Auto-labeling policies are in enforcement mode
Overview
Section titled “Overview”When auto-labeling policies are left in simulation mode, you’re not realizing the protection from labeling that data. As a result, users and services can’t take additional protective measures to safeguard the identified sensitive data. For example, users won’t see in their Office apps that a file is labeled Highly Confidential. Data loss prevention rules might use sensitivity labels to prevent sharing with external users, and other risky actions. Labeled data also provides an additional layer of protection when you use Microsoft 365 Copilot.
To ensure sensitive information is automatically labeled, turn on at least one auto-labeling policy. Turning on auto-labeling policies after simulation testing puts protective measures into effect and starts reducing risk.
Remediation
Section titled “Remediation”Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Data, AI |
| Category | Information Protection |
| Product | Purview |
| Feature | Information protection |
| Area | Data protection |
| Licence | EXCHANGE_S_ENTERPRISE |
| Tenant | Workforce, External |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.