Microsoft Purview Sensitivity labels, best practices for setup?

Question

Background

There have been more than a handful of recent security breaches at my company, involving social engineering and spoofed emails.

A malicious actor fraudulently spoofing one of our customers, sends an email to a user at my company saying "We've updated our banking info, please make all future payments to this new account number." or "We are still waiting for you to process EFT for invoice XXXX in the amount of XXX, please make sure you are using our new account number XXXXXX."

Our customers, bless their hearts, happily paid large sums of money to these malicious actors; assuming they were customers.

I had the idea for a system that looks for words like "EFT, Funds Transfer, Payment Method, Bank Account, Account update, etc.".

Using these keywords, the system automatically flags that email with a message like "IF A CUSTOMER IS ASKING YOU TO UPDATE BANKING INFO OR MAKE A PAYMENT TO A NEW ACCOUNT, CALL THE CUSTOMER FIRST AND CONFIRM." In some kind of popup, tooltip, or banner message.

What I'd like to set up

Put simply, we want to have some kind of visual flag (such as a banner or tooltip) that automatically appears to an end user when they receive an email that contains specified keywords. In particular, inbound emails from outside our tenant.

From my research, I believe that Auto-labeling Sensitivity Labels with a tooltip should accomplish what I am looking for.

Image from Microsoft showing what I believe am looking for.

I watched some guides, but am having trouble getting them working. Below are the steps I've already completed.

Created Sensitive Info Type

1. Navigate to "Data Classification > Sensitive Info Types".
2. "Create Sensitive Info Type"
3. "Define patterns for this sensitive info type", created Pattern #1 with a list of keywords.
4. "Primary Element" set to "Keyword list".
5. Under "Case Insensitive", added a handful of keywords that I'd like to trigger the policy tooltip.
6. No Supporting elements, no additional checks.
7. High confidence level.

Creating Label

1. Created a Label in the Information Protection menu.
2. Gave this label a User-facing description and label color.
3. Assigned Scope to "Items only", not concerned about Teams or Schematized Data maps at this point.
4. Checked off "Apply Content Marking".
5. Under Content marking, applied a Header and Footer (did not set Watermark) with a message that I want the users to see.
6. under "Auto-labeling for files and emails", applied the content marketing to the Sensitive Info type that I previously created. HCL, 1-any Instances.
7. "When content matches these conditions > Automatically apply the label"
8. "Display messages to the user", used the same text as before.
9. "Groups and Sites", skipped this section.

Publishing label policy

1. Published to only me as a test user.
2. "Policy Settings", left all options blank. Do not need users interacting with the label warning.
3. "Default Label for Documents" Skipped
4. "Default settings for emails" = None. Don't want the label applied for EVERY email, just the ones that match the sensitive info type.
5. "Default settings for meetings and calendar events" Skipped
6. "Default settings for Power BI content" Skipped

Testing and primary issue

After all these steps, I sent an email from my personal Gmail to my Company Email, containing all of the keywords I previously defined.

I received the email but did not see any tooltip or banner appear. Assuming it may be a time-based deployment issue, I waited for 24hrs and tried again; with the same results.

Any thoughts? I feel like there is probably something obvious I'm overlooking.

Other Questions

1. There were many separate steps where it appeared that I could create a user-facing message. Which one of these options should I be enabling? Do I need all of them turned on?

2. What different kinds of content marking or alert tooltips are there for me to choose from?

3. Is this the best course of action to accomplish what I am looking for? Is there some other solution that would help me achieve the desired outcome, that may be more effective?

Answer 1

In general, the most useful references are pivots from MSFT's DOCS:

On sensitivity labels: https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide

Default labeling (enabling): https://learn.microsoft.com/en-us/microsoft-365/compliance/mip-easy-trials?source=recommendations&view=o365-worldwide

Labeling for Office Apps (including Outlook): https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide

Sensitivity Labels Capability Table in Outlook: https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-versions?view=o365-worldwide#sensitivity-label-capabilities-in-outlook

Applying mandatory labeling (automatic and trainable): https://learn.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide

Excerpt: Specific to auto-labeling for Exchange:

• Unlike manual labeling or auto-labeling with Office apps, PDF attachments as well as Office attachments are also scanned for the conditions you specify in your auto-labeling policy. When there's a match, the email is labeled but not the attachment.

-- For PDF files, if the label applies encryption, these files, if
unencrypted, are now encrypted by using Message encryption when your tenant is enabled for PDF attachments. The encryption settings
applied are inherited from the email.

--For these Office files, Word, PowerPoint, and Excel are supported. If the label applies encryption and these files are unencrypted, they're now encrypted by using Message encryption. The encryption settings are inherited from the email.

• If you have Exchange mail flow rules or Microsoft Purview Data Loss Prevention (DLP) policies that apply IRM encryption: When content is identified by these rules or policies and an auto-labeling policy, the label is applied. If that label applies encryption, the IRM settings from the Exchange mail flow rules or DLP policies are ignored. However, if that label doesn't apply encryption, the IRM settings from the mail flow rules or DLP policies are applied in addition to the label.

• Email that has IRM encryption with no label will be replaced by a label with any encryption settings when there's a match by using auto-labeling.

• Incoming email is labeled when there is a match with your auto-labeling conditions. If this label is configured for encryption, that encryption is always applied when the sender is from your organization. By default, that encryption isn't applied when the sender is outside your organization but can be applied by configuring Additional settings for email and specifying a Rights Management owner.

• When the label applies encryption, the Rights Management issuer and Rights Management owner is the person who sends the email when the sender is from your own organization. When the sender is outside your organization, you can specify a Rights Management owner for incoming email that's labeled and encrypted by your policy.

• If the label is configured to apply dynamic markings, be aware that for incoming email, this configuration can result in displaying the names of people outside your organization.

Defining a DLP Policy with notifications: https://learn.microsoft.com/en-us/microsoft-365/compliance/use-notifications-and-policy-tips?view=o365-worldwide

DLP Policy tips: https://learn.microsoft.com/en-us/microsoft-365/compliance/dlp-policy-tips-reference?view=o365-worldwide