Sensitivity labels are enabled for SharePoint and OneDrive

Overview

When sensitivity label integration is disabled (the default) in SharePoint, files in SharePoint and OneDrive can’t be labeled or display existing labels, and can’t benefit from the additional protection of sensitivity labels that apply encryption. This protection gap leaves sensitive files unclassified and vulnerable to unauthorized access and external sharing.

Enabling sensitivity labels in SharePoint allows users to apply labels by using Office for the web and SharePoint. It’s also a requirement for default labeling for these locations, and for auto-labeling policies that can classify files automatically. Sensitivity labels for these files can also strengthen security for Microsoft 365 Copilot, and be used with data loss prevention policies and other Microsoft Purview solutions.

Remediation

• Enable sensitivity labels for files in SharePoint and OneDrive

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	Data, AI
Category	SharePoint Online
Product	Purview
Feature	Information protection
Area	Data protection
Licence	RMS_S_PREMIUM, MIP_P1
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.