CAB Runbook: Sensitivity Labels and DLP Policies

This runbook supports a Change Advisory Board (CAB) submission for deploying a sensitivity label taxonomy and foundational Data Loss Prevention (DLP) policies in Microsoft Purview. Complete the bracketed fields before submitting to your CAB.

Change Summary

Field	Value
Change Title	Deploy Microsoft Purview Sensitivity Label Taxonomy, Foundational DLP Policies, and SSN PII Baseline
Change Type	Standard: New Capability
Risk Level	Medium
Estimated Downtime	None: configuration changes only; no service interruption expected
Rollback Available	Yes: labels and policies can be disabled or deleted within minutes
Implementation Window	[Insert maintenance window date/time and duration]
Implementer	[Insert name, title]
Backup Implementer	[Insert name, title]
CAB Sponsor	[Insert name, title]
Ticket / Change ID	[Insert change management ticket number]

Business Justification

GCC High (CMMC)

CMMC Level 2 requires that Controlled Unclassified Information (CUI) be identified, marked, and protected from unauthorized disclosure. This change implements the technical controls required by:

• NIST SP 800-171 Rev. 2 3.1.3: Control the flow of CUI in accordance with approved authorizations
• NIST SP 800-171 Rev. 2 3.13.1: Monitor, control, and protect communications at external boundaries
• NIST SP 800-171 Rev. 2 3.13.16: Protect the confidentiality of CUI at rest

Without sensitivity labels, the organization cannot consistently identify CUI across Microsoft 365, and the label-based controls in this change (encryption, container settings, and the DLP rules at Priorities 6 and 9) have nothing to act on. This change is the prerequisite for those controls. The sensitive-information-type rules in the same change (Priorities 2 and 12) evaluate content directly and do not depend on it.

Commercial

This change implements data classification and loss prevention controls required to meet regulatory obligations and reduce the risk of unauthorized disclosure of sensitive business information. Applicable frameworks include:

• NIST SP 800-171 Rev. 3 3.1.3: Control the flow of CUI in accordance with approved authorizations
• HIPAA 45 CFR § 164.312(e): Encryption and integrity controls for ePHI in transit
• GLBA Safeguards Rule 16 CFR Part 314: Implement safeguards to control access to customer financial data

Without a deployed label taxonomy, the encryption, container, and label-conditioned DLP controls in this change have nothing to act on; this change is the prerequisite for those. The sensitive-information-type rules in the same change evaluate content directly and proceed on their own.

Scope of Change

In Scope, Stage A: Sensitivity Labels

1. Enable MIP container labels for Microsoft 365 Groups in Entra ID (one-time PowerShell command, no user-facing impact)
2. Create the sensitivity label taxonomy in the Microsoft Purview compliance portal (GCC High: six label objects, the CUI parent and its three sublabels among them; Commercial: four labels)

GCC High (CMMC)

Label	CUI Mapping	Encryption	Container Support
Public	Not CUI	No	No
Internal	Not CUI: internal business information	No	Yes
CUI (parent)	Grouping only: holds the three sublabels and cannot be applied itself	n/a	n/a
CUI (Basic)	CUI Basic: the authority does not specify handling, so the NIST SP 800-171 baseline applies	Yes (All Employees)	Yes
CUI//SP-CTI	CUI Specified: Controlled Technical Information under DFARS 252.204-7012	Yes (All Employees)	Yes
CUI//SP-EXPT	CUI Specified under ITAR (22 CFR 120.21); other export authorities per the registry's authority table. US persons only	Yes (sg-us-persons)	Yes, external sharing none

Users see three top-level choices (Public, Internal, CUI); CUI opens to the three sublabels. Basic and Specified are the two handling classes, and the class comes from the law behind the information. Basic means the law says protect it, so the NIST SP 800-171 baseline applies; Specified means the law says how, and the sublabels exist because those rules change both the banner and the permissions. The sublabel mechanics (a parent is a grouping and cannot be applied, each sublabel carries its own settings, a label policy or a DLP condition can select the parent to include every sublabel) are in Sensitivity Labels.

Commercial

Label	Sensitivity Tier	Encryption	Container Support
Public	Publicly available data	No	No
Internal	Internal operational data	No	Yes
Confidential	Regulated content (PII, financial)	No	Yes
Restricted	Board-level / HR / credentials	Yes	Yes

3. Publish a label policy targeting all users with the following settings:
   • Default label for files and emails: Internal (never a parent label: the CUI parent cannot be applied)
   • Mandatory labeling: On: users must select a label before saving or sending
   • Justification required on downgrade or removal: On

In Scope, Stage B: Foundational DLP Policies

Thirteen DLP policies deployed across Exchange, SharePoint, OneDrive, and Teams:

Priority	Policy Name	Workload	Initial Rollout	Action
0	Exchange - Credential Alert	Exchange	Enforced, test group → All users	Block send + alert
1	OneDrive - Credential Alert	OneDrive	Enforced, test group → All users	Block access + alert
2	SharePoint - Credential Alert	SharePoint	Simulation tenant-wide → Enforced	Block access + alert
3	Teams - Credential Alert	Teams	Enforced, test group → All users	Alert only
4	Exchange - CUI//SP / Restricted Label External Sharing	Exchange	Enforced, test group → All users	Block + override with justification (GCC High: two rules; the CUI//SP-EXPT rule blocks with no override)
5	OneDrive - CUI//SP / Restricted Label External Sharing	OneDrive	Enforced, test group → All users	Block access + alert
6	SharePoint - CUI//SP / Restricted Label External Sharing	SharePoint	Enforced tenant-wide (label-based condition is deterministic)	Block access + alert
7	Exchange - CUI (Basic) / Confidential Label External Sharing	Exchange	Enforced, test group → All users	Alert
8	OneDrive - CUI (Basic) / Confidential Label External Sharing	OneDrive	Enforced, test group → All users	Alert
9	SharePoint - CUI (Basic) / Confidential Label External Sharing	SharePoint	Enforced tenant-wide (label-based condition is deterministic)	Alert
10	Exchange - SSN Alert	Exchange	Enforced, test group → All users	Alert
11	OneDrive - SSN Alert	OneDrive	Enforced, test group → All users	Alert
12	SharePoint - SSN Alert	SharePoint	Simulation tenant-wide for 30 days → Enforced (Alert action retained)	Alert

Policy names at Priorities 4 through 9 read GCC High / Commercial. The GCC High block tier (CUI//SP) conditions on the two Specified sublabels, CUI//SP-CTI and CUI//SP-EXPT, and the alert tier on CUI (Basic); the Commercial tiers condition on Restricted and Confidential.

Rollout pattern. Exchange, OneDrive, and Teams DLP support user/group scoping: deploy Enforced to the documented test group, observe real friction (override rates, helpdesk volume, alert count), then expand to All users. SharePoint DLP is site-scoped rather than user-scoped, so test-group enforcement is not available. For SharePoint policies with SIT-based conditions (Priority 2 Credential Alert and Priority 12 SSN Alert), use Simulation mode tenant-wide for 30 days to baseline false positives before promoting to Enforced. For SharePoint policies with label-based conditions (Priorities 6 and 9), the condition is deterministic (a file either carries the label or does not) and simulation is unnecessary; deploy Enforced from the start.

Block-with-override requires BOTH a Block action AND the override checkbox

The "Block + override with justification" pattern used at Priority 4 (Exchange highest-tier label external sharing; in GCC High the CUI//SP-CTI rule only, since the CUI//SP-EXPT rule blocks with no override) is two settings working together in the Purview DLP rule editor: an Action (Restrict access or encrypt the content in Microsoft 365 locations → Block everyone) AND the User overrides setting (Allow users to override policy restrictions + Require business justification to override). Configuring only the override without an Action results in pure alerting with no block: the override checkbox has no visible effect because there is no restriction to override. Per Microsoft Learn, DLP policy tips: "If you set the NotifyAllowOverride action to WithoutJustification or WithJustification or FalsePositives, make sure BlockAccess is set to true and BlockAccessScope has appropriate value. Otherwise, the policy tip comes up but the user doesn't find an option to override the email with justification."

Out of Scope: Reserved for a Follow-Up Submission

The following capabilities are excluded from this change and will be addressed in a subsequent CAB submission:

• Endpoint DLP (USB copy, cloud upload, print, RDP clipboard controls)
• Microsoft 365 Copilot label enforcement
• Client-side and service-side auto-labeling policies (in GCC High the follow-up maps the Classifiers chapter's custom SITs to sublabels: CUI Distribution Statement or CUI DoD Contract Number applies CUI//SP-CTI, CUI Export Control applies CUI//SP-EXPT, a bare CUI Designation Indicator token with no category applies CUI (Basic), that last rule simulated first)
• Insider Risk Management integration
• Finance SIT-based detection policies (the SSN PII baseline is included as Step B-4 below; additional PII SITs (driver's license, ITIN, bank account, passport) are reserved for the follow-up submission)

Prerequisites

All prerequisites must be verified before the implementation window opens.

#	Prerequisite	Verified By	Notes
1	Microsoft Purview compliance portal access: Global Administrator or Compliance Administrator role	[Name]	Required to create labels and policies
2	Exchange Online Administrator role	[Name]	Required for IPPS session during container label sync
3	Microsoft Entra ID P1 or P2 license for at least one admin account	[Name]	Required for container label enablement
4	Microsoft 365 E3/E5 or equivalent licenses for all in-scope users	[Name]	Sensitivity labels require M365 Apps for Enterprise; DLP for Exchange/SharePoint/OneDrive requires E3 minimum. DLP for Teams chat/channel messages (Priority 3) requires E5 per assigned user (see the Step B-2 callout)
5	No existing conflicting label policies in the tenant	[Name]	Check in Purview portal → Information Protection → Label policies
6	Approved list of partner/external domains authorized to receive CUI or sensitive content. One list, two consumers: the Recipient domain is exception on the Exchange rules and the Viewer domain entries on the CUI (Basic) and CUI//SP-CTI labels	[Name]	Required for Stage B DLP Allowed Domains configuration and for the label encryption entries in Stage A
7	Security team distribution group or mailbox for DLP incident reports: substitute the client's real address everywhere the runbook shows [YOUR_DLP_ALERT_EMAIL]	[Name]	Client-provided. Must be an active, monitored mailbox or group before Stage B begins.
8	Change freeze status confirmed: no competing changes to Exchange transport rules or mail flow during window	[Name]	Avoid overlapping with mail flow configuration changes
9	SharePoint Admin Center: unmanaged device access set to Allow limited, web-only access	[Name]	Required for sensitivity label container controls to restrict unmanaged device access. See SharePoint Admin Center — Unmanaged Device Access
10	GCC High only: sg-us-persons exists as a mail-enabled security group and its membership has been reconciled against the HR or export-compliance record of verified US persons	[Name]	The CUI//SP-EXPT label grants Co-Author to this group; the label encryption picker rejects a security group that is not mail-enabled

Implementation Plan

Estimated total implementation time: 90–120 minutes for a tenant with no pre-existing label configuration.

Stage A: Sensitivity Labels (≈45 minutes)

Step A-1: Enable container labels in Entra ID (≈10 minutes)

1. Open PowerShell as an account with Global Administrator or Entra roles.
2. Run the following commands:

# Install required modules if not present
Install-Module Microsoft.Graph.Beta -Scope CurrentUser -Force
Install-Module ExchangeOnlineManagement -Scope CurrentUser -Force

# Choose the tenant cloud explicitly before connecting.
$cloud = 'GCCHigh' # Change to 'Commercial' for a commercial tenant.
if ($cloud -eq 'GCCHigh') {
    Connect-MgGraph -Environment USGov -Scopes 'Directory.ReadWrite.All'
    $ippsConnection = @{
        ConnectionUri = 'https://ps.compliance.protection.office365.us/powershell-liveid/'
        AzureADAuthorizationEndpointUri = 'https://login.microsoftonline.us/organizations'
    }
} elseif ($cloud -eq 'Commercial') {
    Connect-MgGraph -Environment Global -Scopes 'Directory.ReadWrite.All'
    $ippsConnection = @{}
} else {
    throw 'Choose GCCHigh or Commercial.'
}

# Preserve every existing Group.Unified value when enabling labels.
$setting = Get-MgBetaDirectorySetting -All | Where-Object DisplayName -eq 'Group.Unified'
if ($setting) {
    $values = @($setting.Values | Where-Object Name -ne 'EnableMIPLabels' |
        ForEach-Object { @{ Name = $_.Name; Value = $_.Value } })
    $values += @{ Name = 'EnableMIPLabels'; Value = 'True' }
    Update-MgBetaDirectorySetting -DirectorySettingId $setting.Id -BodyParameter @{ Values = $values }
} else {
    $template = Get-MgBetaDirectorySettingTemplate -All | Where-Object DisplayName -eq 'Group.Unified'
    if (-not $template) { throw 'Group.Unified template not found.' }
    New-MgBetaDirectorySetting -BodyParameter @{
        TemplateId = $template.Id
        Values = @(@{ Name = 'EnableMIPLabels'; Value = 'True' })
    }
}

$grpUnifiedSetting = Get-MgBetaDirectorySetting -All | Where-Object DisplayName -eq 'Group.Unified'
$grpUnifiedSetting.Values | Where-Object Name -eq 'EnableMIPLabels'
Connect-IPPSSession @ippsConnection
Execute-AzureADLabelSync
Disconnect-ExchangeOnline

3. Verify: the Get-MgBetaDirectorySetting command above returns the Group.Unified setting's values: confirm EnableMIPLabels shows Value: True. This directory setting has no screen in the Entra portal; it is read and written only through the Microsoft Graph directory-settings cmdlets (reference).

Step A-2: Create sensitivity labels (≈20 minutes)

Navigate to Microsoft Purview compliance portal → Information Protection → Labels. Create labels in order from least to most sensitive: label priority is determined by creation order. In GCC High the CUI tier is a grouping that holds three sublabels, and the portal builds it one of two ways depending on the tenant's label scheme (Learn); check which one the Labels page shows before you start:

• Modern label scheme: a tenant with no sensitivity labels yet, a tenant created from October 1, 2025, or one migrated to the scheme (the page shows a green message bar confirming the migration). The button reads + Create and offers Label or Label group. Create Public and Internal as labels, then create CUI as a Label group: the group carries only a name, display name, label group priority, description for users, and color, and it has no scope, protection, or container pages. Then select the CUI group, select ... under Actions, and choose Create label in group for each of the three sublabels. A tenant that has never had a label is on this scheme, so this is the path most readers of this runbook will see.
• Classic label scheme: an older tenant that still carries parent labels. The button reads + Create a label. Create CUI as a label after Internal, then create each sublabel from the parent: select CUI in the label list, select ... under Actions, then Create sublabel. A label created from + Create a label is always top-level, so a sublabel created that way lands beside the parent instead of under it.

The table below lists every setting in wizard order. Fill in each row as you step through the wizard. The CUI column covers both schemes: a label group has only the name, display name, priority, description, and color rows, and a classic parent label shows the remaining wizard pages but never uses them.

GCC High (CMMC)

Setting	Public	Internal	CUI (group or parent)	CUI (Basic)	CUI//SP-CTI	CUI//SP-EXPT
Name	Public	Internal	CUI	CUI-Basic	CUI-SP-CTI	CUI-SP-EXPT
Display name	Public	Internal	CUI	CUI (Basic)	CUI//SP-CTI	CUI//SP-EXPT
Priority	0	1	2: the Label group priority field on the modern scheme, creation order on the classic; the grouping sits immediately before its sublabels	3	4	5
Parent label	None	None	None: this is the grouping itself (a label group on the modern scheme, a parent label on the classic), and it cannot be applied	CUI	CUI	CUI
Description for users	Approved for public release.	Internal business information not cleared for external release. No special handling required.	Controlled Unclassified Information. Choose the sublabel that matches the document's marking or the contract's CUI guidance.	CUI whose authority does not specify handling. NIST SP 800-171 baseline applies.	Controlled Technical Information under DFARS 252.204-7012. Carries a DoD distribution statement.	Export controlled under ITAR or EAR. US persons only.
Label color	Green	Blue	Yellow: the one color for the CUI tier, since a sublabel has no color field and inherits the group's or parent's color	Inherited from CUI	Inherited from CUI	Inherited from CUI
Scope - Files & other data assets	On	On	On (classic parent only: a label group has no scope page)	On	On	On
Scope - Emails	On	On	On (classic parent only)	On	On	On
Scope - Meetings	Off	Off	Off (classic parent only)	Off	Off	Off
Scope - Groups & sites	Off	On	On (classic parent only)	On	On	On
Control access	Off	Off	n/a (group or parent)	On	On	On
Apply content marking	Off	On	n/a (group or parent)	On	On	On
Assign permissions now or let users decide	n/a	n/a	n/a (group or parent)	Assign permissions now	Assign permissions now	Assign permissions now
User access to content expires	n/a	n/a	n/a (group or parent)	Never	Never	Never
Allow offline access	n/a	n/a	n/a (group or parent)	30 days	30 days	7 days
Assigned users or groups	n/a	n/a	n/a (group or parent)	All Employees: the Add all users and groups in your organization entry (tenant members, guests excluded)	All Employees	sg-us-persons (mail-enabled security group of verified US persons)
Permissions	n/a	n/a	n/a (group or parent)	Co-Author (Editor in current portal naming)	Co-Author	Co-Author
Header text (designation indicator)	n/a	n/a	n/a (group or parent)	Controlled by: [Organization]. POC: [name, email]. Add the CUI category and any dissemination control when the contract's CUI guidance requires them	Controlled by: [Organization]. CUI Category: CTI. Distribution Statement [B through F, per contract]. POC: [name, email].	Controlled by: [Organization]. CUI Category: EXPT. Export controlled: US persons only. POC: [name, email].
Footer text (banner)	n/a	Internal	n/a (group or parent)	CUI	CUI//SP-CTI	CUI//SP-EXPT
Auto-labeling for files and emails	Off	Off	Off (a label group has no auto-labeling page; never configure auto-labeling on a classic parent)	Off	Off	Off
Privacy and external user access (check this protection setting)	n/a	On	n/a (group or parent)	On	On	On
External sharing and Conditional Access (check this protection setting)	n/a	On	n/a (group or parent)	On	On	On
Private teams discoverability and shared channel settings (check this protection setting)	n/a	Off	n/a (group or parent)	Off	Off	Off
Auto apply settings	n/a	None	n/a (group or parent)	None	None	None
Privacy	n/a	Public or Private	n/a (group or parent)	Private	Private	Private
Let group owners add people outside the organization as guests	n/a	On	n/a (group or parent)	Off	Off	Off
External sharing - Content can be shared with	n/a	New and existing guests	n/a (group or parent)	Existing guests	Only people in your organization	Only people in your organization
Access from unmanaged devices	n/a	Full access	n/a (group or parent)	Allow limited, web-only access	Block access	Block access

Create sg-us-persons before this step

sg-us-persons must be a mail-enabled security group (or a Microsoft 365 group): the label encryption picker rejects a security group that is not email-enabled. Create it in the Exchange admin center (Recipients → Groups → Add a group → Mail-enabled security) and populate it from the HR or export-compliance record of verified US persons before running the wizard. A user added to the group later opens already-labeled files on the next attempt, once the Azure Rights Management group-membership cache refreshes (up to three hours per Learn): a refused user holds no use license, so there is nothing to wait out. A user removed from the group keeps cached access for up to the label's 7-day offline window, the revocation lag Sensitivity Labels describes.

What the CUI column means

The CUI column is the grouping that holds the three sublabels: a label group on the modern label scheme (a tenant with no labels yet, a tenant created from October 1, 2025, or one migrated to the scheme) and a parent label on the classic scheme. Either way it carries no marking or encryption of its own and cannot be applied to a file, an email, or a site. A label group has only the name, display name, priority, description, and color rows, so every other row reads n/a (group or parent); a classic parent label shows those wizard pages but never uses them. A sublabel inherits nothing from the grouping except the label color. The sublabel columns are the same under both schemes.

Commercial

Setting	Public	Internal	Confidential	Restricted
Name	Public	Internal	Confidential	Restricted
Display name	Public	Internal	Confidential	Restricted
Description for users	Data that is publicly available or has been approved for public release.	For internal use. May be shared externally when appropriate. No special handling required.	Contains sensitive personal or financial information subject to regulatory requirements. Share only with authorized parties.	Highly sensitive. External sharing not permitted. Access from authorized devices only.
Label color	Green	Blue	Yellow	Red
Scope — Files & other data assets	On	On	On	On
Scope — Emails	On	On	On	On
Scope — Meetings	Off	Off	Off	Off
Scope — Groups & sites	Off	On	On	On
Control access	Off	Off	Off	On
Apply content marking	Off	On	On	On
Assign permissions now or let users decide	—	—	—	Assign permissions now
User access to content expires	—	—	—	Never
Allow offline access	—	—	—	Never
Assigned users or groups	—	—	—	EID_Sensitivity_Label_Restricted
Permissions	—	—	—	Co-Author
Footer text	—	Internal	Confidential	Restricted
Auto-labeling for files and emails	Off	Off	Off	Off
Privacy and external user access (check this protection setting)	—	On	On	On
External sharing and Conditional Access (check this protection setting)	—	On	On	On
Private teams discoverability and shared channel settings (check this protection setting)	—	Off	Off	Off
Auto apply settings	—	None	None	None
Privacy	—	Public	Private	Private
Let group owners add people outside the organization as guests	—	On	Off	Off
External sharing — Content can be shared with	—	Anyone	Existing guests	Only people in your organization
Access from unmanaged devices	—	Full access	Allow limited, web-only access	Block access

Create the Restricted group before this step

EID_Sensitivity_Label_Restricted must be a Microsoft 365 Group. Create it in the Microsoft 365 admin center (admin.microsoft.com → Teams & groups → Active teams & groups) before running this wizard. Microsoft 365 Groups cannot be created in the Entra ID portal or the Intune portal.

Why Public is not scoped to Groups & sites

Container labels exist to restrict: every Groups & sites setting (privacy, external sharing, unmanaged-device access) tightens access compared to tenant defaults. A Public container scope would either repeat tenant defaults or accidentally relax a stricter one: a downgrade footgun where a user picks Public to dodge friction and locks the site into the most permissive posture. Keeping Public at file/email scope only preserves its intended use (marking individual files and emails approved for public release) without making it pickable in the site-creation label dropdown.

Repeat the wizard for each label (six objects in GCC High, four in Commercial). After all labels are created, if container labels were enabled for the first time in Step A-1 above, run the post-enablement sync below: this forces Purview to push the new labels into Entra ID so they become available for application to SharePoint sites, M365 Groups, and Teams sites. For tenants stood up after September 2019 this happens automatically and the command is a no-op safety measure; for older tenants it is required.

Import-Module ExchangeOnlineManagement
# Reuse the cloud-specific connection settings from Step A-1 in this session.
if (-not (Test-Path variable:ippsConnection)) { throw 'Run Step A-1 cloud selection first.' }
Connect-IPPSSession @ippsConnection
Execute-AzureADLabelSync

The cmdlet does not influence the Purview-to-Azure-Rights-Management sync (encryption configuration) or label visibility in Office client apps: both of those are automatic on Microsoft's schedule. See Label Sync Timing for the full sync-path breakdown.

GCC High (CMMC)

Verification: All six objects (five labels and the CUI label group on the modern scheme; six labels on the classic scheme) should appear in the Information Protection → Labels list with correct priority order (Public = 0, Internal = 1, CUI = 2, CUI (Basic) = 3, CUI//SP-CTI = 4, CUI//SP-EXPT = 5), the three sublabels nested under CUI and each label showing a green checkmark. From the IPPS session of Step A-1, Get-Label | Sort-Object Priority | Format-Table Priority, Name, DisplayName, ParentId confirms the nesting: the three sublabels carry the CUI object's GUID (the group's or the parent's) in ParentId; the other three rows are blank.

Commercial

Verification: All four labels should appear in the Information Protection → Labels list with correct priority order (Public = 0, Internal = 1, Confidential = 2, Restricted = 3). Each label should show a green checkmark indicating successful creation.

Step A-3: Publish label policy (≈15 minutes)

1. Navigate to Information Protection → Label policies → Publish labels.
2. Select the labels from the Step A-2 table. In GCC High, select the three CUI sublabels explicitly: on the classic scheme also select the CUI parent label (Learn: when you select a sublabel, make sure you also select its parent), and on the modern scheme the CUI label group is not selectable in a publishing policy, so the sublabels alone are published (Learn). Under both schemes the sublabels are what users apply, and CUI appears in the picker only as the entry that opens to them.
3. Assign to: All users and groups (or a pilot group if a phased rollout is preferred; see Risk Register).
4. Configure policy settings:
   • Require justification for label removal or downgrade: On (in GCC High the prompt does not fire between two CUI sublabels, which share their parent's priority for this setting; see test L-8)
   • Require users to apply a label to their emails and documents: On
   • Require users to apply a label to their Fabric and Power BI content: On
   • Provide a help link: [Insert link to internal data classification policy]
5. Set default labels:
   • Default label for documents: Internal
   • Default label for emails: Internal
   • Never pick the CUI parent as a default: a parent cannot be applied, so never choose it as the default
6. Name the policy: [ORG] - Standard Label Policy v1.0

Label propagation

Sensitivity labels appear in Office clients (Word, Excel, Outlook) within 24 hours of policy publication. Plan the communication timeline accordingly.

Step A-4: Enable co-authoring for encrypted files (≈5 minutes), Microsoft Docs

Without this setting, users on Office desktop apps must check out encrypted labeled files before editing, blocking real-time collaboration. Enabling it allows multiple users to edit encrypted files simultaneously and enables AutoSave for those files.

This setting is effectively irreversible

Once enabled, this setting cannot be turned off from the Purview portal. Disabling it requires PowerShell and will cause labeling metadata to be lost from any unencrypted Word, Excel, and PowerPoint files that were labeled while the setting was active. Enable only after confirming no scripts, Exchange mail flow rules, or third-party tools in your environment read sensitivity label metadata from the old custom document properties location. Standard Microsoft 365 services (DLP policies, auto-labeling, Defender for Cloud Apps) all support the new metadata format and require no changes.

1. Navigate to Microsoft Purview portal → Settings → Solution settings → Information Protection → Co-authoring for files with sensitivity labels.
2. Read the prerequisites and summary displayed on the page.
3. Select Turn on co-authoring for files with sensitivity labels → Apply.
4. Wait 24 hours before relying on co-authoring for encrypted documents.

Stage B: Foundational DLP Policies (≈45–75 minutes)

Step B-1: Verify the security alert mailbox

Before creating policies, confirm that the security team mailbox or distribution group that will receive DLP incident reports is active and monitored: [YOUR_DLP_ALERT_EMAIL]

There is no separate global setting for this in the DLP portal. The recipient is configured within the Incident reports rows of each policy table in B-2 and B-3 below.

Alert deliverability: two field-tested gotchas

DLP incident-report emails arrive from a Microsoft service address that a mail-enabled security group or Microsoft 365 group treats as external, so the group silently drops every alert unless external senders are allowed, with no error surfaced in the Purview portal.

1. Allow external senders on the alert group. If [YOUR_DLP_ALERT_EMAIL] is a mail-enabled security group or M365 group, enable it: Exchange admin center → Recipients → Groups → [group] → Settings → General settings → check Allow external senders to email this group (Microsoft Learn), or via PowerShell for an M365 group: Set-UnifiedGroup -Identity <group> -RequireSenderAuthenticationEnabled $false. The external-sender block is documented here.
2. Inbound mail filtering can still drop it. Even with external senders allowed, we have repeatedly seen client third-party secure-email gateways block the alerts by sender IP or domain. If alerts still don't arrive, trace where they died: Exchange admin center → Mail flow → Message trace, then allow-list the Microsoft 365 alert sender at the upstream filter.

Step B-2: Create credential alert policies (Priorities 0–3)

For each policy: DLP → Policies → Create policy → Custom → Custom policy → full directory scope → single rule.

Setting	Exchange (P0)	OneDrive (P1)	SharePoint (P2)	Teams (P3)
Policy name	Exchange - Credential Alert	OneDrive - Credential Alert	SharePoint - Credential Alert	Teams - Credential Alert
Locations	Exchange email	OneDrive accounts	SharePoint sites	Teams chat and channel messages
Included users/groups	EID_Sensitivity_Label_Test_Users, expand to All after validation	← same	Not supported: SharePoint scopes by site URL, not by user/group	EID_Sensitivity_Label_Test_Users, expand to All after validation
Condition - Sensitive info type	All credentials (bundled SIT: covers passwords, API keys, tokens, and secrets)	← same	← same	← same
Action	Block the email; notify the user	Restrict access or encrypt the content → Block everyone except the content owner, last modifier, and site admin	Restrict access or encrypt the content → Block everyone except the content owner, last modifier, and site admin	Alert only
User notifications	On	On	On	Off
Incident reports - Admin alert	On	On	On	On
Incident reports - Recipients	[YOUR_DLP_ALERT_EMAIL]	← same	← same	← same
Incident reports - Alert frequency	Every rule match	← same	← same	← same
Alert severity	High	High	High	Medium
Policy mode	Enforced (test group) → Enforced (All)	Enforced (test group) → Enforced (All)	Simulation tenant-wide: promote to Enforced after reviewing alert log	Enforced (test group) → Enforced (All)

Teams - Credential Alert (Priority 3) requires E5

The Teams chat-and-channel-messages DLP location needs an E5-tier license assigned to each in-scope user: Office 365 / Microsoft 365 E5/G5, E5 Compliance, or E5 Information Protection & Governance (Microsoft Learn: "Support for DLP protection in Teams Chat requires an E5 license"). Priorities 0–2 (Exchange/OneDrive/SharePoint) and the rest of this runbook work at E3. On an E3 tenant the Teams - Credential Alert policy silently fails to enforce and validation test V-3 never triggers, observed in the field. If Teams coverage is required, confirm E5 assignment first (the Information protection license report in the Teams admin center → Analytics & reports flags unlicensed users).

Step B-3: Create label-based external sharing policies (Priorities 4–9)

For each policy: DLP → Policies → Create policy → Custom → Custom policy → full directory scope → single rule.

GCC High (CMMC)

Specified sublabel policies (Priorities 4-6): CUI//SP-CTI and CUI//SP-EXPT

The Exchange policy holds two rules, because the two Specified sublabels differ in two settings: a distribution statement can authorize a recipient of Controlled Technical Information, so the CUI//SP-CTI rule blocks with override and business justification and carries the approved partner-domain exception, while export-controlled content blocks with no override and no domain exception. OneDrive and SharePoint block absolutely for both sublabels with no domain exception, so one rule with both sublabels selected is enough there; the partner-domain exception exists only on the Exchange CTI rule. Select the sublabels themselves, never the CUI parent: the parent would pull CUI (Basic) into the block tier.

Setting	Exchange (P4)	OneDrive (P5)	SharePoint (P6)
Policy name	Exchange - CUI//SP Label External Sharing	OneDrive - CUI//SP Label External Sharing	SharePoint - CUI//SP Label External Sharing
Locations	Exchange email	OneDrive accounts	SharePoint sites
Included users/groups	EID_Sensitivity_Label_Test_Users, expand to All after validation	← same	Not supported: deploying Enforced across all sites; false positive risk is low given the tight condition (labeled content + shared externally)
Rules	Two rules in this one policy, EXPT - Block, no override ordered first, then CTI - Block with override; rows below name the rule where the two differ	One rule	One rule
Condition - Content is labeled	EXPT rule: CUI//SP-EXPT. CTI rule: CUI//SP-CTI	CUI//SP-CTI or CUI//SP-EXPT (both sublabels selected in the one condition)	← same
Condition - Content is shared	With people outside the organization	← same	← same
Approved-domain allow list	CTI rule: required, list approved GCC High partner domains (added in the Exceptions section of the rule, not within the Content is shared condition). EXPT rule: none (US persons only); add a domain only with the export-compliance officer's written approval. The same domains must appear as Viewer entries on the CUI//SP-CTI label; a domain on this exception and not on the label delivers a file the partner cannot open	Not available: Recipient domain is exists only in Exchange and Teams rules. None is wanted here: the CUI//SP-CTI and CUI//SP-EXPT container labels set External sharing to Only people in your organization, so no external share reaches this rule; it is the backstop for a CUI//SP file that lands on a less restrictive site	← same
Action	Restrict access or encrypt the content → Block everyone (email undelivered)	Restrict access or encrypt the content → Block everyone except the content owner, last modifier, and site admin	Restrict access or encrypt the content → Block everyone except the content owner, last modifier, and site admin
User overrides	CTI rule: Allow users to override → Require business justification (override is logged via audit log X-header; the Block action MUST be configured for the override option to appear to users (see info callout below the Stage B summary table)). EXPT rule: Off, block with no override	Off: Block is absolute for stored content	Off: Block is absolute for stored content
User notifications	On	On	On
Incident reports - Admin alert	On	On	On
Incident reports - Recipients	[YOUR_DLP_ALERT_EMAIL]	← same	← same
Incident reports - Alert frequency	Every rule match	← same	← same
Alert severity	High	High	High
Policy mode	Enforced	Enforced	Enforced

CUI (Basic) label policies (Priorities 7-9)

Setting	Exchange (P7)	OneDrive (P8)	SharePoint (P9)
Policy name	Exchange - CUI (Basic) Label External Sharing	OneDrive - CUI (Basic) Label External Sharing	SharePoint - CUI (Basic) Label External Sharing
Locations	Exchange email	OneDrive accounts	SharePoint sites
Included users/groups	EID_Sensitivity_Label_Test_Users, expand to All after validation	← same	Not supported: deploying Enforced across all sites; alert-only action means false positives have no user impact
Condition - Content is labeled	CUI (Basic)	← same	← same
Condition - Content is shared	With people outside the organization	← same	← same
Approved-domain allow list	Required: list approved GCC High partner domains (added in the Exceptions section of the rule, not within the Content is shared condition). The same domains must appear as Viewer entries on the CUI (Basic) label	Not available in this location. The approved domains go in the SharePoint admin center: Policies > Sharing > More external sharing settings > Limit external sharing by domain > Allow only specific domains, the same list as the Exchange exception; it refuses a share to any other domain before DLP runs, and covers OneDrive. This alert-only rule then fires on shares to approved domains and on links that predate the setting; that alert is the CUI-flow record for AC.L2-3.1.3, not a false positive. If the CAB wants a hard block instead of the alert, the action sub-option Block access for specific external domains or users with Domain IS NOT set to the approved list is the per-rule allow list (present in the GCC High wizard; no user notification or override)	← same, with the per-site subset under Active sites > site > Settings > More sharing settings for CUI (Basic) sites
Action	Alert only	Alert only	Alert only
User notifications	On	On	On
Incident reports - Admin alert	On	On	On
Incident reports - Recipients	[YOUR_DLP_ALERT_EMAIL]	← same	← same
Incident reports - Alert frequency	Every rule match	← same	← same
Alert severity	Medium	Medium	Medium
Policy mode	Enforced	Enforced	Enforced

Commercial

Restricted label policies (Priorities 4–6)

Setting	Exchange (P4)	OneDrive (P5)	SharePoint (P6)
Policy name	Exchange — Restricted Label External Sharing	OneDrive — Restricted Label External Sharing	SharePoint — Restricted Label External Sharing
Locations	Exchange email	OneDrive accounts	SharePoint sites
Included users/groups	EID_Sensitivity_Label_Test_Users, expand to All after validation	← same	Not supported: deploying Enforced across all sites; false positive risk is low given the tight condition (labeled content + shared externally)
Condition — Content is labeled	Restricted	← same	← same
Condition — Content is shared	With people outside the organization	← same	← same
Approved-domain allow list	Optional: list approved regulatory recipients (auditors, regulators, law firms), added in the Exceptions section of the rule	Not available in this location, and the action blocks every external recipient, so a regulator's domain in Limit external sharing by domain never reaches a stored Restricted file. Where auditors must open stored files, use the action sub-option Block access for specific external domains or users with Domain IS NOT set to the approved regulatory domains (no user notification or override), or deliver through Exchange, where the exception exists	← same
Action	Restrict access or encrypt the content → Block everyone (email undelivered)	Restrict access or encrypt the content → Block everyone except the content owner, last modifier, and site admin	Restrict access or encrypt the content → Block everyone except the content owner, last modifier, and site admin
User overrides	Allow users to override → Require business justification (override is logged via audit log X-header; the Block action MUST be configured for the override option to appear to users (see info callout below the Stage B summary table))	Off: Block is absolute for stored content	Off: Block is absolute for stored content
User notifications	On	On	On
Incident reports — Admin alert	On	On	On
Incident reports — Recipients	[YOUR_DLP_ALERT_EMAIL]	← same	← same
Incident reports — Alert frequency	Every rule match	← same	← same
Alert severity	High	High	High
Policy mode	Enforced	Enforced	Enforced

Confidential label policies (Priorities 7–9)

Setting	Exchange (P7)	OneDrive (P8)	SharePoint (P9)
Policy name	Exchange — Confidential Label External Sharing	OneDrive — Confidential Label External Sharing	SharePoint — Confidential Label External Sharing
Locations	Exchange email	OneDrive accounts	SharePoint sites
Included users/groups	EID_Sensitivity_Label_Test_Users, expand to All after validation	← same	Not supported: deploying Enforced across all sites; alert-only action means false positives have no user impact
Condition — Content is labeled	Confidential	← same	← same
Condition — Content is shared	With people outside the organization	← same	← same
Approved-domain allow list	Optional	Not available in this location; the optional list goes in Limit external sharing by domain if the organization keeps one	← same
Action	Alert only	Alert only	Alert only
User notifications	On	On	On
Incident reports — Admin alert	On	On	On
Incident reports — Recipients	[YOUR_DLP_ALERT_EMAIL]	← same	← same
Incident reports — Alert frequency	Every rule match	← same	← same
Alert severity	Medium	Medium	Medium
Policy mode	Enforced	Enforced	Enforced

Step B-4: Create SSN alert policies (Priorities 10–12)

For each policy: DLP → Policies → Create policy → Custom → Custom policy → full directory scope → single rule.

Setting	Exchange (P10)	OneDrive (P11)	SharePoint (P12)
Policy name	Exchange - SSN Alert	OneDrive - SSN Alert	SharePoint - SSN Alert
Locations	Exchange email	OneDrive accounts	SharePoint sites
Included users/groups	EID_Sensitivity_Label_Test_Users, expand to All after validation	← same	Not supported: SharePoint scopes by site URL, not by user/group
Condition - Sensitive info type	U.S. social security number (SSN): high-confidence variant only (formatted SSN pattern ddd-dd-dddd + a keyword from Keyword_ssn within 300 characters; minimizes false positives from non-SSN nine-digit numbers)	← same	← same
Action	Alert only: do not restrict or block. This first submission is a baseline-and-tune period before deciding on enforcement	← same	← same
User notifications	On: informs users that SSN content is now monitored and sets expectations for future enforcement	← same	← same
Incident reports - Admin alert	On	On	On
Incident reports - Recipients	[YOUR_DLP_ALERT_EMAIL]	← same	← same
Incident reports - Alert frequency	Every rule match	← same	← same
Alert severity	Medium	Medium	Medium
Policy mode	Enforced (test group) → Enforced (All)	Enforced (test group) → Enforced (All)	Simulation tenant-wide for 30 days: promote to Enforced (Alert action retained) after reviewing simulation log

Why high-confidence only

The SSN SIT has three confidence levels. High confidence requires a formatted SSN pattern (ddd-dd-dddd or ddd dd dddd) plus a keyword from Keyword_ssn (e.g., SSN, social security, SSA Number) within 300 characters. Medium and low confidence drop the formatting requirement and produce substantially higher false-positive volume from any nine-digit number (part numbers, invoice IDs, employee IDs). Starting with high-confidence only keeps initial alert volume manageable; expand to medium and low confidence in a subsequent CAB submission after baseline tuning. See U.S. social security number (SSN) for the full pattern definition.

Step B-5: Verify policy priority order

1. Navigate to DLP → Policies.
2. Confirm policies are ordered 0 through 12 as specified. Adjust priority manually if the portal has assigned different numbers.

Validation Plan

Complete all validation steps before closing the change ticket. Document pass/fail for each test. The plan has five layers: DLP credential detection, per-label feature tests, container-vs-content matrix, cross-tier sanity tests, and audit visibility.

Validate blocking with a second account, never your own upload

The SharePoint/OneDrive block action exempts exactly who its wizard label says: "Block everyone except the content owner, last modifier, and site admin." They retain access by design as the remediation path (they get the policy tip and can fix the file). A validator who uploads a test file is its owner and last modifier, and admins are exempt outright, so testing against your own upload shows no blocking at all and reads as a broken policy (field-verified: this has confused a client's director). Confirm every blocked-access expectation with a second account holding none of those three roles; for that account the file vanishes from the library listing and direct links return Access Denied. Two related facts: the permission change persists even if the policy is later deleted (restoring visibility takes an override or manual re-permissioning), and where the owner must also lose access, that is the quarantine action, currently in preview.

Required Test Sites

Each site holds 4–5 test files.

Provision Team Sites, not Communication Sites

Container labels on Team Sites exercise the full surface area: SharePoint-level controls (external sharing, unmanaged-device access, default sharing link type) plus Group-level controls (privacy public/private, Teams sensitivity inheritance, group mailbox external email). Communication Sites only exercise the SharePoint subset.

Cleanup: each Team Site provisions a Microsoft 365 Group, group mailbox, and Planner. When tearing down the test environment, delete the M365 Group (Entra admin center → Groups → [Group] → Delete), not just the SharePoint site.

No Test-Public site

The Public label is file/email-scope only and cannot be applied as a container label (see Stage A-2 above). In GCC High there is no Test-CUI site either: the CUI parent cannot be applied as a container label, so every site takes a sublabel.

GCC High (CMMC)

#	Site Name	Container Label	Carries Which Tests
S-1	Test-Internal	Internal	L-2 (Internal per-label feature)
S-2	Test-CUI-Basic	CUI (Basic)	L-3 (CUI (Basic) per-label feature); B-1 and B-2 (2×2 cells with labeled site); X-3 source; X-4 (Internal file external-share attempt)
S-3	Test-CUI-SP-CTI	CUI//SP-CTI	L-4 (CUI//SP-CTI per-label feature, includes the external-share block); X-2 (Public file in a CUI//SP-CTI site)
S-4	Test-CUI-SP-EXPT	CUI//SP-EXPT	L-5, L-6, and L-7 (CUI//SP-EXPT banner and encryption, no-override external-share block, refusal of a user outside sg-us-persons)
S-5	Test-Unlabeled	(none)	L-1 (Public per-label feature: site label irrelevant for a file-label test); L-6 SharePoint leg (CUI//SP-EXPT file shared from an unlabeled site so the DLP block is what fires); B-3 and B-4 (2×2 cells with unlabeled site); X-1 (CUI//SP-CTI file in unlabeled site); X-3 destination (move-out OneDrive personal can substitute)

Production sites follow the same rule as the test sites: a tented project site for contract work carries the sublabel that matches the contract (CUI//SP-CTI for technical work, CUI//SP-EXPT for export-controlled programs), never the parent.

Commercial

#	Site Name	Container Label	Carries Which Tests
S-1	Test-Internal	Internal	L-2 (Internal per-label feature)
S-2	Test-Confidential	Confidential	L-3 (Confidential per-label feature); X-4 (Internal file external-share attempt)
S-3	Test-Restricted	Restricted	L-4 (Restricted per-label feature, includes V-4 external-share check); B-1 and B-2 (2×2 cells with labeled site); X-2 (Public file in Restricted site)
S-4	Test-Unlabeled	(none)	L-1 (Public per-label feature: site label irrelevant for a file-label test); B-3 and B-4 (2×2 cells with unlabeled site); X-1 (Restricted file in unlabeled site); X-3 destination (move-out OneDrive personal can substitute)

Layer 1: DLP Credential and SSN Detection

Validates DLP credential and SSN rules across Exchange, OneDrive, SharePoint, and Teams. Environment-agnostic: same expected behavior in Commercial and GCC High.

#	Test	Expected Result	Validated By
V-1	Send an email containing a plaintext password to an external address	Exchange - Credential Alert triggers; email is blocked; user receives policy tip	[Name]
V-2	Upload a file containing a test credential string to OneDrive and share externally	OneDrive - Credential Alert triggers; external sharing link is removed	[Name]
V-3	From a test-group member, post a message in a Teams channel containing a test credential string	Teams - Credential Alert triggers; incident report delivered to the security mailbox; the message is not blocked and no policy tip appears (Priority 3 is Alert-only with user notifications off). Requires E5 (see the Step B-2 callout)	[Name]
V-4	Send an email containing a test SSN (e.g., 123-45-6789 with the keyword SSN nearby) to an external address	Exchange - SSN Alert triggers (Alert only, no block); incident report delivered to security mailbox; sender sees policy tip	[Name]
V-5	Upload a file containing the same test SSN string to OneDrive	OneDrive - SSN Alert triggers; incident report delivered; file remains accessible (Alert action only)	[Name]
V-6	Upload a file containing the same test SSN string to a SharePoint site	SharePoint - SSN Alert match appears in the policy's simulation log (DLP → Policies → SharePoint - SSN Alert → View matches); no user-facing alert during the 30-day simulation period	[Name]

Layer 2: Per-Label Feature Tests

Confirms each label's specific enforcement (markings, encryption, external-share block, downgrade justification) behaves as designed. The presence of every label in the Office client picker (in GCC High, the CUI entry opening to its three sublabels) is implicitly validated: if the label cannot be applied, the test cannot be run.

GCC High (CMMC)

#	Test	Expected Result	Validated By
L-1	In Test-Unlabeled (S-5), apply Public to a test document; save and reopen	Save succeeds; no header/footer/watermark; no encryption	[Name]
L-2	In Test-Internal (S-1), apply Internal to a test document; save and reopen	Save succeeds; "Internal" footer text appears; no encryption	[Name]
L-3	In Test-CUI-Basic (S-2), apply CUI (Basic) (picker path CUI → CUI (Basic)) to a test document; save, then open it as a second internal account and as a guest	Save succeeds with encryption; "CUI" footer and the Controlled by: [Organization]. POC: ... header appear; the internal account opens it (All Employees, Co-Author); the guest cannot decrypt	[Name]
L-4	In Test-CUI-SP-CTI (S-3), apply CUI//SP-CTI to a test document; share it externally via SharePoint	Encryption applies; "CUI//SP-CTI" footer and the header carrying CUI Category: CTI and the distribution statement appear; the external share is blocked by SharePoint - CUI//SP Label External Sharing (P6); alert to the security mailbox	[Name]
L-5	In Test-CUI-SP-EXPT (S-4), apply CUI//SP-EXPT to a test document as a member of sg-us-persons; save, then reopen as a second member of sg-us-persons	Encryption applies; "CUI//SP-EXPT" footer and the header carrying CUI Category: EXPT and Export controlled: US persons only appear; the second member opens it with Co-Author rights	[Name]
L-6	Copy the L-5 file into Test-Unlabeled (S-5) and share it externally from there via SharePoint, so DLP and not the container setting is what blocks (a share from S-4 is refused by the site's container label before any DLP rule runs; X-2 covers that mechanism); then email the file as an attachment to an external address	SharePoint: SharePoint - CUI//SP Label External Sharing (P6) blocks access and offers no override. Exchange: the EXPT - Block, no override rule of Exchange - CUI//SP Label External Sharing (P4) blocks the send and the policy tip offers no override (a CUI//SP-CTI attachment sent the same way offers override with business justification). Alert to the security mailbox for both	[Name]
L-7	As an internal account that is outside sg-us-persons, did not apply the label (the Rights Management issuer keeps Full Control), and is not an Azure Rights Management super user, open the L-5 file from the library	The file stays listed with its label visible, but Office refuses the content (the not-signed-in-with-permission message on desktop, a generic error in Office for the web). Encryption produced the refusal, not DLP: no DLP alert fires	[Name]
L-8	Downgrade a CUI//SP-CTI document to Public	Justification prompt appears; downgrade is recorded in Activity Explorer and Unified Audit Log. A change between two CUI sublabels (for example CUI//SP-EXPT to CUI (Basic)) does not prompt: sublabels share their parent's priority for this setting	[Name]

Commercial

#	Test	Expected Result	Validated By
L-1	In Test-Unlabeled (S-4), apply Public label to a test document; save and reopen	Save succeeds; no header/footer/watermark; no encryption	[Name]
L-2	In Test-Internal (S-1), apply Internal label to a test document; save and reopen	Save succeeds; "Internal" footer text appears; no encryption	[Name]
L-3	In Test-Confidential (S-2), apply Confidential label to a test document; save and reopen	Save succeeds; "Confidential" header/footer applied; no encryption: Confidential applies content marking and DLP scope only (Restricted is the only encrypting label in this taxonomy)	[Name]
L-4	In Test-Restricted (S-3), apply Restricted label to a test document; share externally via SharePoint	Encryption applies; "Restricted" markings visible; non-permitted user cannot decrypt; external sharing blocked by Sensitive Label External Sharing policy; alert to security mailbox	[Name]
L-5	Downgrade a Restricted document to Public	Justification prompt appears; downgrade is recorded in Activity Explorer and Unified Audit Log	[Name]

Layer 3: Container vs Content Boundary (2×2)

Validates that container labels and content labels enforce independently. This is the highest-confusion area in Purview audits: each cell isolates one observable behavior.

GCC High (CMMC)

#	Site	File Label	Expected Result	Validated By
B-1	Test-CUI-Basic (S-2)	CUI (Basic)	Site blocks external sharing; file is encrypted; DLP matches on label condition	[Name]
B-2	Test-CUI-Basic (S-2)	(unlabeled)	Site blocks external sharing; file is not encrypted: confirms the container label does not auto-protect content. Mandatory labeling normally prevents this state in production; this cell demonstrates the gap if mandatory labeling is bypassed	[Name]
B-3	Test-Unlabeled (S-5)	CUI (Basic)	Site permits external sharing of the link; file remains encrypted: the external recipient is outside All Employees and cannot open the content even though the link is shareable. Confirms encryption travels with the file	[Name]
B-4	Test-Unlabeled (S-5)	(unlabeled)	No protection at any layer. Baseline / control case: the "shadow CUI" risk that mandatory labeling and auto-labeling are designed to eliminate	[Name]

Commercial

#	Site	File Label	Expected Result	Validated By
B-1	Test-Restricted (S-3)	Restricted	Site blocks external sharing; file is encrypted; DLP matches on label condition	[Name]
B-2	Test-Restricted (S-3)	(unlabeled)	Site blocks external sharing; file is not encrypted: confirms the container label does not auto-protect content. Mandatory labeling normally prevents this state in production; this cell demonstrates the gap if mandatory labeling is bypassed	[Name]
B-3	Test-Unlabeled (S-4)	Restricted	Site permits external sharing of the link; file remains encrypted: non-permitted external recipient cannot open content even though the link is shareable. Confirms encryption travels with the file	[Name]
B-4	Test-Unlabeled (S-4)	(unlabeled)	No protection at any layer. Baseline / control case: the "shadow data" risk that mandatory labeling and auto-labeling are designed to eliminate	[Name]

Layer 4: Cross-Tier Sanity

Validates that file labels travel with the file, container labels apply to all content regardless of file label, and tier mismatches behave defensibly.

GCC High (CMMC)

#	Test	Expected Result	Validated By
X-1	Place a CUI//SP-CTI file in Test-Unlabeled (S-5)	File encryption persists; a guest or external recipient cannot decrypt regardless of permissive site sharing settings (All Employees excludes guests)	[Name]
X-2	Place a Public file in Test-CUI-SP-CTI (S-3); attempt external share	Site-level container restrictions block the external share even though the file itself imposes no sharing restriction of its own	[Name]
X-3	Move a CUI (Basic) file from Test-CUI-Basic (S-2) to OneDrive personal	File label and encryption persist across the move; permission scope unchanged	[Name]
X-4	Place an Internal file in Test-CUI-Basic (S-2); attempt to share it with a new external recipient	The site's external-sharing restriction (existing guests only) blocks the new external share, even though the Internal file carries no sharing restriction of its own, confirming container controls apply to all content regardless of file label	[Name]

Commercial

#	Test	Expected Result	Validated By
X-1	Place a Restricted file in Test-Unlabeled (S-4)	File encryption persists; non-permitted user cannot decrypt regardless of permissive site sharing settings	[Name]
X-2	Place a Public file in Test-Restricted (S-3); attempt external share	Site-level container restrictions block the external share even though the file itself imposes no sharing restriction of its own	[Name]
X-3	Move a Restricted file from Test-Restricted (S-3) to OneDrive personal	File label and encryption persist across the move; permission scope unchanged	[Name]
X-4	Place an Internal file in Test-Confidential (S-2); attempt to share it with a new external recipient	The site's external-sharing restriction (existing guests only) blocks the new external share, even though the Internal file carries no sharing restriction of its own, confirming container controls apply to all content regardless of file label	[Name]

Layer 5: Audit Visibility

#	Test	Expected Result	Validated By
A-1	Open Activity Explorer in Purview and confirm the Layer 1–4 test events (the V-, L-, B-, and X-series) are visible	All test events appear with user, workload, label, and justification data	[Name]

30-Day Post-Deployment Review

Within 30 days of implementation:

1. Review DLP Alerts dashboard for false-positive alert volume on credential policies across the test group.
2. Review the SharePoint simulation logs for Priority 2 (Credential Alert) and Priority 12 (SSN Alert). If false-positive rates are acceptable, promote each to Enforced tenant-wide (SSN retains Alert-only action) and submit a minor change request.
3. Promote the test-group-scoped policies (Exchange, OneDrive, Teams credential and label-sharing alerts; Exchange and OneDrive SSN alerts) from the test group to All users once friction metrics are acceptable.
4. Categorize SSN false-positive sources (employee IDs, invoice IDs, part numbers, etc.) and decide whether to: (a) keep Alert-only, (b) author a custom SIT excluding known false-positive number formats, or (c) promote to Block once volume is manageable.
5. Export Activity Explorer data to confirm label adoption rates are trending upward.
6. Present findings to the CAB sponsor before the follow-up submission.

Rollback Plan

Labels and DLP policies can be reversed without service interruption.

Scenario	Rollback Procedure	Estimated Time
Label policy causes user disruption (help desk volume spike)	Set mandatory labeling to Off in the label policy settings; this removes the forced prompt while leaving labels available	5 minutes
DLP policy causes legitimate mail to be blocked	Set the affected policy to Simulation mode or disable the specific rule; does not require deleting the policy	5 minutes
Labels need to be removed entirely	Unpublish the label policy first; wait 24 hours for client propagation to clear; then delete labels. Labels cannot be deleted while active in a policy.	24+ hours
Container label sync causes Groups configuration issue	Revert EnableMIPLabels to False via the Entra directory settings PowerShell commands	10 minutes

Label deletion is permanent

Sensitivity labels that have been applied to files cannot be removed by deleting the label definition: the label metadata persists in the file. Rollback of the label policy only affects new labeling behavior, not already-labeled content. Do not delete label definitions unless directed by Microsoft support.

Risk Register

GCC High (CMMC)

Risk	Likelihood	Impact	Mitigation
Mandatory labeling generates help desk volume in the first week	High	Low	Pre-deployment communication with brief user guidance; set a 5-business-day support buffer
Credential DLP blocks a legitimate automated process (service account, pipeline)	Low	High	Audit Exchange transport rules and known automation accounts before deployment; add sender exclusions for identified service accounts
CUI//SP-EXPT encryption refuses a US person who is missing from sg-us-persons	Medium	Medium	Reconcile sg-us-persons against the HR or export-compliance record before deployment (Prerequisite 10); the Co-Author grant is to the group, so adding the user restores access on the user's next open attempt, once the Azure Rights Management group-membership cache refreshes (up to three hours), without relabeling; the 7-day offline window governs removal, not addition
Block access from unmanaged devices on CUI//SP-CTI and CUI//SP-EXPT sites locks out a legitimate user on a personal device	Medium	Medium	Communicate that CUI project sites require a managed device; confirm Prerequisite 9 and the Intune enrollment path for the affected users before go-live
External partner blocks due to Allowed Domains list being incomplete	Medium	Medium	Confirm the approved partner domain list with the security team before deployment; test with a known partner tenant before go-live
Labels do not appear in Office clients within expected timeframe	Low	Low	Policy propagation can take up to 24 hours; inform users not to expect immediate availability; verify via test account
SSN policy generates false positives on non-SSN nine-digit numbers (employee IDs, part numbers, invoice IDs, etc.)	Medium	Low	Alert-only action prevents user impact during baseline period; high-confidence-only SIT variant requires formatted pattern + keyword within 300 characters to mitigate; review 30-day baseline volume before deciding on enforcement

Commercial

Risk	Likelihood	Impact	Mitigation
Mandatory labeling generates help desk volume in the first week	High	Low	Pre-deployment communication with brief user guidance; set a 5-business-day support buffer
Credential DLP blocks a legitimate automated process (service account, pipeline)	Low	High	Audit Exchange transport rules and known automation accounts before deployment; add sender exclusions for identified service accounts
Restricted encryption prevents file access for an authorized external party	Medium	Medium	Scope Restricted encryption to a security group; add authorized users before deployment; test access with the recipient before go-live
DLP alert volume overwhelms the security mailbox	Medium	Medium	Set alert aggregation to daily digest for Medium-severity alerts; reserve real-time alerts for High-severity policies only
Labels do not appear in Office clients within expected timeframe	Low	Low	Policy propagation can take up to 24 hours; inform users not to expect immediate availability
SSN policy generates false positives on non-SSN nine-digit numbers (employee IDs, part numbers, invoice IDs, etc.)	Medium	Low	Alert-only action prevents user impact during baseline period; high-confidence-only SIT variant requires formatted pattern + keyword within 300 characters to mitigate; review 30-day baseline volume before deciding on enforcement

Communication Plan

Audience	Message	Timing	Delivered By
All Microsoft 365 users	New sensitivity labels are being added to Office applications. You will be asked to select a label when saving documents or sending email. A brief guide is available at [link].	5 business days before go-live	[Name / Communication channel]
IT Help Desk	Sensitivity label training brief: expected user questions, where labels appear, how to reset a label, and escalation path for legitimate DLP blocks	3 business days before go-live	[Name]
Security / Compliance team	DLP incident report mailbox is live as of [date]. Review the alert dashboard at [Purview portal link] within 48 hours of go-live. Escalation path for enforcement disputes: [Name/ticketing queue].	Day of go-live	[Name]
CAB Sponsor	Post-implementation summary within 5 business days of go-live confirming validation results and help desk ticket volume	Within 5 business days	[Name]

Change Record

Field	Value
Submitted by	[Name]
Submission date	[Date]
CAB review date	[Date]
CAB decision	[ ] Approved [ ] Approved with conditions [ ] Deferred [ ] Rejected
Conditions / Notes
Approved by	[Name, title]
Implementation date (actual)
Closed by	[Name]
Closure date