SENSITIVITY CLASSIFICATION

Attaches or removes data-sensitivity metadata (a label and an information type, with an optional rank) on the columns of a virtual table. The classification is stored as column metadata, surfaced through the sys.sensitivity_classifications catalog view, and reported to client tools (such as SSMS) that read the classification of query results.

Syntax

ADD SENSITIVITY CLASSIFICATION TO
    <column> [, ...n]
    WITH ( <option> [, ...n] )

DROP SENSITIVITY CLASSIFICATION FROM
    <column> [, ...n]

<column> ::= [ schema_name. ] table_name . column_name

<option> ::=
      LABEL = 'label_name'
    | LABEL_ID = 'label_id'
    | INFORMATION_TYPE = 'information_type_name'
    | INFORMATION_TYPE_ID = 'information_type_id'
    | RANK = { NONE | LOW | MEDIUM | HIGH | CRITICAL }

Arguments

column

The column to classify, given as a two- or three-part name (table.column or schema.table.column). One statement may list several columns.

LABEL = ‘label_name’ / LABEL_ID = ‘label_id’

A free-text sensitivity label (for example 'Confidential') and its optional identifier. Querona stores whatever label text you supply — it does not enforce a fixed taxonomy — so any organizational label set works.

INFORMATION_TYPE = ‘information_type_name’ / INFORMATION_TYPE_ID = ‘information_type_id’

A free-text information type (for example 'Financial') and its optional identifier.

RANK = { NONE | LOW | MEDIUM | HIGH | CRITICAL }

The optional sensitivity rank. When omitted, the column carries no rank.

At least one of LABEL or INFORMATION_TYPE must be specified. Each option may appear at most once.

Remarks

ADD SENSITIVITY CLASSIFICATION on an already-classified column replaces its classification; you do not have to drop the existing one first.

A column may be listed more than once in a single statement; the repeat is applied once.

The classification flows to query results: a SELECT of a classified column (through expressions, aggregates, views, UNION, and FOR JSON / FOR XML output) reports the column’s label, information type and rank to a client that requested the data-classification protocol feature — the same behavior as SQL Server.

Permissions

Requires the ALTER permission on the schema of each target table (classifying a column changes table metadata).

Examples

Classify two columns, then remove one of the classifications:

ADD SENSITIVITY CLASSIFICATION TO
    dbo.Customers.Ssn,
    dbo.Customers.Email
    WITH ( LABEL = 'Confidential', INFORMATION_TYPE = 'Personal', RANK = HIGH );

DROP SENSITIVITY CLASSIFICATION FROM dbo.Customers.Email;

See also

• sys.sensitivity_classifications