Build sensitivity label configs with content marking, encryption, permissions, and auto-labeling rules for data classification.
Build sensitivity label configs with content marking, encryption, permissions, and auto-labeling rules for data classification.
Required Fields
displayNameisActivepriorityscopeOutput will appear here...Build a Microsoft Purview sensitivity label combining visual contentMarking (header/footer/watermark), rights-management encryption with per-identity permissions, and autoLabeling rules that trigger based on detected sensitive information types crossing a minCount/maxCount threshold. priority determines which label wins when a document matches multiple auto-labeling conditions simultaneously, labels are evaluated by priority order and the first (or highest-priority, depending on tenant configuration) match applies, so an overlapping, ambiguously-prioritized label set can result in a document being labeled less restrictively than intended if a lower-priority label's condition happens to match first.
The builder validates that displayName, isActive, priority, and scope all resolve before accepting the JSON as a valid sensitivity label definition; it can't verify the referenced parentLabelId exists in your label taxonomy or that sensitiveInfoTypes IDs correspond to real, currently-defined sensitive information type definitions in your tenant, those are only confirmed against the live Microsoft Purview compliance portal.
Design label priority as a deliberate hierarchy across your entire label taxonomy up front, not on a per-label, ad-hoc basis, overlapping auto-labeling conditions with poorly-considered priority ordering is a common cause of sensitive content ending up under-protected.
Prefer group-based permission assignment in encryption.permissions over individually-listed users wherever practical, it dramatically reduces the maintenance burden of keeping a label's access list accurate as team membership changes.
offlineAccessDays is a genuine security-versus-usability tradeoff, don't default to a long window without considering the actual sensitivity of content this label protects, a highly sensitive label warrants a shorter offline window than a general internal-use label.
Was this tool helpful?
Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.