Solutions Hub: data labeling for security and AI

Label sensitive data once, and let every security control and AI tool act on it

BigID finds and classifies sensitive data, then writes the right Microsoft Purview or Google Drive label onto each file, and onto the records in your vector databases. DLP, encryption, access controls, and AI assistants get a clear, consistent signal to work from. Labels stay current as data changes, keep pace with the largest Microsoft 365 tenants, and come with a record of every label applied.

Agende uma demonstração

Where labels land

Purview and Google Drive

Labels written into the file, so the tools you already run enforce them

Ready for AI

Approved, restricted, prohibited

Data marked for AI use before it reaches a copilot, an LLM, or a vector store

Built for scale

Microsoft 365 tenants

Adaptive throttling, change-only relabeling, and parallel segments across SharePoint and OneDrive

Classification that every tool can act on

Give every control, and every AI tool, the same answer about how sensitive a file is

DLP, encryption, sharing rules, and copilots all make decisions from the label on a file. Labels applied by hand are patchy and go out of date, and the controls built on them end up guessing. BigID reads the content, decides the sensitivity level against your policy, writes the matching label to the file, and keeps it right as the file changes, across a Microsoft 365 tenant, Google Drive, file shares, cloud storage, and the vector databases behind your AI. It builds on the same descoberta e classificação that feeds posture management e Governança de IA.

Your policy sets the levels

Your levels, your label names, your priorities. BigID applies them to every file that qualifies and removes them when a file no longer does.

Enforcement stays where it lives

Purview, Google Drive, and your DLP tools act on the label. They keep the enforcement role, and they get a consistent label to enforce.

Ready for AI

Data marked approved, restricted, or prohibited for AI use, files and vector records alike, before it reaches a copilot or an LLM.

One decision about sensitivity, written where every control and every AI can read it

BigID decides how sensitive each file is one time, applies the matching label, and keeps it right, so the controls that enforce can do their job.

Your policy sets the levels, and BigID matches every file to one, so a label means the same thing in every team and every region.

The label is written into the file, so the tools that enforce it can read it wherever the file travels.

Every label applied, skipped, or retried is on the record, so nothing slips through the cracks.

Files in Microsoft 365, Google Drive, file shares, and cloud storage, along with the records in your vector databases, go through one labeling policy. BigID classifies the data, maps each finding to a sensitivity level you defined, writes the matching label to the file or the vector record, and keeps it current as the data changes. Purview, Google Drive, and the DLP, encryption, and access controls around them read the label and do the enforcing, AI tools and copilots draw on what the label clears them to use, and a report records every label applied, skipped, or retried, with the reason.

Comece aqui

Where teams start when they bring labeling under control

Can we get consistent labels on millions of files without anyone tagging by hand? Set your sensitivity levels, tie each one to a label, and BigID applies the right label to every matching file and keeps it current as files change. Sensitivity levels that match your policy → Will our Purview DLP and Copilot controls have labels to work with? BigID writes Microsoft Purview sensitivity labels, encryption labels included, onto files across SharePoint, OneDrive, file shares, and cloud storage, so the controls you already run have the labels they key on. Labels written where your tools can act on them → We run Google Workspace. Does this work for us too? Google Drive labels are applied to files, Docs, Sheets, and Slides from the same classification and the same levels. Labels written where your tools can act on them → Can labeling keep pace with a large Microsoft 365 tenant? Adaptive throttling, change-only relabeling, tenant segmentation, multiple identities, and dynamic threading keep a labeling run moving across the biggest SharePoint and OneDrive estates. Labeling at Microsoft 365 scale → How do we make sure our AI tools only use data that is cleared for it? Mark data approved, restricted, or prohibited for AI use, label the records in your vector databases, and give copilots and pipelines the labels their controls read. Data labeled for AI use → How do we show an auditor, or ourselves, that it worked? A propagation report records every label applied, skipped, or retried, with the reason, and every label is searchable in the BigID catalog. Reporting that shows your work →

Capacidades

Label sensitive data once, and keep every label right as the data changes

In the order the work runs: set the levels, write the labels where tools can read them, keep pace with a large tenant, stay current as files change, ready data for AI, and show the results.

Sensitivity levels that match your policy

Your policy decides the levels and the names. BigID does the matching, file by file, so a label means the same thing in every team and every region.

Out-of-the-box levels of Restricted, Confidential, Internal Use, and Public, ready to use as they are or edit to fit your own scheme
Build your own classification groups, with your own levels and names, for sensitivity, residency, identity, or risk category
Describe what belongs in each level with a point-and-click query builder over BigID’s classification findings
Levels are ranked, so when a file qualifies for several, the highest sensitivity wins
Roll findings up: tag table columns, tables, and whole data sources with the highest level found inside them
Strict matching removes a label from a file that no longer qualifies for it, so labels do not outlive the data they describe
Map each level to its Microsoft Purview or Google Drive label on the same screen, with no separate saved queries or labeling scans to manage

Labels written where your tools can act on them

The label goes into the file itself. Purview, Google Drive, and the DLP, encryption, and access controls built around them read it wherever the file travels, so each of them starts from the same answer.

Microsoft Purview sensitivity labels applied directly to files, so Purview DLP, encryption, and Copilot controls can enforce them consistently
Encryption labels as well as classification-only labels, so a level can carry protection with it
Google Drive labels for files, Docs, Sheets, and Slides, including labels with fields and options
Microsoft Commercial, US GCC High, and US DoD environments supported, with corporate proxy and custom certificate options for locked-down networks
Word, Excel, PowerPoint, PDF, image, Visio, Project, and Power BI files, among many other formats
Original last-modified dates kept on SharePoint Online, OneDrive, SMB, Box, Google Drive, and iManage, so labeling leaves no trace in the way people find their files
Existing labels read back into the BigID catalog, so BigID and your label provider stay in agreement
Labels that feed DLP, CASB, and access control tools, and that can trigger BigID policy actions, retention, and minimization

Labeling at Microsoft 365 scale

A large tenant holds millions of files and a limited budget of API calls. BigID moves through it steadily, spends that budget where the risk is, and finishes the job.

Adaptive throttling that eases off when Microsoft signals pressure and picks back up efficiently, so a labeling run keeps moving instead of stalling on retries
Event-based rescanning, so each later pass covers what changed instead of the whole tenant
Tenant segmentation: split a SharePoint tenant by site or site group, label the highest-risk content first, and run segments in parallel
Multiple app and user identities connecting to SharePoint Online, spreading the load across the tenant
Dynamic scan threading that adjusts parallelism while the run is in progress, so capacity gets used when it is there and eased when it is not
SDK-based labeling that makes large file volumes practical
Just-in-time labeling: labels applied as data is classified, with no wait for a full scan cycle to finish
Labels applied to changed objects only, so the cost of staying current follows the rate of change

Labels that stay right as data changes

Files get edited, moved, shared, and added every hour. BigID labels new and changed content automatically, retries what is busy, and flags the files whose label disagrees with what is inside them.

Labeling starts on its own when BigID finds new objects or when you change a level or a mapping, with no recurring labeling scans to schedule
Automatic retries for files that are open, temporarily protected, or caught in a brief network hiccup, with no one needed to rerun anything
Labels applied by people stay in place by default; choose whether BigID may overwrite them or lower a level where policy calls for it
Propagation scope by data source type, individual data source, or file type, and new sources of a chosen type join automatically
Exclude a source such as a legal hold archive, or a specific label, from being written while BigID keeps reading what is already there
BigID manages the labels tied to your active levels and leaves every other label exactly as it is
Out-of-the-box policies that find files BigID classifies at one level but that carry a different label, surfaced as cases in the Security Posture console

Data labeled for AI use

AI tools draw on whatever they can reach. Labels tell them, and the controls around them, what they may use.

Label data by AI-use eligibility: approved, restricted, or prohibited, or your own categories matched to internal policy, regulation, or risk thresholds
Apply labels upstream, before data reaches an LLM, a copilot, or an agentic system, so AI workflows start out compliant by default
Label records in vector databases, MongoDB Atlas Vector Search and Elasticsearch, so the embeddings behind your AI carry the same sensitivity as the files they came from
Purview DLP policies scoped to Microsoft 365 Copilot can key on these labels, so content labeled Highly Confidential stays out of Copilot summaries while users see a policy tip instead of a dead end
Identity-aware classification: connect data to the people it belongs to, who owns it, and where it resides before it goes anywhere near an AI pipeline
One set of levels across files, structured data, and vectors, so security and AI teams work from the same definitions
Part of BigID’s Secure Data Pipeline for governed AI enablement, alongside the GenAI catalog, cleansing, and search

Reporting that shows your work

Every label BigID applies, skips, or retries is recorded, with the reason, so the answer to “did it work?” is a report rather than a hunch.

A labels propagation report showing completed, skipped, and failed labels over time, by day, by week, or across 90 days
A plain-language reason on every skipped or failed file, so the fix is a task for the file owner rather than an investigation
File-level CSV download with the file, the label, the operation, the status, the reason, who started it, and the data source
Every label shows up as a tag in the BigID catalog, searchable and usable as criteria in policies and delegated remediation
One catalog as the source of truth for what was classified, what was labeled, and what is waiting
Role-based permissions that separate who can edit levels from who can read the labeling results

Onde ele corre

Microsoft 365, Google Drive, file shares, cloud storage, and the vector databases behind your AI

The same levels apply wherever the data lives, so a file on a share and a record in a vector database describe sensitivity the same way.

Microsoft 365

SharePoint Online and OneDrive, with Purview sensitivity labels, encryption labels included.

Espaço de trabalho do Google

Google Drive labels across files, Docs, Sheets, and Slides.

Armazenamento de objetos na nuvem

Amazon S3, Azure Blob Storage, and Google Cloud Storage.

Content and file platforms

Box, iManage, and SMB file shares.

Bancos de dados vetoriais

MongoDB Atlas Vector Search and Elasticsearch, so AI data carries a level too.

Government and regulated clouds

Microsoft Commercial, US GCC High, and US DoD environments, with proxy and custom certificate support.

Validação por terceiros

Independently proven classification sits behind every label

The Forrester Wave™, 2º trimestre de 2026

“O BigID foi projetado para alto desempenho e escalabilidade de petabytes.”

The Forrester Wave™: Soluções de Descoberta e Classificação de Dados Sensíveis, 2º trimestre de 2026

Nomeada Líder, uma das três entre os dez fornecedores avaliados.
Highest possible score for enrichment for classification, tuning to improve accuracy, and cloud and on-premises data source coverage

Leia o relatório Forrester Wave →

O desafio de classificação da Intuit

Intuit put 20 vendors through a head to head classification challenge on a synthetic dataset of more than 40,000 records
A BigID venceu, com precisão e recall ponderados de 96,5%.

“A tecnologia da BigID demonstrou capacidades impressionantes na classificação precisa de dados em grande escala.”

Gleb Keselman, Diretor de Engenharia de Software de Segurança da Intuit

Leia como o desafio foi realizado →

And from IDC

“Tools like BigID are the future. Organizations should be leveraging these tools to remove the manual processes from data discovery, provide better visibility, and help with prioritization of controls.”

Ryan O’Leary, IDC, Future of Trust: Battling Data Discovery Confusion

Perguntas frequentes

Answers on data labeling: Purview, Google Drive, scale, and AI

How is labeling different from classifying data?

Classification decides what the data is and how sensitive it is. Labeling writes that decision onto the file, or the vector record, where other tools can read it. BigID does both, so the level a file is classified at and the label it carries come from the same place and stay in step. The label is what lets Purview, Google Drive, and the DLP, encryption, and access controls around them act on what BigID found.

Does BigID decide which labels my organization uses?

No, your label taxonomy stays yours. Your Purview or Google Drive administrators define the labels. BigID imports them, lets you map each one to a sensitivity level, and applies them to the files that qualify. Retention labels stay wherever you manage them today.

Who enforces the labels?

The tools built to enforce them do, and BigID gives them better labels to work from. Purview DLP, encryption, sharing controls, Google Drive policies, and Copilot controls all act on a label. BigID classifies the data, applies the right label, keeps it current, and reports on every file, so those controls run on accurate, consistent labels instead of manual tagging.

Can labels keep sensitive data out of Copilot and other AI tools?

Yes, labels give AI controls something concrete to act on. Label data as approved, restricted, or prohibited for AI use, apply Purview labels that Copilot-scoped DLP policies key on, and label the records in vector databases such as MongoDB Atlas Vector Search and Elasticsearch so the data behind your AI carries the same sensitivity as its source. For the wider program, see Governança de IA.

Will labeling overwhelm our Microsoft 365 environment?

BigID is built to label large tenants steadily. Adaptive throttling eases off when Microsoft signals pressure, event-based rescanning covers only what changed, tenant segmentation puts the highest-risk sites first and runs segments in parallel, and multiple identities and dynamic threading spread the load.

Which sources and file types can be labeled?

Microsoft 365, Google Drive, file shares, cloud storage, and vector databases. That covers SharePoint Online, OneDrive, Google Drive, SMB, Box, iManage, Amazon S3, Azure Blob Storage, and Google Cloud Storage, plus MongoDB Atlas Vector Search and Elasticsearch. File types follow what Microsoft and Google support for labeling, including Office documents, PDFs, and images.

What happens to labels people have already applied by hand?

They stay in place unless you decide otherwise. By default BigID does not overwrite a label a person set. Where policy calls for consistency, you can allow BigID to overwrite user-applied labels or lower a level, and you can exclude any source or label from being written at all. Existing labels are read into the BigID catalog either way.

Recursos