SENSITIVITY CLASSIFICATION

Attaches or removes data-sensitivity metadata (a label and an information type, with an optional rank) on the columns of a virtual table. The classification is stored as column metadata, surfaced through the sys.sensitivity_classifications catalog view, and reported to client tools (such as SSMS) that read the classification of query results.

Syntax

ADD SENSITIVITY CLASSIFICATION TO
    <column> [, ...n]
    WITH ( <option> [, ...n] )

DROP SENSITIVITY CLASSIFICATION FROM
    <column> [, ...n]

<column> ::= [ schema_name. ] table_name . column_name

<option> ::=
      LABEL = 'label_name'
    | LABEL_ID = 'label_id'
    | INFORMATION_TYPE = 'information_type_name'
    | INFORMATION_TYPE_ID = 'information_type_id'
    | RANK = { NONE | LOW | MEDIUM | HIGH | CRITICAL }

Arguments

column

The column to classify, given as a two- or three-part name (table.column or schema.table.column). One statement may list several columns.

LABEL = ‘label_name’ / LABEL_ID = ‘label_id’

A free-text sensitivity label (for example 'Confidential') and its optional identifier. Querona stores whatever label text you supply — it does not enforce a fixed taxonomy — so any organizational label set works.

INFORMATION_TYPE = ‘information_type_name’ / INFORMATION_TYPE_ID = ‘information_type_id’

A free-text information type (for example 'Financial') and its optional identifier.

RANK = { NONE | LOW | MEDIUM | HIGH | CRITICAL }

The optional sensitivity rank. When omitted, the column carries no rank.

At least one of LABEL or INFORMATION_TYPE must be specified. Each option may appear at most once.

Remarks

ADD SENSITIVITY CLASSIFICATION on an already-classified column replaces its classification; you do not have to drop the existing one first.

A column may be listed more than once in a single statement; the repeat is applied once.

The classification flows to query results: a SELECT of a classified column (through expressions, aggregates, views, UNION, and FOR JSON / FOR XML output) reports the column’s label, information type and rank to a client that requested the data-classification protocol feature — the same behavior as SQL Server.

When auditing is enabled, every execution of ADD or DROP SENSITIVITY CLASSIFICATION is recorded in the audit trail as one event for the whole statement — including an attempt refused for a missing permission.

Permissions

Requires the ALTER permission on the schema of each target table (classifying a column changes table metadata).

Examples

Classify two columns, then remove one of the classifications:

ADD SENSITIVITY CLASSIFICATION TO
    dbo.Customers.Ssn,
    dbo.Customers.Email
    WITH ( LABEL = 'Confidential', INFORMATION_TYPE = 'Personal', RANK = HIGH );

DROP SENSITIVITY CLASSIFICATION FROM dbo.Customers.Email;

See also

• sys.sensitivity_classifications