Most firms lock the building. Almost nobody locks the document that walks out of it.
Here's the gap I see in nearly every wealth management tenant I review. Every control sits at the door — who can sign in, from which device, on which network. All good. But the moment a client's financial plan gets downloaded, forwarded, or dropped on a thumb drive, it's just a file. Whoever holds it, reads it.
Sensitivity labels close that gap. You tag a document "Client Confidential," and the protection attaches to the file itself instead of the folder it was sitting in. Microsoft's own documentation puts it plainly: the file "remains encrypted no matter where it resides, inside or outside your organization, even if the file's renamed."
What that means for a practice: a client statement attached to the wrong email is unreadable to the wrong recipient. A thief who exfiltrates your document library has stolen noise. You can also set a label to block forwarding, or to stop opening after a date you choose.
If you're on Microsoft 365 Business Premium, sensitivity labels are already in your subscription. Most firms I meet have simply never switched them on.
Worth a look before your next cyber renewal. Ask whoever runs your IT which labels are published in your tenant. If the answer is "none," there's your next project.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email