Auto-labeling policies are enabled for SharePoint and OneDrive

Overview

When auto-labeling for SharePoint and OneDrive isn’t set up, files uploaded without sensitivity labels might not be visible to Data Loss Protection (DLP) policies that rely on labels. As a result, those files can move through the environment with fewer safeguards, which can raise the risk of inappropriate sharing or access.

For example, enabling at least one auto-labeling policy in enforcement mode for SharePoint and OneDrive helps classify sensitive files when users create or edit them. Auto-labeling classification supports downstream protections, such as DLP policies, so they can respond based on the file’s sensitivity and help reduce data exposure risk.

Remediation

• Apply sensitivity labels automatically for SharePoint and OneDrive

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Low
Pillar	Data, AI
Category	Information Protection
Product	Purview
Feature	Information protection
Area	Data protection
Licence	EXCHANGE_S_ENTERPRISE
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.