AI Assistant
Help Center AI Assistant is now available
Got questions about Feishu? Use our AI chat to find the answers.
00:00
Click and hold to drag
Got It
Try Now
Admin | Create secure labels and label policies

Admin | Create secure labels and label policies

7 min read
I. Intro
🔖
Availability: Some of the features described in this article are in beta.
Who can perform these steps: Primary administrators or administrators with "Information Protection" permission.
As an administrator, you can create secure labels to categorize documents by the level of protection you want to apply.
To use the labels, you'll also have to create label policies, which will govern which labels will be usable by which members, among other settings.
You can optionally create a user guide to help your members understand how to use the labels or create approval rules for lowering a document's label.
II. Steps
Create a secure label
  1. Go to the Feishu Admin Console and click Security > Information Protection > Secure labels.
  1. Click Secure Label > New Label.
  • 250px|700px|reset
  1. Decide whether you'll use a template or create a new label from scratch.
  • 250px|700px|reset
  1. Fill out the label's name and description. You will have to input a name for the default language and any other languages that have been turned on. To change the default language and turn other languages off or on, go to Security > Information Protection > Secure labels and click Set Label Language. The label's name cannot be changed after the label has been created.
  • 250px|700px|reset
  1. Click Next, then select whether to enable the protection settings of Feishu documents. If you turn on the protection, you can select what protections will be applied to a document that is given this label. The settings allow you to specify whether to allow documents to be shared externally, who can view, add, and remove collaborators, and who can search, view, comment, copy, duplicate, print, download, or manage the document.
  • 250px|700px|reset
  • Note: If you select Restrict (allow sharing with trusted parties) under Allow documents to be shared externally, you should also go to Security > Member Permissions > Docs settings and select both Disallow external sharing and Allow sharing with trusted parties.
  • 250px|700px|reset
  1. Click Preview to confirm each configuration item. If you have enabled Docs protection settings, you must select at least one child option before you click Preview.
  1. If no modification is required, click Confirm.
  1. In the pop-up window, choose to create a new label policy now or later.
Manage secure labels
  • Edit secure label: On the Secure label page, click Edit besides a secure label to change its details. Its name cannot be changed.
  • Delete secure label: Click the More icon > Delete. You will be asked to verify your identity. Once deleted, the label will be removed from existing documents, which will then have no label. Deletion of secure labels is not reversible. Please proceed with care.
  • Note: A secure label can't be deleted if it is currently in use by a label policy or policies. You must either edit or delete the relevant label policy or policies before you can delete the label.
  • 250px|700px|reset
  • Adjust a secure label's sensitivity level: To the right of a secure label, click the More icon > Move up one level/Move down one level or drag the label using the Drag icon. Sensitivity levels denote a label's priority. A document's secure label can't be automatically changed to a label with a lower sensitivity level.
  • 250px|700px|reset
Set up user guide
A link to the user guide will appear when members set a document's secure label. You create a guide to help users understand secure labels and how to use them.
  1. Go to the Feishu Admin Console and click Security > Information Protection > Secure labels.
  1. Click Secure Label > Configure User Guide.
  • 250px|700px|reset
  1. Input a link to a Feishu doc. Ensure you enable viewing permission for members.
Create a label policy
Once you've created one or more labels, you must include them in one or more label policies for them to be usable by members. You will be prompted to create a label policy when you create a new secure label.
  1. Go to the Feishu Admin Console and click Security > Information Protection > Secure labels.
  1. Click Label Policy > Create Label Policy.
  • 250px|700px|reset
  1. Set the policy's name and choose to which members the policy will apply by setting the Application scope.
  • 250px|700px|reset
  1. Set the policy's rules:
  • Select secure labels to publish: Choose which secure labels are included in this policy. When published, these labels will be available to members within the Application scope. Note that label policies are not exclusive, and that members may be within the application scope of several policies. A member can use labels from any policy that applies to them.
  • Require members to apply a secure label to their documents: Optional. If members are required to apply a secure label, they'll be able to use secure labels from any label policies that apply to them, even if those labels don't have this requirement.
  • Apply a default label to documents: Optional. If you choose a default label, you can decide whether it will only apply to new documents or to both new documents and existing unlabeled documents. The second option may involve a large number of existing documents. Please select with care. You can also choose whether members will have to confirm the default label next time they open the document.
  • 250px|700px|reset
  1. Click Preview, then confirm each of the configuration items. If there are no changes, click Confirm. Click Previous to go back to earlier steps to make changes.
  • 250px|700px|reset
  1. Choose whether to activate the new policy now or later in the pop-up.
250px|700px|reset
Manage label policies
  • Edit label policy: Click Edit after a label policy.
  • Delete label policy: Click the More icon > Delete. You will be asked to verify your identity. Once deleted, labels applied through this policy will remain on the documents. Deletion is not reversible. Please proceed with care.
  • 250px|700px|reset
  • Adjust label policy level: To the right of a label policy, click the More icon > Move up one level/Move down one level or drag the label policy to adjust the label policy level.
  • Note: The policy level represents the policy priority. The higher the level, the higher the priority. When there is a conflict between different policies, the policy with the higher priority will be applied. For instance, if two policies set different default labels for new or existing documents, the default label set by the higher priority policy will apply.
  • Deactivate label policy: To the right of a secure label, click the More icon > Deactivate. Once deactivated, labels to which this policy was applied will remain on the corresponding documents. The document protection features defined by the labels will still be in effect. However, the application scope, default label, and other policy rules defined by this policy will be invalid.
  • Activate label policy: To the right of a secure label, click the More icon > Activate. Once activated, the specified secure labels will be applied to the specified application scope. If there is a defined default label it will also go into effect.
Create an approval rule
  1. Go to the Feishu Admin Console and click Security > Information Protection > Secure labels.
  1. On the Secure label page, click Settings.
  • 250px|700px|reset
  1. Click Create Approval Rule.
  1. Set the rule's name and application scope.
  1. Set which actions members will need approval to complete.
  • If you select that approval is needed for Specified actions, you can require approval when members lower specified secure labels, or lower any secure label to a specified label.
  • 250px|700px|reset
  1. Click on the Specify approver box. In the window that appears, set the Approver and optionally set a Cc recipient, then click Save.
  1. Once you're done, click Confirm.
  1. If you click Create Approval Rule, the approval rule will immediately go into effect for the specified application scope and will have the highest priority by default.
  • 250px|700px|reset
Manage approval rules
Administrators can edit and delete approval rules for lowering security levels and also adjust the approval rule level.
  • Edit rule: To the right of an approval rule, click Edit.
  • 250px|700px|reset
  • Delete rule: To the right of an approval rule, click the More icon > Delete.
  • Adjust rule level: To the right of an approval, click the More icon > Move Up 1 level/Move Down 1 level or drag the approval rule to adjust the level.
Note: The approval rule level represents the rule's priority. The higher the rule's level, the higher its priority. When several rules apply in a scenario, the highest-level rule will take effect.
View label usage data
You can view a summary of label usage by going to the Feishu Admin Console > Security > Information Protection. You can see how many labels have been created, how many have been included in policies, and a breakdown of label usage in the form of a pie chart.
You can click Secure labels to go to the Label overview page to view further data and export the data as an Excel or CSV file.
250px|700px|reset
III. FAQs
Which types of documents can be labeled?
The supported document types include Docs, Sheets, Bases (only supported on the desktop app), Mindnotes, Slides and files uploaded to Feishu.
How do I apply a default label to existing documents?
If you apply a default label to existing documents when creating or editing a label policy, it will be applied automatically.
How do I set a secure label for documents?
Below the document's title, click Set Security Level, or click the More icon in the upper-right corner of the document, then click Set Security Level.
250px|700px|reset
How many labels and label policies can one organization set?
An organization can add 100 secure labels and 100 label policies.
What happens when I delete a label?
Once deleted, the label will be removed from all documents it has been applied to. Labels cannot be restored once deleted. The protection policies corresponding to the label will no longer apply.
If a member is in a label policy's application scope, which documents related to them will the policy apply to?
Documents for which that member is the owner.
Can members change a document's secure label?
Yes. The document owner or people with management permissions for a document can change it.
Can members change document permissions without changing the secure label?
Yes, members can adjust certain document permissions from loose to strict without changing the secure label. However, the secure label must be changed if they want to change permission from strict to loose.
250px|700px|reset
If I make a copy of a document or create a document based on a custom template, will the security level be copied as well?
Yes. When a member creates a file through copying or a custom template, the original security level will be inherited. This can be changed and configured as needed.
Are secure labels visible to external users?
No.
What happens if a label is removed as a policy's default label?
Documents to which that label was assigned will not change, unless superseded by a new default label.
What does the label policy "rule level" represent?
The label policy level represents the policy's priority. The higher the level, the higher the priority. When multiple label policies conflict, the policy with higher priority will be applied.
How are secure labels handled after a document owner is transferred?
A document's label will not change when it's transferred. The new owner will be able to change the label, but only to the labels that are included in policies that apply to them.
If multiple members apply to change the label applied to a document to different labels, and they are all approved, which label will ultimately be applied?
The secure label with the lowest sensitivity level.
How do I handle special scenarios arising from editing a label policy?
  • If Policy 1 defines that moving down a level is subject to approval and Policy 1 is edited, with the change that moving down a level does not require approval.
  • Affects: Requests to move down a level that are now in the approval process.
  • Outcome: The requests in the approval process will still require approval to pass.
  • If Policy 3 applies Labels L1 and L2 to Department 3 and Policy 3 is edited to remove Label L2.
  • Affects: Documents within Department 3 that have used Label L2.
  • Outcome: The secure label for documents that have had Label L2 applied will not change. If the owner wants to change the label, they will only be able to publish it to labels they can use.
  • If Policy 4 defines Label L1 as the default label for Department 3 and Policy 4 is edited to remove Label L1 as the default label.
  • Affects: Documents within Department 3 that have applied L1 as the default label.
  • Outcome: The documents with L1 don't change. L1 is no longer automatically applied to new documents in the future.
If a secure label's "Allow documents to be shared externally" option is set to"Restrict (allow sharing with trusted parties)", what configurations can members make regarding sharing Docs with trusted parties?
Members can make the following configurations regarding sharing Docs with trusted parties.
  • Sharing docs with trusted parties: In the upper-right corner of the document interface, click Share > Permission settings. Under External sharing, select Allow content to be shared with trust parties or Only people with manage permission can share the content with trust parties.
  • 250px|700px|reset
  • Invite trusted party members to collaborate: In the upper-right corner of the document interface, click Share. Then, under Invite collaborators, you can add members of trusted parties.
  • 250px|700px|reset
If a secure label's "Allow documents to be shared externally" option is set to "Restrict (allow sharing with trusted parties)", who can that doc be shared with?
It can be shared with members of the organization and members of trusted parties. It cannot be shared with external individuals or external groups.
The secure label's "Allow documents to be shared externally" option was set to "Restrict (allow sharing with trusted parties)", so why can't I find members of trusted parties when inviting collaborators in Docs?
The administrator may need to configure the visibility of trusted party members. For more information, see Establish a trusted party relationship.
How can I set secure labels for multiple docs at once?
Go to the Docs home page. Select more than one doc, then click Set Security Level.
Written by: Feishu Help Center
Updated on 2024/12/05
Was this content helpful?
Thank you for your feedback!
Need more help? Please contact Support.
0
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom
rangeDom