sensitivity label assignment method

Assign Sensitivity Labels In SharePoint with MSGraph (PowerShell)

Table of Contents

What are Sensitvity Labels?

Organizations have the need to tag their documents regarding sensitivity. This need is arising among ISO 27001. Sensitivity labels in Microsoft 365 enable organizations to tag documents regarding their sensitivity. In general the sensitivity of a document can be classified roughly in three categories: public, confidential, highly confidential. Each organization might have a different understanding when to use which sensitivity label.

How to assign Sensitivity Labels in SharePoint with PowerShell?

In this article, I will describe following four steps to assign sensitivity labels with PowerShell:

• Make sure that sensitivity Labels are enabled
• Create Azure AD App Registration with the permissions to assign sensitivity labels for SharePoint Sites
• Enable metered APIs and Service in Microsoft Graph.
• Run the script, which is provided in this article

How to enable Sensitivtiy Labels for SharePoint? (Short Summary)

In order to enable sensitivity labels, you need to enable sensitivity labels in Microsofts Purview (Compliance Center) as a global administrator.

• Sign in to Purview Portal as a global administrator

Now you can set Sensitivity Labels in SharePoint.

Details about about supported file types, limitations etc. can be obtained here: Enable sensitivity labels for Office files | Microsoft Learn

How to configure the Azure App Registration to set Sensitivity Labels in SharePoint

Make sure that you have configured following permissions for your Azure App Registration if you want to authenticate via client secret or certificate. This permissions allow you to update documents in all SharePoint Sites:

If you want to do it only on one Site, use Sites.Selected permission and add the permission as per following documentation:

How to download files from SharePoint using Graph API (PowerShell)

If you want to get familiar on how to create an Azure App registration, check out following article, where I describe in detail, what an Azure App Registration is and how you can configure it in order to use MS Graph. How to configure Azure App registration for MS Graph | SPO Scripts

I have configured the app with the Sites.ReadWrite.All permission and authenticate with a certificate.

Enable Metered Graph API services for MS Graph

The API to assigning sensitivity labels for SharePoint files involve additional cost for metered API services. In order to set up metered Graph API services, I have created an resource by following the article: Enable metered APIs and services in Microsoft Graph . The pricing is based on the ammount of API calls ( currently $0.00185 (USD) per API call as per 09th October 2023). Metered APIs are currently only available in Microsoft Global environment .

You can create the resource for metered APIs by running following cmdlet in the Azure cloud shell:

In my case it looks like this:

Running it in Azure cloud shell, I received following output:

If you try it without the registration, you will receive following error message

How to assign a Sensitivity Label for a SharePoint File with PowerShell

Let’s assume, we want to change the sensitivity label for this file to confidential:

If you want to assign a sensitivity label for one file, you first need to identify the DriveItem ID and Drive ID for the SharePoint file, where you want to set the sensitivity label. You can get the DriveItem ID by executing the script in following article:

How to Get SharePoint Files with MSGraph with PowerShell

In order to assign a sensitivity label, I wrote following function:

I recommend to export the certificate password as an encrypted file, which will be used in the upcomming scripts. A hardcoded password in a script is not recommended.

With the execution of the script below, the sensitivity of the Subfoldderdocument.docx becomes a confidential. If you want to use the script, replace the parameters to fit your scenario.

I oberserved that it took a few moments until the sensitivity label was updated in SharePoint as it happens asychronously.

How to assign Sensitivity Labels for a SharePoint Library with PowerShell

In order to assign sensitivity labels a whole SharePoint library with PowerShell, you need to obtain first the DriveItemIDs for each SharePoint file and then proceed with assigning the sensitivity labels.

To showcase the functionality, I have prepared following SharePoint Library with various sensitivity labels. My aim is to assign the confidential sensitivity label for each file. This script recurses subfolders, so that child items of folders are assigned with the sensitivity label of choice.

The output of the script shows, that not every file type is supported for assigining sensitivity labels to it. Currently only Word, Excel and PowerPoint file types support sensitivity label per default.

Further Reference

If you are new to Graph API, consider reading following article, which will help you to configure the Azure Application correctly:

How to configure Azure App registration for MS Graph | SPO Scripts

Leave a Comment Cancel Reply

You must be logged in to post a comment.

How to Automatically Assign Sensitivity Labels to Content

Topics: SharePoint Content Management , Microsoft 365 , Sensitivity labels

Microsoft 365 offers plenty of features and facilities to assure safe and smooth collaboration and content sharing . Sensitivity labels allow you to classify your organization’s content based on its sensitivity and significance. You can determine what is the correct label for content in your Microsoft 365 environment based on its sensitivity level. You can look at our blog ‘ How sensitivity labels protect your data in Microsoft 365’ to see a clear insight on how sensitivity labels work.

In this blog post, we are going to explain how to automatically assign sensitivity labels to content.

This is a very handy function when you have thousands of documents and files stored in your Microsoft 365 platform . This number will keep rising each day, thus managing documents with required safety and sensitivity becomes more difficult as time passes. Automatic data labeling is thus a necessity for organizations. Let us see how automatic data labeling works and available label application methods.

How Sensitivity Labels Work and Why they are Beneficial

Along with creating sensitivity labels you can also define conditions to apply those labels to documents and contents automatically. There are multiple benefits associated with this ability to perform automatic data labeling.

• You can avoid training your users on how to assign labels based on various conditions.
• Avoid human errors in classifying and assigning labels.
• Instead of learning and concentrating on your organization’s labeling policy, they can now focus on other critical processes.

Methods Available to Enable Automatic Applying of Sensitivity Labels

You can enable the automatic assigning of labels to your content in two ways:

• Client-side labeling
• Service-side labeling

Client-side labeling: works when users edit a document or create an email. At this time, they will get label recommendations. They can either accept or reject these recommendations based on their understanding. In this method. The label can be applied to content even before saving it. Learn more about auto-labeling in Office Apps to make the most of this facility.

Service-side labeling: works with the help of an auto- labeling policy. This method is used for applying auto-labeling of content saved in SharePoint and OneDrive, and Emails sent and received by Exchange. This method is ideal for applying auto-labeling to large volumes of documents in your organization together. Unlike client-side labeling, service-side labeling auto-labeling is processed by services, rather than apps.

With the help of these label application methods, users can easily determine what is the correct label for a document or content.

How are the Sensitivity Labels Evaluated Based on Conditions?

Label priority or the order in which these labels are listed in the policy is important in automatic data labeling. The sensitivity labels are ordered for evaluation based on how they are positioned in the policy. The least sensitive labels are positioned first, whereas the label with higher sensitivity levels come last in the policy. It will be better to understand the label priority to know these processes better.

Configuring Parent Labels for Automatic Applying

A label with a sub-label is considered a parent label. You should not consider a parent label while configuring auto-labeling options to be auto-assigned or recommended in Office apps to assign to content. Ensure that you are not choosing a parent label while setting up an auto-labeling policy. It does not make sense, as even if you do it, the parent label will not get applied to the document/content. The best way to make use of the sub-labels with an automatic labeling facility is to publish both parent labels and sub-labels together.

With the help of the automatic data labeling facility, you can determine what is the correct label for content effortlessly. Moreover, the label application methods are simple and easy to follow. Try these methods and keep your sensitive content safe in Microsoft 365 platform . For more information on how to configure automatic sensitivity label assigning, stay tuned to our future blogs.

Have a good day!

Book a Live demo

Schedule a live demo of Dock 365's Contract Management Software now.

Written by Alex K Joseph

Alex Joseph is a Digital Marketing Strategist with explicit knowledge in Content Marketing and Microsoft Technologies. A writer by day, Alex is a night owl and a DIYer. Alex's theory is to make businesses achieve success with modern solutions and smart exploitation of resources.

Related Posts

Book a live demo of Dock 365's Contract Management Software!

Contract Management

• Contract Management Software
• Contract Lifecycle Management
• Contract Management for Small Business
• Contract Management Solutions
• Vendor Management System
• Enterprise Intranet Portal

Integrations

• E-signatures
• Microsoft 365
• Microsoft Dynamics 365 CRM
• Salesforce CRM
• Oracle NetSuite
• Microsoft Business Central

Quick Links

• Download Free Guide

© 2024 Dock 365 Inc. All Rights Reserved.

Known issues with sensitivity labels in Office

This document details the known issues and workarounds with the sensitivity labeling feature in Office and will be kept updated as new issues are discovered and known issues are fixed. 

Note:  For Outlook (Windows, macOS, iOS, Android, and on the web), the mailbox must be hosted in Exchange Online. Sensitivity labels aren't supported for mailboxes that are hosted on-premises. 

Last updated: May 10, 2024 

This section describes the known issues working with files in Microsoft 365 for the web and emails using Outlook on the web.

If you encounter an issue that is not listed here, please submit feedback !

Need more help?

Want more options.

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Microsoft 365 subscription benefits

Microsoft 365 training

Microsoft security

Accessibility center

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.

Ask the Microsoft Community

Microsoft Tech Community

Windows Insiders

Microsoft 365 Insiders

Was this information helpful?

Thank you for your feedback.

It's all about the answers!

Once you sign in you will be able to subscribe for any updates here.

• Answers and Comments

rational-doors-next ×5,857 requirements-management-doors-next ×1,353 dxl ×28

question asked: Feb 12, 10:54 a.m. question was seen: 325 times last updated: Feb 12, 10:54 a.m.

Related questions

• DOORS DXL Syntax Highlighting
• DXL feature in DOORS Next Generation
• Using JRS to Query DNG Review Status in a Global Configuration environment
• Jazz CLM 6.0.6.1: RM: repotools-rm.sh: `CRJAZ2438E An error occurred while invoking the service https://host.domain.com:9443/rm/service/com.ibm.team.repository.service.internal.setup.IRegistrationHandlerService. The operation did not complete` resolution?
• How to pro-grammatically update the value of a module custom attributes in RDNG ?
• DNG 6.0.5 Error accessing to the Project area 404
• IBM Report Builder issue with enumeration list in DNG and LISTAGG
• Uninstall DOORS Web Access 9.7
• OAuth when accessing external OSLC server
• Can I add more rules to creation of modules from a custom template?

Set a sensitivity label for an excel workbook created from DOORS DXL

Be the first one to answer this question.

Joanne C Klein

Compliance in Microsoft 365

Sensitivity Labels ‘Learn More’: A way to inform Business Workers in-the-moment

If you’ve deployed sensitivity labels in your tenant, a simple configuration option you should be leveraging to provide help to a business worker from within Office applications is the Learn More option. What I love most about this is how it helps a business worker in-the-moment while they’re in the Office tools editing a document (and potentially deciding which sensitivity label to apply).

Part of my governance guidance included in My Microsoft 365 Engagement Framework © for organizations is to always house governance documentation in the form of modern pages on a Governance SharePoint Communication site. This technique has many benefits, however the primary benefit is providing the flexibility to tag modern pages with the numerous types of governance you may store in the site allowing you to display the pages in dynamic ways. (Retention Governance, Security Governance, Solution Governance, Container Governance, etc.)

Note: I’ve previously blogged about how to configure this for classic AIP labels: AIP Client: Tell me more! With Sensitivity labels, Microsoft has improved the end-user experience with the placement of the Learn More link being more visible from within Office applications.

If you’ve implemented sensitivity labels, an important governance page to include is one dedicated to the data classification scheme you’ve deployed in your environment as the classification scheme directly relates to the sensitivity labels published to business workers.

Example: On the governance page, you could show the classification scheme, explain what the labels mean, what controls are implemented for each, and provide relevant examples. Like the modern page image below suggests, you may want to even include a video of how to apply them and some tips for your end-users on proper handling controls when working (particularly with sensitive data).

The goal? Business workers need to understand why they’re being asked to apply a sensitivity label, how to do it, and what behavior they can expect once applied. We need to make this easy to understand to minimize the impact to the business worker’s workflow.

It’s striking that balance between data security and enabling usability.

Where do you configure the ‘Learn More’ option?

From the Compliance Center, when publishing sensitivity labels in a policy, the below options are presented to you as part of Policy settings and the option highlighted with the yellow arrow allows for a custom help page to be specified. This is where you would provide your own organization’s governance information around the data classification scheme you’ve implemented.

What does the end-user see?

End-users will see the prompt for this Learn More page under the Sensitivity label in the following locations. When clicked, it will take them directly to the custom help page URL specified above:

Office 365 Business Apps

Office online apps.

Note: As of the time of this writing (September 2020), I cannot see the Learn More link in the iOS Mobile app. Hopefully this will come!

Work with your information management and data security teams to build out the information to be communicated on the  Learn More page.

A simple yet effective configuration option.

Thanks for reading.

Credit: Photo by  Lisa Fotios  from  Pexels

Share this:

• Pingback: Sensitivity labels ‘Learn More’: A way to inform Business Workers in-the-moment

A question about labels. We use Cloudpath and trying to upload spreadsheets with a watermark to their portal apparently caused an error of “invalid argument” . Have you heard of anything like that?

I have not.

Thank you. I think I figured out what the issue was.

Leave a Reply Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed .

Discover more from Joanne C Klein

Subscribe now to keep reading and get access to the full archive.

Type your email…

Continue reading

Navigation Menu

Search code, repositories, users, issues, pull requests..., provide feedback.

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly.

To see all available qualifiers, see our documentation .

• Notifications You must be signed in to change notification settings

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement . We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

get and set Sensitivity Labels in Docx file #1232

msuguino commented Aug 5, 2023

scanny commented Sep 24, 2023

Sorry, something went wrong.

No branches or pull requests

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

sensitivityLabel: evaluateApplication

• 7 contributors

Namespace: microsoft.graph.security

APIs under the /beta version in Microsoft Graph are subject to change. Use of these APIs in production applications is not supported. To determine whether an API is available in v1.0, use the Version selector.

Compute the sensitivity label that should be applied and return the set of actions that must be taken to correctly label the information. This API is useful when a label should be set manually or explicitly by a user or service, rather than automatically based on file contents.

Given contentInfo , which includes existing content metadata key-value pairs , and labelingOptions as an input, the API returns an informationProtectionAction object that contains one of more of the following:

• addContentFooterAction
• addContentHeaderAction
• addWatermarkAction
• applyLabelAction
• customAction
• justifyAction
• metadataAction
• protectAdhocAction
• protectByTemplateAction
• protectionDoNotForwardAction
• recommendLabelAction
• removeContentFooterAction
• removeContentHeaderAction
• removeProtectionAction
• removeWatermarkAction

This API is available in the following national cloud deployments .

Permissions

Choose the permission or permissions marked as least privileged for this API. Use a higher privileged permission or permissions only if your app requires it . For details about delegated and application permissions, see Permission types . To learn more about these permissions, see the permissions reference .

HTTP request

To evaluate as the signed-in user (delegated permission) or a specified user (application permission):

To evaluate as a service principal (application permission):

Request headers

Request body.

In the request body, supply a JSON representation of the parameters.

The following table shows the parameters that can be used with this action.

If successful, this action returns a 200 OK response code and an informationProtectionAction collection in the response body.

The following example shows a request.

Microsoft Graph SDKs use the v1.0 version of the API by default, and do not support all the types, properties, and APIs available in the beta version. For details about accessing the beta API with the SDK, see Use the Microsoft Graph SDKs with the beta API .

For details about how to add the SDK to your project and create an authProvider instance, see the SDK documentation .

The following example shows the response.

Was this page helpful?

Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback .

Submit and view feedback for

Additional resources

Scientists develop most sensitive way to observe single molecules

Scientists at the University of Wisconsin-Madison have developed the most sensitive method yet for detecting and profiling a single molecule -- unlocking a new tool that holds potential for better understanding how the building blocks of matter interact with each other. The new method could have implications for pursuits as varied as drug discovery and the development of advanced materials.

The technical achievement, detailed this month in the journal Nature , marks a significant advance in the burgeoning field of observing individual molecules without the aid of fluorescent labels. While these labels are useful in many applications, they alter molecules in ways that can obscure how they naturally interact with one another. The new label-free method makes the molecules so easy to detect, it is almost as if they had labels.

"We're very excited about this," says Randall Goldsmith, a UW-Madison professor of chemistry who led the work. "Capturing behaviors at the level of single molecules is an amazingly informative way of understanding complex systems, and if you can build new tools that grant better access to that perspective, those tools can be really powerful."

While researchers can glean useful information from studying materials and biological systems at larger scales, Goldsmith says that observing the behavior of and interactions between individual molecules is important for contextualizing that information, sometimes leading to new insights.

"When you see how nations interact with each other, it all comes down to interactions between individuals," says Goldsmith. "You wouldn't even think of understanding how groups of people interact with each other while ignoring how individuals interact with each other."

Goldsmith has been chasing the allure of single molecules since he was a postdoctoral researcher at Stanford University more than a decade ago. There, he worked under the chemist W.E. Moerner, who received the Nobel Prize in chemistry in 2014 for developing the first method of using light to observe a single molecule.

Since Moerner's initial success, researchers around the world have devised and refined new ways to observe these tiny bits of matter.

The method that the UW-Madison team developed relies on a device called an optical microresonator, or microcavity. As its name suggests, the microcavity is an extremely tiny space where light can be trapped in both space and time -- at least for a few nanoseconds -- where it can interact with a molecule. Microcavities are more commonly found in physics or electrical engineering laboratories, not chemistry labs. Goldsmith's history of combining concepts from disparate scientific fields was recognized in 2022 with a Polymath award from Schmidt Futures.

Microcavities are built from incredibly small mirrors fashioned right on top of a fiber optic cable. These fiber optic mirrors bounce the light back and forth many times very quickly within the microcavity.

The researchers let molecules tumble into the cavity, let the light pass through it, and can not only detect the molecule's presence, but also learn information about it, such as how fast it moves through water. This information can be used to determine the molecule's shape, or conformation.

"Conformation at the molecular level is incredibly important, particularly for thinking about how biomolecules interact with each other," says Goldsmith. "Let's say you have a protein and you have some small-molecule drug. You want to see if the protein's druggable, which is to say, 'Does the drug have some kind of major interaction with the protein?' One way you might be able to see that is if it introduces a conformational change."

There are other ways to do that, but they require large amounts of sample material and time-consuming analyses. With the newly developed microcavity technique, Goldsmith says, "we can potentially build a black-box tool to give us the answer in tens of seconds."

The team, which included Lisa-Maria Needham, a former postdoctoral researcher who is now a laboratory director at the University of Cambridge, has filed a patent for the device. Goldsmith says the device and methods will now be refined over the next couple of years. In the meantime, he says he and his collaborators are already thinking about the many ways it could be useful.

"We're excited about many other applications in spectroscopy," he says. "We hope we can use this as a stepping stone to other ways to learn about molecules."

This research was primarily funded by the National Institutes of Health (R01GM136981), with resonator construction supported by the Q-NEXT Quantum Center, a U.S. Department of Energy, Office of Science, National Quantum Information Science Research Center, under award number DE-FOA-0002253.

• Organic Chemistry
• Nature of Water
• Inorganic Chemistry
• Quantum Physics
• Materials Science
• Evaporation
• Macromolecule
• Plasma (physics)
• Fluid mechanics

Story Source:

Materials provided by University of Wisconsin-Madison . Original written by Will Cushman. Note: Content may be edited for style and length.

Journal Reference :

• Lisa-Maria Needham, Carlos Saavedra, Julia K. Rasch, Daniel Sole-Barber, Beau S. Schweitzer, Alex J. Fairhall, Cecilia H. Vollbrecht, Sushu Wan, Yulia Podorova, Anders J. Bergsten, Brandon Mehlenbacher, Zhao Zhang, Lukas Tenbrake, Jovanna Saimi, Lucy C. Kneely, Jackson S. Kirkwood, Hannes Pfeifer, Edwin R. Chapman, Randall H. Goldsmith. Label-free detection and profiling of individual solution-phase molecules . Nature , 2024; 629 (8014): 1062 DOI: 10.1038/s41586-024-07370-8

Cite This Page :

Explore More

• How Statin Therapy May Prevent Cancer
• Origins of 'Welsh Dragons' Exposed
• Resting Brain: Neurons Rehearse for Future
• Observing Single Molecules
• A Greener, More Effective Way to Kill Termites
• One Bright Spot Among Melting Glaciers
• Martian Meteorites Inform Red Planet's Structure
• Volcanic Events On Jupiter's Moon Io: High Res
• What Negative Adjectives Mean to Your Brain
• 'Living Bioelectronics' Can Sense and Heal Skin

Trending Topics

Strange & offbeat.