Users must provide justification to downgrade sensitivity labels

Overview

When users aren’t required to provide a justification for changing a label, they can silently replace a label with one that has a lower sensitivity. For example, replace the “Confidential” label that applies additional protection settings, with “General”. This action creates security and compliance risk. Requiring a justification reason makes this risk more obvious to users, and forces them to provide a reason as a visible audit trail.

Compromised accounts or departing employees could downgrade labels to enable data exfiltration. Requiring justification is a lightweight control that increases accountability with low impact on user workflows.

Remediation

• Publish sensitivity labels by creating a label policy
• What label policies can do
• Review labeling activities in activity explorer

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Medium
Pillar	Data
Category	Information Protection
Product	Purview
Feature	Information protection
Area	Data protection
Licence	RMS_S_PREMIUM, Microsoft 365 E3
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.