# Users must provide justification to downgrade sensitivity labels
When users aren't required to provide a justification for changing a label, they can silently replace a label with one that has a lower sensitivity.
Source: https://maester.dev/docs/tests/ZTA.35018
## Overview
When users aren't required to provide a justification for changing a label, they can silently replace a label with one that has a lower sensitivity. For example, replace the "Confidential" label that applies additional protection settings, with "General". This action creates security and compliance risk. Requiring a justification reason makes this risk more obvious to users, and forces them to provide a reason as a visible audit trail.
Compromised accounts or departing employees could downgrade labels to enable data exfiltration. Requiring justification is a lightweight control that increases accountability with low impact on user workflows.
## Remediation
- [Publish sensitivity labels by creating a label policy](https://learn.microsoft.com/purview/create-sensitivity-labels?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#publish-sensitivity-labels-by-creating-a-label-policy)
- [What label policies can do](https://learn.microsoft.com/purview/sensitivity-labels?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#what-label-policies-can-do)
- [Review labeling activities in activity explorer](https://learn.microsoft.com/purview/data-classification-activity-explorer-available-events?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci#protection-removed)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Medium |
| Pillar | Data |
| Category | Information Protection |
| Product | [Purview](/docs/tests/products/purview) |
| Feature | Information protection |
| Area | Data protection |
| Licence | RMS_S_PREMIUM, Microsoft 365 E3 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.