Sensitivity Label Policy

Sensitivity Label Policy lets you allow or block Microsoft Purview sensitivity labels for the workspace. Use it when you want SharePoint, OneDrive, Outlook Email, Microsoft Teams, and Microsoft Excel to withhold files and messages whose labels should not be processed in Langdock.

​

Open the policy

1. Go to Integrations in your workspace settings.
2. Open Microsoft Purview, or open SharePoint, OneDrive, Outlook Email, Microsoft Teams, or Microsoft Excel and click Purview settings.
3. Connect Microsoft Purview if no connection exists. The connection needs SensitivityLabel.Read, User.Read, openid, and offline_access.

The screen title is Sensitivity Label Policy. The description is “Configure an allow/block policy per label.” On SharePoint, OneDrive, Outlook Email, Microsoft Teams, and Microsoft Excel, an info banner links to this policy through Purview settings.

​

Load labels

Open the menu beside Load labels and choose a connection. The selected connection is checked. Then click Load labels. Until a tenant is loaded, the line reads “Select a Purview connection and load labels for that Microsoft tenant.” After a successful load, the table replaces that line. Each Microsoft tenant has its own catalog and choices. Loading another tenant switches the table. Other tenants stay saved. The first time you load a tenant, every label and sublabel starts allowed. Reloading an existing policy keeps the choices you already saved. A label that is new since your last save starts blocked in the table.

​

Allow or block labels

The table columns are Label, Applicable to, Encryption, and Allowed. Applicable to is Email, Files, or Email (Outlook) and files (SharePoint & OneDrive). Encryption shows whether the label encrypts files and emails. A single file or email can still have different encryption settings. Turn Allowed off to block a label. Allowing or blocking a parent sets the same choice on its sublabels. Parent labels do not apply to files by themselves. Each file or message is classified on its own. A site, folder, or drive label does not apply to the items inside it. There is no separate enable switch. The saved label rows are the policy. Only a label you saved as blocked denies access. Unlabeled items stay allowed. Labels the saved policy does not mention stay allowed. Click Save Policy, then confirm Save Sensitivity Label Policy? The saved policy applies from the next request. Nothing carries over from an earlier check, so a file that was allowed a minute ago is checked again. Synced SharePoint and OneDrive folders pick up the change at their next sync. See Folder Sync below.

​

Where the policy applies

When the integrations apply the saved policy:

• SharePoint and OneDrive. File reads, metadata, downloads, copy sources, uploads to an existing path, search, and folder listings classify the file before content is returned or replaced. A new path can be created. A shortcut is judged by its target. Document-library rows are classified as files. Ordinary list rows are not. Editing fields on a document-library row is allowed even when the file is blocked. Sites, folders, drives, and site pages are not classified as documents.
• Outlook Email. Reads, search, drafts lists, moves, flags, categories, and polling triggers classify the message before the body is returned. Blocked messages are left out of polls.
• Microsoft Teams. Message text is not classified. A downloadable SharePoint or OneDrive attachment is classified before download. A blocked attachment is omitted. The message and its other attachments are still returned.
• Microsoft Excel. The workbook is classified before cells, sheets, tables, or charts are read, and again before an edit. Editing a blocked workbook is refused.

​

Purview decryption

Purview decryption is on the same Microsoft Purview screen, under the sensitivity label policy. Each integration starts off. Turn a switch on when members should read allowed protected content from that integration. Each switch applies to the entire workspace, for every member’s connection to that integration. You can’t turn decryption on for single members or groups.

• SharePoint and OneDrive. Files and documents, including a file downloaded into a synced folder. Decryption runs only after the label policy allows the file.
• Outlook Email. Email bodies and attachments, including new-email triggers.
• Microsoft Teams. Cloud attachments in chats and channels. Message text and meeting transcripts are not decrypted.
• Microsoft Excel. Workbook content for supported read actions. The read returns saved cell values, without recalculating formulas. Edits and password-protected workbooks are not covered.

Turn Enabled on and confirm Enable decryption. The dialog title names the integration, for example Enable decryption for SharePoint?. That activates Get Purview token and requires the Azure Rights Management Services scope user_impersonation. If your OAuth client uses manual scopes, add user_impersonation in its settings. Once both are allowed, members must reauthorize existing connections before decryption starts. Decryption needs extract or owner rights in Microsoft. View alone is not enough. Decryption accepts only .docx, .xlsx, .pptx, .pdf, and encrypted Outlook messages (.rpmsg), up to 25 MiB. Macro-enabled Office files, Office templates, and generic .pfile files are not decrypted. If decryption is unavailable, denied, or fails, the protected content is not returned.

​

What Langdock requests from Microsoft

Langdock checks the sensitivity label of each file and email before anything reaches the AI. It reads the label first and requests the content only when the label is allowed. A blocked file’s content and a blocked email’s body are never requested. In two cases, Langdock receives a little more before the check. It uses that data only for the check, and blocked items never reach the AI:

• SharePoint search and Excel file search. Microsoft returns a short preview with every result.
• SharePoint and OneDrive folder listings. Langdock requests each file’s name, link, and type with the listing. Folder Sync needs them to keep a file whose label can’t be checked right now.

Only file types that can carry a sensitivity label can be blocked, such as Word, Excel, PowerPoint, and PDF files. Microsoft lists them under supported file types. Other files stay allowed.

​

Folder Sync

A file you can open in SharePoint or OneDrive is still withheld when its label is blocked. Files you don’t have permission to open stay hidden either way. Folder sync checks each file’s label before fetching it. Blocked files are left out, and copies synced earlier are removed. If a label can’t be checked, the file keeps its synced copy, but members can’t use it until a later sync checks it. After you change which labels are blocked, the next sync re-checks every file and takes longer. The next sync also picks up a relabeled file on its own. See Folder Sync for source-permission rules.

​

Speed and request limits

Once you save a policy for a tenant, each file and email needs one to three extra Microsoft Graph requests. Folder listings, searches, and email triggers take longer, and large tenants can hit Microsoft throttling.

​

Related pages

• SharePoint scopes
• Microsoft OneDrive scopes
• Outlook Email scopes
• Microsoft Teams scopes
• Microsoft Excel scopes
• Folder Sync