8. Labels
Sensitivity labels, their order, markings, restrictions, group targeting and migration.
Policy → Labels
A label is a sensitivity level such as Public, Internal, Confidential or Strictly Confidential. The label is what Ada writes into a document or email. It carries three kinds of settings:
- Identity: name, ID, colour, description and optional sub-sensitivities.
- Markings: the visible header, footer and watermark in documents, and the header, footer and subject prefix in email.
- Restrictions: what users may not do with content that carries the label, such as downgrading, printing, sending, saving or copying.
Rules (chapter 10) decide which label content should get. The label decides what that means on the endpoint. A new installation has no labels. Until you create and publish at least one, nothing is classified and nothing is enforced.
In this topic
- 8.1 The Labels page
The page has a collapsible help box ( How do labels work? ), a toolbar with + Add Label , and one card per label. The cards are sorted by sensitivity order, lowest at the top.
- 8.2 Label order: the
sensitivity ladder
The order of the cards is the most important setting on this page. It is not cosmetic. Endpoints never compare label names. They compare each label’s position.
- 8.3 Creating and editing a
label
Closing the drawer without Save discards your edits. A new label starts as New Label with colour #605e5c , a generated GUID as its ID, no markings and no restrictions.
- 8.4 Identity fields
Changing an ID safely. Change the ID field and click Save . In the same save, the console:
- 8.5 Sub-sensitivities
A sub-sensitivity is an optional second level under a label, for example Confidential HR or Confidential Finance .
- 8.6 Document markings
The Markings Section controls what Ada writes into Word, Excel and PowerPoint documents.
- 8.7 Email markings (Outlook)
Email markings are set separately from document markings. They are written into the message body when the label is applied, in classic Outlook (COM add-in) and in the Outlook web add-in (new Outlook, Outlook on the…
- 8.8 Restrictions
Restrictions are enforced by the Office add-ins and the agents. Each restriction can be changed per group (section 8.9 ).
- 8.9 Group targeting and
group exceptions
This section decides which machines receive the label . Chapter 9 (Groups) explains how machines are placed in groups.
- 8.10 Labels from other
products (migration)
Use this section when documents already carry labels from Microsoft Purview (formerly AIP) or from a product that writes a document property, such as Titus . A document with no Ada label that carries a mapped foreign…
- 8.11 Enabling, disabling and
deleting
Important If every label that reaches a machine is disabled, users have nothing to pick. In that case the add-ins apply no label restrictions on that machine.
- 8.12 Validation at Publish &
Sign
The drawer catches most problems. The server checks everything again when you publish and rejects the policy with a list of errors if:
- 8.13 How labels look to users
Users never see positions or IDs. They only see names, colours, descriptions and the messages caused by restrictions.
- 8.14 Worked example: a
four-level scheme
This scheme suits most organisations. Create the labels in this order, so no reordering is needed, or reorder them as in section 8.2.3.