Edit and monitor classification labels for your organization

Note: To edit Drive labels applied to your files, go here instead. To edit Gmail classification labels applied to your messages, go here instead.

As an administrator, you can review, edit, and delete the Drive and Gmail classification labels used by your organization. Be cautious about changing a published label. Changes affect all files and messages the label is applied to.

• Review all classification labels in your organization
• Edit a Drive label and its fields
• Unlock a Drive label for editing
• Disable a Drive label
• Delete a Drive label
• Audit classification label activity in Drive
• Audit classification label activity in Gmail

Review all classification labels in your organization

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAccess and data controlLabel manager.
3. (Optional) To filter the list, click Search for label name and enter search text.

Edit a classification label

As an administrator, you can change a label’s name, field names, or options. The changes are propagated everywhere the label is applied. You can’t change the field type or multi-selection option. You also can’t edit a label that’s used in a data classification rule, data loss prevention (DLP) rule, or Vault retention rule.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAccess and data controlLabel manager.
3. Click the label that you want to edit.
4. Edit the label. Besides renaming fields and options, you can disable and delete them:
   • To change which apps the label is used in: Check or uncheck the box next to the app.
   • To rename fields or options: Click the field name or expand the option and then click the option name. If the label or field is used by a rule, you see a name is locked next to it and can’t edit it.
   • To disable a field: Find the field then click MoreDisable. Note: When a field is disabled, users can't apply values to it anymore. However, it will continue to show up anywhere it already has values applied, and in search results.
   • To delete a field: First disable it and publish. Then, click MoreDelete. For files where the field was applied, the field is removed.
   • To disable a field option:
     1. Click the field to expand it.
     2. For the field option you want to disable, click More and choose how to disable it:
        • To keep the option visible but block users from choosing it, click Show and don’t allow selection.
        • To hide the option completely, click Hide and disable.
   • To delete a field option: First disable it and publish. Then, click MoreDelete. For files with labels where the deleted option was applied, the field is unset.
5. Click Publish changes.

Unlock a classification label for editing

Labels are locked for destructive editing (disabling or deleting fields, field options, or the labels themselves) when they’re used in a DLP, data classification, or retention rule. To unlock a label, you must remove it from all rules. For DLP rules, the label can’t be used as a condition or action.

Disable a classification label

Disable a label when you no longer want users to apply a label, but you want to keep the label where it’s already applied and in search results. The following steps disable a label for all apps. To learn how to disable a label for only certain apps, go to Enable or disable a classification label.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAccess and data controlLabel manager.
3. For the label you want to disable, click MoreDisable. You can’t disable a label if it hasn’t been published or if it’s used in a data classification rule, data loss prevention (DLP) rule, or Vault retention rule.
4. Confirm you want to disable the label by clicking Disable and show.

You can re-enable a label by finding it in the label manager and clicking MoreEnable.

Delete a classification label

Delete a label when you want all instances where that label was applied, including any field values entered by users, to be permanently deleted and removed from files or messages.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAccess and data controlLabel manager.
3. If the label’s status is Published, disable the label first:
   1. For the label you want to disable, click MoreDisable.
   2. Confirm you want to disable the label.
4. For the label you want to delete, click MoreDelete. You can’t delete a label if it’s used in a data classification rule, data loss prevention (DLP) rule, or Vault retention rule.
5. Confirm you want to delete the label by clicking Delete permanently.

Audit classification labels activity in Drive

When a user or rule applies or updates a label on a file, that activity is recorded in admin audit logs. The log entry includes the previous and new label values, and which user or system made the change.

Admin audit logs for other file events don’t report file labels.

Learn more about reviewing admin log events and reporting logs and BigQuery.

Audit classification label activity in Gmail

To audit Gmail messages sent with classification labels applied to them, export Gmail logs to BigQuery.

Learn about reporting logs and BigQuery, and review available metadata fields and review example queries for Gmail.