Auto-labeling policies are configured for all Microsoft 365 workloads

Overview

Auto-labeling greatly extends your labeling reach, by automatically labeling items based on content inspection. When you rely on just manual labeling, users might not always recognize what counts as sensitive data or might forget to label information during their daily tasks. Default labels offer a baseline of protection but don’t take into consideration content that requires a higher level of protection. This leads to gaps in classification, allowing sensitive content to move through Microsoft 365 applications without proper labels or protection.

You can configure auto-labeling settings for labels that trigger when users open files in their Office apps, and auto-labeling policies that require no user interactions. Setting up at least one auto-labeling policy to detect sensitive content automatically labels this content, no matter what actions people take. In turn, this labeled content can be used with other Microsoft Purview solutions to increase your security, such as data loss prevention (DLP) rules and access restrictions.

Remediation

• Automatically apply a sensitivity label to Microsoft 365 data

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	Data, AI
Category	Information Protection
Product	Purview
Feature	Information protection
Area	Data protection
Licence	EXCHANGE_S_ENTERPRISE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.