Track outbound emails with Specific sensitivity label

Question

Is there a way to track emails with labeled attachments when they are exfiltrated? I set up an IRM policy to do just that but the File sensitivity label field is empty:

Answer 1

@jpcapone

Thank you for raising this important question around tracking exfiltration of emails with labeled attachments. You are absolutely right to expect visibility into those file-level labels, especially when enforcing protection policies.

Why the "File sensitivity label" is empty

Even though you've set up an IRM policy, the reason you're seeing a blank "File sensitivity label" in the audit logs is because:

• IRM protects but doesn’t classify - IRM enforces access control (e.g., "Do Not Forward"), but it doesn't apply or log sensitivity labels on attachments.
• Attachments require separate labeling - The email and the attachments are treated separately. For labels to appear in logs, the attachment itself must be labeled, either manually or via auto-labeling.

How to Fix This

Manual Pre-Send Labeling - Before attaching, users can manually label files:

• Right-click the file > Properties > Sensitivity
• Or for Office docs, apply labels via the ribbon in Word/Excel/PowerPoint

Auto-Labeling via Microsoft Purview - Set up rules in Microsoft Purview to automatically label attachments based on:

• File content (e.g., credit card numbers, SSNs)
• Metadata (e.g., filenames with “confidential”)

DLP Policies for Enforcement - Use Purview DLP with rules like:

• Condition: Attachment has sensitivity label = X AND recipient is external
• Action: Block with override or generate an alert

Optional - Consider integrating Microsoft Defender for Cloud Apps (MDCA) for real-time alerts and visibility when labeled content is shared externally.

Test this - Try sending a labeled Word or PDF file externally and confirm if the label appears in:

• Purview > Content Explorer
• Purview > Audit logs

I hope this information helps. Please do let us know if you have any further queries.

Kindly consider upvoting the comment if the information provided is helpful. This can assist other community members in resolving similar issues.

Thank you.

Answer 2

I have configured each piece you identified in my testing.

Manual Pre-Send Labeling - Before attaching, users can manually label files:

• Right-click the file > Properties > Sensitivity
• Or for Office docs, apply labels via the ribbon in Word/Excel/PowerPoint
  

DLP Policies for Enforcement - Use Purview DLP with rules like:

• Condition: Attachment has sensitivity label = X AND recipient is external
  • Action: Block with override or generate an alert
    Activity explorer
    
  This is an alert regarding the same event and IRM is still empty
  Please advise.