1. Define the user's classification scope
Preparing document classification for a new user starts with the work they will actually perform. List the repositories, document types, classification labels, and sharing channels in scope. Name the policy owner and the person who can answer ambiguous cases. Exclude labels and systems the user will not touch, because an oversized introduction makes the important distinctions harder to remember.
2. Give the user a short decision guide
For each allowed label, provide a plain-language meaning, two representative examples, the permitted audience, and the expected storage location. Include one example that should not receive the label. Do not use live confidential documents as training material. If local policy or law defines the classification, link to the controlling policy instead of paraphrasing it as optional advice.
3. Confirm that the tools match the policy
Check that the account can see only the labels and locations needed for the role. Microsoft explains that sensitivity labels become visible in supported applications when an administrator publishes the applicable label policy to selected users. Record the assigned policy, target group, date, and expected applications. A screenshot from an administrator console is not enough; verify the labels from the new user's account.
4. Include records duties in onboarding
Classification training should sit beside the user's records-management duties. The U.S. National Archives recommends including records-management information in new-hire packets and using new-employee orientation for training. Explain what must be retained, where official copies belong, and whom to contact before deleting or moving a record. Avoid claiming that a general guide replaces an organization's retention schedule.
5. Practice with invented documents
Use several fictional samples that differ in sensitivity and sharing needs. Ask the user to choose a label, explain the choice, save the item, share it with an approved test account, and verify the recipient's access. Include a case where the user must stop and escalate. Record the test date and result without copying sample secrets into the onboarding log.
6. Test expected restrictions
Check both allowed and blocked behavior. The user should confirm that an ordinary item can be shared as intended and that a restricted item cannot be sent to an unapproved audience. If encryption or access limits are part of a label, test them with accounts designed for verification. Do not weaken a policy merely to complete onboarding.
7. Assign operating ownership
Name the classification-policy owner, platform administrator, records contact, and team approver. State who may change a label definition, publish a policy, grant an exception, or investigate an incident. The new user should know which questions are routine and which require an immediate pause.
8. Close the setup with evidence
A complete onboarding record includes the policy version, label guide, assigned access, training date, fictional test cases, results, unresolved questions, and next review date. Mark the user ready only after the account shows the expected controls and the user can classify the test set consistently. Recheck the setup after a role change, policy revision, or migration to another document system.
Sources
- Knowledge Area 4: Records Schedule Implementation — U.S. National Archives and Records Administration
- Create and configure sensitivity labels and their policies — Microsoft Learn