SharePoint Online: Manage user permissions with sensitivity labels
Sensitivity labels
Sensitivity labels are part of Microsoft Information Protection solution. They allow you to classify and protect your organization's data, by applying appropriate permissions and restrictions on content. Sensitivity labels can be applied either by users or automatically.
Assign permissions
Sensitivity labels allow you to assign user permissions based on the applied label. When defining the scope for your label, choose Groups & Sites.
This configuration doesn't automatically label documents. Instead, it works on the level of an entire container. The label sets permissions on e.g. site level. The files inside will inherit the settings.
When selecting the protection settings, choose Encrypt files and emails
Using these settings, you can configure privacy settings, external user access and external sharing, and access from unmanaged devices. In the encryption menu, choose Configure encryption settings
You can either select permissions yourself, if a group is pre-determined; or let users choose them. Assuming you want to retain control and manage permissions yourself, select Assign permissions now
When you choose which permissions to allow for those users or groups,
In the following screen, you will be able to specify the permission level and the users or groups. You can select a predefined permissions level with a preset group of rights, such as Co-Author or Reviewer, or you can create your own custom permission level. As an admin you will be able to choose much more granular permissions than a user
Image: Permission levels - user view
Image: Permission levels - administrator's view
Limit export options
When configuring label policy settings, you are also able to limit printing and other export options.