Edit and monitor classification labels for your organization

Supported editions for this feature: Frontline Starter, Frontline Standard, and Frontline Plus; Business Standard and Business Plus; Enterprise Standard and Enterprise Plus; Education Standard and Education Plus; Essentials, Enterprise Essentials, and Enterprise Essentials Plus; G Suite Business. Compare your edition

Note: To edit Drive labels applied to your files, go here instead. To edit Gmail classification labels applied to your messages, go here instead.

As an administrator, you can review, edit, and delete the Drive and Gmail classification labels used by your organization. Be cautious about changing a published label. Changes affect all files and messages the label is applied to.

Review all classification labels in your organization

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Security > Access and data control > Label manager.
Requires having the Manage Classification Labels administrator privileges.
(Optional) To filter the list, click Search for label name and enter search text.

Edit a classification label

As an administrator, you can change a label’s name, field names, or options. The changes are propagated everywhere the label is applied. You can’t change the field type or multi-selection option. You also can’t edit a label that’s used in a data classification rule, data loss prevention (DLP) rule, or Vault retention rule.

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Security > Access and data control > Label manager.
Requires having the Manage Classification Labels administrator privileges.
Click the label that you want to edit.
Edit the label. Besides renaming fields and options, you can disable and delete them:
- To change which apps the label is used in: Check or uncheck the box next to the app.
- To rename fields or options: Click the field name or expand the option and then click the option name. If the label or field is used by a rule, you see a name is locked next to it and can’t edit it.
- To disable a field: Find the field then click MoreDisable. Note: When a field is disabled, users can't apply values to it anymore. However, it will continue to show up anywhere it already has values applied, and in search results.
- To delete a field: First disable it and publish. Then, click MoreDelete. For files where the field was applied, the field is removed.
- To disable a field option:
  1. Click the field to expand it.
  2. For the field option you want to disable, click More and choose how to disable it:
    - To keep the option visible but block users from choosing it, click Show and don’t allow selection.
    - To hide the option completely, click Hide and disable.
- To delete a field option: First disable it and publish. Then, click MoreDelete. For files with labels where the deleted option was applied, the field is unset.
Click Publish changes.

Unlock a classification label for editing

Labels are locked for destructive editing (disabling or deleting fields, field options, or the labels themselves) when they’re used in a DLP, data classification, or retention rule. To unlock a label, you must remove it from all rules. For DLP rules, the label can’t be used as a condition or action.

Disable a classification label

Disable a label when you no longer want users to apply a label, but you want to keep the label where it’s already applied and in search results. The following steps disable a label for all apps. To learn how to disable a label for only certain apps, go to Enable or disable a classification label.

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Security > Access and data control > Label manager.
Requires having the Manage Classification Labels administrator privileges.
For the label you want to disable, click MoreDisable. You can’t disable a label if it hasn’t been published or if it’s used in a data classification rule, data loss prevention (DLP) rule, or Vault retention rule.
Confirm you want to disable the label by clicking Disable and show.

You can re-enable a label by finding it in the label manager and clicking MoreEnable.

Delete a classification label

Delete a label when you want all instances where that label was applied, including any field values entered by users, to be permanently deleted and removed from files or messages.

Sign in with an administrator account to the Google Admin console.
If you aren’t using an administrator account, you can’t access the Admin console.
Go to Menu Security > Access and data control > Label manager.
Requires having the Manage Classification Labels administrator privileges.
If the label’s status is Published, disable the label first:
1. For the label you want to disable, click MoreDisable.
2. Confirm you want to disable the label.
For the label you want to delete, click MoreDelete. You can’t delete a label if it’s used in a data classification rule, data loss prevention (DLP) rule, or Vault retention rule.
Confirm you want to delete the label by clicking Delete permanently.

Audit classification labels activity in Drive

When a user or rule applies or updates a label on a file, that activity is recorded in admin audit logs. The log entry includes the previous and new label values, and which user or system made the change.

Admin audit logs for other file events don’t report file labels.

Learn more about reviewing admin log events and reporting logs and BigQuery.

Audit classification label activity in Gmail

As an admin, you can audit Gmail messages with applied classification labels that were sent by people in your organization. To audit Gmail messages with classification labels, you can:

Export Gmail logs to BigQuery
Export Gmail data from Google Vault

Export Gmail logs to BigQuery

To audit Gmail messages with classification labels, you can export Gmail logs to BigQuery. BigQuery is Google’s managed data platform that helps you analyze data with features like machine learning, search, and business intelligence. For example, you can create a BigQuery report of recent Gmail log events that have one or more classification labels associated with messages.

Learn more about reporting logs and BigQuery, review the schema (metadata fields) for Gmail logs, and see example Gmail queries.

You can optionally use Looker Studio to read and share your BigQuery reports. Learn more about Looker Studio

Export Gmail data from Google Vault

You can export Gmail data from Vault, including information about classification labels applied to messages, to an XML file. Create a new Vault matter, then search for and export Gmail data. For details about what’s in the export, visit the Gmail exports section on the Vault exports page.

To find Gmail messages with classification labels in Vault, on the Vault search page:

In the Service field, enter Gmail
In the Terms field, enter has:classification-labels

Fill out the other search fields based on the messages you want to find.

To learn more and get detailed steps, visit Get started with Vault search & export.

Was this helpful?

How can we improve it?