Demystifying Labels in Microsoft 365 - Part 2

Hello everyone,

In the Part1, we have gone through some of the  information about the Labels which are beings used in M365[Part 1 link below]

 https://cloudmonkeys20.blogspot.com/2023/02/demystifying-labels-in-microsoft-365.html

in this  part 2 series . we are going to covers the below  

• Some basics PowerShell commands to check the sensitivity labels
• Backup / export the Sensitivity labels
• Audit logs for sensitivity labels
• Script to get all the sensitivity labels usage  in a tenant [granular level]
• Troubleshooting the retention labels in M365

The basics

Using the table below to know which PowerShell Modules you need to install (by running Install-Module XXX) and import (Import-Module XXX) to configure / troubleshoot Labels:

Labels, Label actions, Label Policies and Label Rules

To get the sensitivity labels in your tenant use the below command 

To get the label which matched the header , use the below command

To Get the label full information and encryption information

Label Data Collection - Export labels Data

Whatever is the case/issue, always make sure to note & collect label output via the mentioned cmd-lets:

Get-Label|Export-Clixml -Path C:\Temp\Labels.xml;Get-LabelPolicy |%{Get-LabelPolicy -Identity $_.Identity} | Export-Clixml -Path C:\Temp\LabelPolicies.xml;Get-LabelPolicy |%{Get-LabelPolicyRule -Policy $_.Identity}|Export-Clixml -Path C:\Temp\LabelRules.xml

Audit Logs - how to fetch the audit logs for sensitivity labels

Retention Policy lookup : 

This retention policy look up help admins to determine whether the affected user has applied for retention policy or not.  

The Script for more granularity 

Use the githib below link to get the sensisitivty label information in granular level

https://github.com/12Knocksinna/Office365itpros/edit/master/ReportSensitivityLabelsAuditRecords.ps1

Analysis the sensitivity labels

https://github.com/12Knocksinna/Office365itpros/blob/master/AnalyzeSensitivityLabelUsage.PS1

Retention policy  Validation

Created one retention policy to delete the emails of 5 days old in purview portal 

Sent few test email to the target users

With in a week, policy has been appeared in target user outlook and assigned

Result : email not deleted after retention policy applied in outlook .

Resolution : Connect EXO PowerShell and ran the below command

Emails got deleted and went to recycle bin folder