivity label on the document library, usually Confidential, Client. New uploads and edited files receive it if they have no label or a lower-priority one. It does not override a label an attorney chose manually, and it does not touch files at rest until they are edited.
• For restricted matters, assign the Restricted Matter label to the matter group and pair it with information barriers where the firm needs an ethical wall in Teams, SharePoint and OneDrive.
• Add a DLP rule that blocks or warns when Highly Confidential documents are shared outside the firm, and a Copilot location DLP rule if the firm wants privileged files kept out of Copilot. The same labels drive rules that keep privileged documents out of other AI tools.

Label existing documents in a planned pass. Because library defaults only apply on upload or edit, older matter files stay unlabeled until someone opens and saves them, or until the firm runs an auto-labeling policy.

What licenses does matter-based labeling need?

Manual labeling is included in Microsoft 365 Business Premium. The library default label and service-side auto-labeling are not.

According to the Microsoft Purview service description, manual labeling is available with Business Premium, Microsoft 365 E3 and E5, among others. Default labels for SharePoint libraries and client and service-side automatic labeling require Microsoft 365 E5, Office 365 E5 or a Microsoft 365 E5 Information Protection and Governance license. Firms on Business Premium should ask their Microsoft partner which add-on brings these features to the users who need them, and confirm current licensing before designing around a feature.

What should the firm do this quarter?

Settle the label names, pilot them on a few active matters, then roll the pattern out to new matters first.

• Agree on four or five labels with the managing partner and the firm's general counsel or ethics partner.
• Publish them to a pilot group and apply them in three to five matter workspaces.
• Set container labels and library defaults on the pilot sites and confirm documents pick up the right label.
• Add the DLP rules for external sharing and Copilot, starting in test mode.
• Write the label definitions into the firm's AI policy and information security policy, and train attorneys and staff in a short session.
• Plan an auto-labeling or manual pass for existing matter files.

How does s90 help?

s90 designs and deploys sensitivity labels, matter workspaces and DLP for law firms as part of its data protection service. We build the label set with your firm's leadership, set up matter templates so new matters are labeled from the start, and keep the policy record your managing partner can point to if a client or the State Bar asks how confidential information is protected. If you want to see how this would look in your tenant, we can start with a short review.