Here's a short video explaining the permissions in sensitivity labels.

In this video I explain the different options in the encryption section for a sensitivity label. Most are self-explanatory, but what about the "all authenticated users"?