CAB Runbook: Sensitivity Labels and DLP Policies

This runbook supports a Change Advisory Board (CAB) submission for deploying a sensitivity label taxonomy and foundational Data Loss Prevention (DLP) policies in Microsoft Purview. Complete the bracketed fields before submitting to your CAB.

Change Summary

Field	Value
Change Title	Deploy Microsoft Purview Sensitivity Label Taxonomy and Foundational DLP Policies
Change Type	Standard — New Capability
Risk Level	Medium
Estimated Downtime	None — configuration changes only; no service interruption expected
Rollback Available	Yes — labels and policies can be disabled or deleted within minutes
Implementation Window	[Insert maintenance window date/time and duration]
Implementer	[Insert name, title]
Backup Implementer	[Insert name, title]
CAB Sponsor	[Insert name, title]
Ticket / Change ID	[Insert change management ticket number]

Business Justification

GCC High (CMMC)

CMMC Level 2 requires that Controlled Unclassified Information (CUI) be identified, marked, and protected from unauthorized disclosure. This change implements the technical controls required by:

• NIST SP 800-171 Rev. 2 3.1.3 — Control the flow of CUI in accordance with approved authorizations
• NIST SP 800-171 Rev. 2 3.13.1 — Monitor, control, and protect communications at external boundaries
• NIST SP 800-171 Rev. 2 3.13.16 — Protect the confidentiality of CUI at rest

Without sensitivity labels, the organization cannot consistently identify CUI across Microsoft 365, and DLP policies cannot enforce information flow controls against unlabeled content. This change is the prerequisite for all subsequent Purview-based compliance controls.

Commercial

This change implements data classification and loss prevention controls required to meet regulatory obligations and reduce the risk of unauthorized disclosure of sensitive business information. Applicable frameworks include:

• NIST SP 800-171 Rev. 3 3.1.3 — Control the flow of CUI in accordance with approved authorizations
• HIPAA 45 CFR § 164.312(e) — Encryption and integrity controls for ePHI in transit
• GLBA Safeguards Rule 16 CFR Part 314 — Implement safeguards to control access to customer financial data

Without a deployed label taxonomy, DLP policies cannot reliably identify sensitive content at the point of sharing. This change is the prerequisite for all subsequent information protection controls.

Scope of Change

In Scope — Phase A: Sensitivity Labels

1. Enable MIP container labels for Microsoft 365 Groups in Entra ID (one-time PowerShell command — no user-facing impact)
2. Create four sensitivity labels in the Microsoft Purview compliance portal

GCC High (CMMC)

Label	CUI Mapping	Encryption	Container Support
Public	Not CUI	No	No
General	Not CUI — internal operational data	No	Yes
CUI — Basic	CUI Basic (standard safeguarding)	Recommended	Yes
CUI — Specified	CUI Specified (enhanced safeguarding)	Required	Yes

Commercial

Label	Sensitivity Tier	Encryption	Container Support
Public	Publicly available data	No	No
Internal	Internal operational data	No	Yes
Restricted	Regulated content (PII, financial)	No	Yes
Highly Restricted	Board-level / HR / credentials	Yes	Yes

3. Publish a label policy targeting all users with the following settings:
   • Default label for files and emails: General (or Internal)
   • Mandatory labeling: On — users must select a label before saving or sending
   • Justification required on downgrade or removal: On

In Scope — Phase B: Foundational DLP Policies

Seven DLP policies deployed across Exchange, SharePoint, OneDrive, and Teams:

Priority	Policy Name	Workload	Initial Mode	Action
0	Exchange — Credential Alert	Exchange	Enforced	Block send + alert
1	OneDrive — Credential Alert	OneDrive	Enforced	Restrict access + alert
2	SharePoint — Credential Alert	SharePoint	Enforced	Restrict access + alert
3	Teams — Credential Alert	Teams	Simulation	Alert only
4	Exchange — Sensitive Label External Sharing	Exchange	Enforced	Alert + override with justification
5	OneDrive — Sensitive Label External Sharing	OneDrive	Enforced	Alert + restrict access
6	SharePoint — Sensitive Label External Sharing	SharePoint	Enforced	Alert + restrict access
7	Exchange — Restricted Label External Sharing	Exchange	Enforced	Alert
8	OneDrive — Restricted Label External Sharing	OneDrive	Enforced	Alert
9	SharePoint — Restricted Label External Sharing	SharePoint	Enforced	Alert

Teams Credential Alert (Priority 3) remains in Simulation mode for 30 days due to elevated false-positive risk on code snippets and configuration files shared in technical channels. Promotion to Enforced requires a post-deployment review (see Validation Plan).

Out of Scope — Reserved for Phase 2 Submission

The following capabilities are excluded from this change and will be addressed in a subsequent CAB submission:

• Endpoint DLP (USB copy, cloud upload, print, RDP clipboard controls)
• Microsoft 365 Copilot label enforcement
• Client-side and service-side auto-labeling policies
• Insider Risk Management integration
• PII and Finance SIT-based detection policies

Prerequisites

All prerequisites must be verified before the implementation window opens.

#	Prerequisite	Verified By	Notes
1	Microsoft Purview compliance portal access — Global Administrator or Compliance Administrator role	[Name]	Required to create labels and policies
2	Exchange Online Administrator role	[Name]	Required for IPPS session during container label sync
3	Microsoft Entra ID P1 or P2 license for at least one admin account	[Name]	Required for container label enablement
4	Microsoft 365 E3/E5 or equivalent licenses for all in-scope users	[Name]	Sensitivity labels require M365 Apps for Enterprise; DLP requires E3 minimum
5	No existing conflicting label policies in the tenant	[Name]	Check in Purview portal → Information Protection → Label policies
6	Approved list of partner/external domains authorized to receive CUI or sensitive content	[Name]	Required for Phase B DLP Allowed Domains configuration
7	Security team distribution group or mailbox for DLP incident reports	[Name]	e.g., security-alerts@[org].com
8	Change freeze status confirmed — no competing changes to Exchange transport rules or mail flow during window	[Name]	Avoid overlapping with mail flow configuration changes

Implementation Plan

Estimated total implementation time: 90–120 minutes for a tenant with no pre-existing label configuration.

Phase A: Sensitivity Labels (~45 minutes)

Step A-1: Enable container labels in Entra ID (~10 minutes)

1. Open PowerShell as an account with Global Administrator or Entra roles.
2. Run the following commands:

# Install required modules if not present
Install-Module Microsoft.Graph.Beta -Scope CurrentUser -Force
Install-Module ExchangeOnlineManagement -Scope CurrentUser -Force

# Enable MIP labels for M365 Groups
Connect-MgGraph -Scopes "Directory.ReadWrite.All"
$template = Get-MgBetaDirectorySettingTemplate | Where-Object { $_.DisplayName -eq "Group.Unified" }
$settingParams = @{
    TemplateId = $template.Id
    Values = @(@{ Name = "EnableMIPLabels"; Value = "True" })
}
New-MgBetaDirectorySetting -BodyParameter $settingParams

# Sync labels from Purview to Entra
Connect-IPPSSession
Execute-AzureAdLabelSync
Disconnect-ExchangeOnline

3. Verify: In Entra ID → Groups → Settings, confirm EnableMIPLabels = True.

Step A-2: Create sensitivity labels (~20 minutes)

1. Navigate to Microsoft Purview compliance portal → Information Protection → Labels.
2. Create each label in the order listed in the Scope section (Public first, highest sensitivity last).
3. For each label, configure:
   • Display name and description (user-facing tooltip text)
   • Scope: Files, Emails (and Sites/Groups for General/Internal and above)
   • Encryption settings per the label design in the Scope section
   • Content marking: footer with the label name (CUI banner for CUI-aligned labels)
4. Verify all four labels appear in the label list with correct priority order.

Step A-3: Publish label policy (~15 minutes)

1. Navigate to Information Protection → Label policies → Publish labels.
2. Select all four labels.
3. Assign to: All users and groups (or a pilot group if a phased rollout is preferred — see Risk Register).
4. Configure policy settings:
   • Default label for documents: General (or Internal)
   • Default label for emails: General (or Internal)
   • Require users to apply a label: On
   • Require justification for label removal or downgrade: On
   • Provide a help link: [Insert link to internal data classification policy]
5. Name the policy: [ORG] — Standard Label Policy v1.0

Label propagation

Sensitivity labels appear in Office clients (Word, Excel, Outlook) within 24 hours of policy publication. Plan the communication timeline accordingly.

Phase B: Foundational DLP Policies (~45–75 minutes)

Step B-1: Configure compliance alert destination

1. Navigate to Microsoft Purview compliance portal → DLP → Alerts → Settings.
2. Configure the incident report recipient mailbox: [security-alerts@org.com]
3. Verify the mailbox is reachable and monitored.

Step B-2: Create credential protection policies (Priorities 0–3)

For each workload (Exchange, OneDrive, SharePoint, Teams):

1. Navigate to DLP → Policies → Create policy → Custom → Custom policy.
2. Name: [Workload] — Credential Alert
3. Scope: All locations within the workload
4. Rule condition: Content contains → Sensitive info type → Add: General Password, Software Development Credentials, Azure Active Directory Client Secret
5. Rule action:
   • Exchange: Block the email and notify the user
   • OneDrive / SharePoint: Restrict access — remove external sharing links
   • Teams: Alert only (Simulation mode for first 30 days)
6. Alert settings: Generate an alert for every rule match; send to the incident report mailbox
7. Policy mode: Enforced (Teams: Simulation)

Step B-3: Create label-based external sharing alert policies (Priorities 4–9)

For Exchange, OneDrive, and SharePoint:

1. Navigate to DLP → Policies → Create policy → Custom → Custom policy.
2. Name per the priority table in the Scope section (e.g., Exchange — Sensitive Label External Sharing)
3. Scope: The applicable workload
4. Rule condition: Content is labeled → [Highest sensitivity label] AND Content is shared → With people outside the organization

GCC High (CMMC)

5. Add an Allowed Domains exception for each policy at priorities 4–9: Recipient domain is one of → list approved partner GCC High tenant domains. CUI may only be shared externally to these domains even if the user provides justification.

Commercial

5. Optionally add an Allowed Domains exception for known regulatory recipients (external auditors, regulators, law firms) to reduce false-positive alert volume.

6. Rule action:
   • Priorities 4–6 (Highest sensitivity): Alert + require override justification
   • Priorities 7–9 (Restricted tier): Alert only
7. Alert severity:
   • Priorities 4–6: High
   • Priorities 7–9: Medium
8. Policy mode: Enforced

Step B-4: Verify policy priority order

1. Navigate to DLP → Policies.
2. Confirm policies are ordered 0 through 9 as specified. Adjust priority manually if the portal has assigned different numbers.

Validation Plan

Complete all validation steps before closing the change ticket. Document pass/fail for each item.

#	Test	Expected Result	Validated By
V-1	Send an email containing a plaintext password to an external address	Exchange — Credential Alert triggers; email is blocked; user receives policy tip	[Name]
V-2	Upload a file containing a test credential string to OneDrive and share externally	OneDrive — Credential Alert triggers; external sharing link is removed	[Name]
V-3	Create a new Word document; attempt to save without applying a label	Mandatory labeling prompt appears; document cannot be saved until a label is selected	[Name]
V-4	Apply the highest sensitivity label to a test file; share externally via SharePoint	SharePoint — Sensitive Label External Sharing policy triggers; alert generated to security mailbox	[Name]
V-5	In a test Teams channel, post a message containing a test credential string	Teams — Credential Alert records event in simulation log; no user-facing block (simulation mode)	[Name]
V-6	Downgrade a labeled document from the highest sensitivity label to Public	Justification prompt appears; downgrade is recorded in Activity Explorer and Unified Audit Log	[Name]
V-7	Verify labels appear in Office clients (Word, Outlook) for a test user account	Labels visible in the sensitivity label picker with correct display names and tooltips	[Name]
V-8	Open Activity Explorer in Purview and confirm test events from V-1 through V-6 are visible	All test events appear with user, workload, label, and justification data	[Name]

30-Day Post-Deployment Review

Within 30 days of implementation:

1. Review DLP Alerts dashboard for false-positive alert volume on credential policies.
2. Review Teams simulation log (Priority 3) — if false-positive rate is acceptable, promote to Enforced and submit a minor change request.
3. Export Activity Explorer data to confirm label adoption rates are trending upward.
4. Present findings to the CAB sponsor before the Phase 2 submission.

Rollback Plan

Labels and DLP policies can be reversed without service interruption.

Scenario	Rollback Procedure	Estimated Time
Label policy causes user disruption (help desk volume spike)	Set mandatory labeling to Off in the label policy settings; this removes the forced prompt while leaving labels available	5 minutes
DLP policy causes legitimate mail to be blocked	Set the affected policy to Simulation mode or disable the specific rule; does not require deleting the policy	5 minutes
Labels need to be removed entirely	Unpublish the label policy first; wait 24 hours for client propagation to clear; then delete labels. Labels cannot be deleted while active in a policy.	24+ hours
Container label sync causes Groups configuration issue	Revert EnableMIPLabels to False via the Entra directory settings PowerShell commands	10 minutes

Label deletion is permanent

Sensitivity labels that have been applied to files cannot be removed by deleting the label definition — the label metadata persists in the file. Rollback of the label policy only affects new labeling behavior, not already-labeled content. Do not delete label definitions unless directed by Microsoft support.

Risk Register

GCC High (CMMC)

Risk	Likelihood	Impact	Mitigation
Mandatory labeling generates help desk volume in the first week	High	Low	Pre-deployment communication with brief user guidance; set a 5-business-day support buffer
Credential DLP blocks a legitimate automated process (service account, pipeline)	Low	High	Audit Exchange transport rules and known automation accounts before deployment; add sender exclusions for identified service accounts
CUI — Specified encryption prevents a user from opening a file on a non-corporate device	Medium	Medium	Scope CUI — Specified label permissions to a security group; add authorized external devices to the group before deployment
External partner blocks due to Allowed Domains list being incomplete	Medium	Medium	Confirm the approved partner domain list with the security team before deployment; test with a known partner tenant before go-live
Labels do not appear in Office clients within expected timeframe	Low	Low	Policy propagation can take up to 24 hours; inform users not to expect immediate availability; verify via test account

Commercial

Risk	Likelihood	Impact	Mitigation
Mandatory labeling generates help desk volume in the first week	High	Low	Pre-deployment communication with brief user guidance; set a 5-business-day support buffer
Credential DLP blocks a legitimate automated process (service account, pipeline)	Low	High	Audit Exchange transport rules and known automation accounts before deployment; add sender exclusions for identified service accounts
Highly Restricted encryption prevents file access for an authorized external party	Medium	Medium	Scope Highly Restricted encryption to a security group; add authorized users before deployment; test access with the recipient before go-live
DLP alert volume overwhelms the security mailbox	Medium	Medium	Set alert aggregation to daily digest for Medium-severity alerts; reserve real-time alerts for High-severity policies only
Labels do not appear in Office clients within expected timeframe	Low	Low	Policy propagation can take up to 24 hours; inform users not to expect immediate availability

Communication Plan

Audience	Message	Timing	Delivered By
All Microsoft 365 users	New sensitivity labels are being added to Office applications. You will be asked to select a label when saving documents or sending email. A brief guide is available at [link].	5 business days before go-live	[Name / Communication channel]
IT Help Desk	Sensitivity label training brief: expected user questions, where labels appear, how to reset a label, and escalation path for legitimate DLP blocks	3 business days before go-live	[Name]
Security / Compliance team	DLP incident report mailbox is live as of [date]. Review the alert dashboard at [Purview portal link] within 48 hours of go-live. Escalation path for enforcement disputes: [Name/ticketing queue].	Day of go-live	[Name]
CAB Sponsor	Post-implementation summary within 5 business days of go-live confirming validation results and help desk ticket volume	Within 5 business days	[Name]

Change Record

Field	Value
Submitted by	[Name]
Submission date	[Date]
CAB review date	[Date]
CAB decision	[ ] Approved [ ] Approved with conditions [ ] Deferred [ ] Rejected
Conditions / Notes
Approved by	[Name, title]
Implementation date (actual)
Closed by	[Name]
Closure date