- Get link
- X
- Other Apps
This article explains how to use sensitivity labels in Microsoft 365 Excel, from prerequisites and configuration to everyday usage, governance, and best practices, so that you can protect sensitive data while keeping users productive.
1. What are sensitivity labels in Microsoft 365 Excel?
Sensitivity labels in Microsoft 365 are part of Microsoft Purview Information Protection and are designed to classify and protect organizational data across Office apps such as Word, Excel, PowerPoint, Outlook, SharePoint, and OneDrive.
When you apply a sensitivity label to an Excel workbook, the label can do more than just mark the file with a classification name. Depending on how your administrator has configured it, a label can:
- Encrypt the file and control who can open it.
- Restrict actions such as printing, copying, or forwarding.
- Apply visual markings such as headers, footers, or watermarks.
- Travel with the file across locations and devices so protection remains in place even after download or sharing.
In Excel specifically, sensitivity labels are visible in the title bar, the status bar, and on the Home tab through the Sensitivity button. Users can see which label is applied and can change it if their permissions allow.
2. Prerequisites and licensing for using sensitivity labels in Excel
Before users can work with sensitivity labels in Excel, several technical and licensing requirements must be satisfied.
2.1 Core requirements
| Requirement | Description |
|---|---|
| Microsoft 365 subscription | You must use a subscription edition of Microsoft 365 Apps (for example, Microsoft 365 Apps for enterprise). Sensitivity labels are not supported with standalone perpetual Office editions such as Office 2019 or Office 2021. |
| Eligible license | Users generally need an enterprise license such as Microsoft 365 E3/E5 or equivalent information protection SKUs. The license must include Microsoft Purview Information Protection capabilities. |
| Supported Excel client | Minimum versions of Excel for Windows, macOS, web, and mobile are required for built-in labeling. Your tenant should follow Microsoft’s “minimum versions for sensitivity labels in Office apps” guidance. |
| Published labels | An administrator must create sensitivity labels in the Microsoft Purview portal and publish them to users via label policies before they appear in Excel. |
| Work or school account | Users must sign in with a work or school account. Personal Microsoft accounts are not supported for organizational sensitivity labels. |
Note : If the Sensitivity button is missing in Excel even though the ribbon was customized, verify that the user is running a supported subscription build of Microsoft 365 Apps, has a suitable information protection license, and is included in a published label policy.
2.2 Excel-specific limitations
Excel has some unique constraints that affect how sensitivity labels behave:
- Headers and footers used for label markings have a combined limit of 255 characters in Excel, including non-visible formatting codes. If the limit is exceeded, parts of the text may not display.
- Older binary workbook formats such as .XLS do not support the same labeling and encryption capabilities as modern .XLSX workbooks.
- Some advanced label capabilities might require recent client builds; organizations should standardize on a supported channel and version.
3. Where users see and apply sensitivity labels in Excel
Once labels are configured and published, Excel users can access them from several locations, depending on the platform.
3.1 Excel for Windows and macOS (desktop)
In modern desktop versions of Excel, users can apply or change a sensitivity label using either the title bar or the Sensitivity button on the ribbon.
- Open the Excel workbook and make sure you are signed in with your work or school account.
- On the Home tab, locate the Sensitivity button on the ribbon.
- Click Sensitivity to open the list of available labels.
- Hover over each label to see its description and usage guidance (if your administrator configured it).
- Select the appropriate label (for example, “Public”, “General”, “Confidential”, or “Highly Confidential”).
- Excel will apply the label and enforce any configured protections such as encryption or restricted access.
Alternatively, you can often click the label name next to the workbook title in the title bar to change it more quickly, depending on your Excel version.
3.2 Excel for the web
Excel for the web also supports built-in labeling when connected to a supported Microsoft 365 tenant.
- Open the workbook in Excel for the web from SharePoint or OneDrive.
- On the Home tab, locate the Sensitivity button.
- Click the drop-down arrow to see labels that are available for you.
- Select the label that best matches the workbook’s sensitivity.
The label and its protection follow the file across the service, so if users download the workbook to desktop Excel with the same account, the label remains applied and the protection persists.
3.3 Excel mobile apps
On Android and iOS, users can apply labels from the Home tab or from the More Options menu.
- Open the workbook in the Excel mobile app.
- Tap Home, then scroll if necessary to find Sensitivity.
- Tap Sensitivity and choose the desired label.
- Confirm any prompts about changing label or access restrictions.
Note : For Outlook, mailboxes must be hosted in Exchange Online for sensitivity labels to work, but for Excel the primary dependency is on supported Microsoft 365 apps and licensing rather than mailbox location.
4. How admins create and publish labels for Excel
From an Excel user’s perspective, labels simply appear in the Sensitivity menu, but administrators configure them centrally in Microsoft Purview.
- In the Microsoft Purview compliance portal, an admin creates sensitivity labels that describe different levels of confidentiality (for example, “Public”, “Internal”, “Confidential”, “Highly Confidential”).
- For each label, the admin chooses:
- Whether to encrypt content and with which permissions.
- What visual markings (watermarks, headers, footers) to apply.
- Whether to require justification when users downgrade a label.
- Whether users must provide a business justification for removing encryption.
- The admin then publishes labels via label policies to selected users or groups.
- Once policies are synchronized to clients, Excel shows the labels on the Home tab and in the title bar for those users.
In addition to manual labeling, admins can configure auto-label and recommended label policies that analyze content for sensitive data (for example, credit card numbers, national IDs) and automatically apply or suggest labels.
5. Applying sensitivity labels in real-world Excel scenarios
The key to a successful rollout is mapping Excel use cases to clear labeling guidelines that are easy for users to follow.
5.1 Common Excel scenarios and recommended labeling
| Excel scenario | Typical content | Recommended label example | Protection behavior |
|---|---|---|---|
| Public dashboards | Non-sensitive KPIs and metrics for broad internal distribution; no personal data. | “Public” or “General” | No encryption, simple footer or watermark indicating low sensitivity. |
| Internal department reports | Operational metrics, internal procedures, non-personal financials. | “Internal” | May restrict sharing with external users; optional header/footer markings. |
| HR analytics workbook | Employee names, IDs, salary bands, performance ratings. | “Confidential – HR” | Encryption limiting access to HR group; strong watermark and headers. |
| Customer pricing sheet | Customer names, quotes, discounts, contract terms. | “Confidential – Sales” | Restricted to sales teams and managers; forwarding/sharing limited. |
| R&D experiment data | Proprietary formulas, lab results, intellectual property. | “Highly Confidential – R&D” | Strong encryption, strict access control, watermark and header/footer applied. |
5.2 Step-by-step example: labeling a financial workbook
Suppose you maintain a quarterly financial forecast workbook that contains sensitive revenue and margin projections.
- Open the workbook in Excel for Windows using your work account.
- Review the data and confirm that it should not be shared outside the finance team.
- Click Home > Sensitivity.
- Select a label such as “Confidential – Finance”.
- Excel applies encryption rules defined by the label, for example:
- Only members of the finance security group can open the workbook.
- External recipients cannot open the file even if it is emailed.
- A header/footer shows “Confidential – Finance” on every printed page.
- Save and close the workbook. The label travels with the file, whether stored in SharePoint, OneDrive, or downloaded locally.
Note : If users frequently choose the wrong label, consider enabling auto-labeling or recommended labels in Microsoft Purview so that Excel prompts users when it detects sensitive content such as financial account numbers or personal identifiers.
6. What sensitivity labels actually do to an Excel workbook
From a technical standpoint, sensitivity labels can apply several layers of protection to Excel files.
6.1 Encryption and access control
For labels configured with encryption, Excel integrates with Microsoft Purview and Azure Information Protection to embed rights management in the file.
- Access is granted based on Azure AD identities and groups rather than just file location.
- The label can restrict who can open, print, copy, or export the workbook.
- The protection persists even after the file is downloaded or copied to another location.
- Admins can track access attempts and, depending on the configuration, revoke access if necessary.
6.2 Visual markings in Excel
Labels can optionally add visual markings to make classification obvious to viewers:
- Headers and footers: Text such as “Confidential” or “Highly Confidential” can be added to printed pages. Excel limits the header and footer string to 255 characters, including formatting codes.
- Watermarks: Semi-transparent text across the sheet background (like “Confidential”) can be applied in supported Office clients, helping to prevent accidental screenshots or unauthorized distribution.
6.3 Integration with SharePoint, OneDrive, and Teams
When Excel workbooks are stored in SharePoint, OneDrive, or Teams, sensitivity labels align with the underlying document libraries and sites. Some organizations also configure labels at the container level (for example Teams or SharePoint sites) to enforce default or mandatory labeling for files stored in those locations.
7. Limitations, known issues, and best practices in Excel
7.1 Common limitations and issues
- Unsupported clients: Sensitivity labels are not supported for standalone perpetual Office editions (for example, Office 2016, Office 2019) and require Microsoft 365 subscription builds.
- Older file formats: .XLS workbooks and certain legacy file types may not support modern labeling and encryption, especially when using automated labeling at scale.
- Excel header/footer limits: If combined header and footer text and formatting exceed 255 characters, the text might not appear as expected.
- Known bugs: Microsoft documents known issues with labeling in Office apps, such as intermittent label display problems or co-authoring conflicts, and updates this list as fixes ship.
Note : If your organization experiences unexpected behavior with labels in Excel (for example, labels not updating or co-authoring failing on encrypted files), always compare your build with Microsoft’s “known issues with sensitivity labels in Office” and minimum version guidance before troubleshooting further.
7.2 Deployment best practices for Excel
To maximize the value of sensitivity labels in Excel, consider these practical recommendations:
- Start with a small set of intuitive labels (for example, Public, Internal, Confidential, Highly Confidential) and avoid overly granular names.
- Use label descriptions to explain concrete examples of when to use each label, specifically for Excel scenarios like HR reports, customer lists, or pricing models.
- Pilot labeling with a small group of power users in finance, HR, and security before enabling it tenant-wide.
- Combine manual, recommended, and auto-labeling so that high-risk content is flagged or protected even if users forget to label it.
- Regularly review where labels are applied in SharePoint and OneDrive to ensure that actual usage matches your data classification policy.
Note : Sensitivity labels and retention policies solve different problems. Labels focus on protection and access control, while retention policies manage lifecycle (how long data is kept and when it is deleted). For Excel workbooks containing regulated data, you often need both: a label for protection and a retention policy for compliance and records management.
FAQ
Why do I not see the Sensitivity button in Excel?
The most common reasons are that you are using a perpetual (non-subscription) edition of Office, you do not have a license that includes information protection features, or your administrator has not yet published any labels to your account. Sensitivity labels require Microsoft 365 subscription builds and published label policies before the button appears.
Do sensitivity labels still protect an Excel file if I email it outside the organization?
If the label is configured with encryption, protection travels with the file. External recipients will only be able to open the workbook if their identity or domain is included in the label’s access configuration (for example, specific partners). If the label only applies visual markings without encryption, the file will not be cryptographically protected.
Can I change or remove a sensitivity label that was applied automatically in Excel?
In many organizations, users can change or remove a label that was applied automatically, but they may be required to provide justification when downgrading sensitivity or removing encryption. This behavior is controlled by settings in the label configuration in Microsoft Purview and by organizational policy.
How do sensitivity labels interact with password-protected Excel workbooks?
Microsoft recommends using sensitivity labels and encryption rather than workbook-level passwords for most enterprise scenarios. Where both are used, sensitivity label encryption typically provides stronger, identity-based protection, while simple workbook passwords are easier to share or bypass. Organizations should standardize on label-based protection for consistent auditing and access control.
Are sensitivity labels stored in the Excel file when I download it?
Yes. One of the key design goals of sensitivity labels is that classification and protection persist with the file, independent of its storage location. When you download a labeled workbook from SharePoint or OneDrive and open it in a supported Excel client, the label and its associated protection remain in effect.