Default sensitivity labels are configured for SharePoint document libraries
Overview
Section titled “Overview”When you configure SharePoint with a default label for document libraries, any new files uploaded to that library, or existing files edited in the library will have that label applied if they don’t already have a sensitivity label, or they have a sensitivity label but with lower priority. This location-based labeling offers a baseline level of protection and a form of automatic labeling without content inspection. When files aren’t labeled, important files can bypass protection and remain vulnerable.
This configuration is most suitable for document libraries that contain files with the same level of sensitivity. It can be supplemented with auto-labeling policies that uses content inspection, and manual labeling with a higher priority sensitivity label if needed.
Remediation
Section titled “Remediation”Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Data, AI |
| Category | SharePoint Online |
| Product | Purview |
| Feature | Information protection |
| Area | Data protection |
| Licence | RMS_S_PREMIUM2, Microsoft 365 E5 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.