What are Sensitivity Labels?
Sensitivity Labels can be applied to Groups, Sites and Teams in M365, they are configured in Microsoft Purview. The labels will be applied to the workspace but can also be used to managed a variety of settings, these include:
- Privacy Settings - Private or Public
- External Sharing Permissions
- External user access - if guest access is enabled or disabled
- Access from unmanaged devices
- Default label for channel meetings
- Authentication contexts
- Default sharing link for a SharePoint site (PowerShell-only configuration)
- Site sharing settings (PowerShell-only configuration)
Your Admins will configure these and at the point of Creation you can select the label to be applied. Read more about What are Sensitivity Labels?
Sensitivity Label Settings in ProvisionPoint can be applied using our service definitions, either
- By defaulting the label or allowing the requestors to choose the label that suits their creation the most. This will not apply to the List default.
When sensitivity labels are configured in the Admin > Settings > Sensitivity Labels area, you list which settings they will impact. As we can also manage these settings via the Security tab, these will no longer be selectable as the label will define the.
What is a Sensitivity Label Mismatch?
Once a workspace is created, the label assigned to the workspace may be changed in the admin centres.
However there may be times when you want to review the labels assigned. Use the report, or notify rules to collect information or ask owners to check the labels are correct on a regular basis.
Define the mismatch value to look for and let the scheduled policy show you the results or make a change using the rules.
You can also ensure any changes made in O365 are applied to ProvisionPoint instances or vice versa.
Available rules:
| Rule name | Description |
| URL Mismatch - Report | Report only on the mismatch that is configured |
| URL Mismatch - Notify | Send an email to configured people about the non-compliance, this email will include content define in the rule. Additional configuration will be needed, read the Configure Notifications for Notify Rules article |
| URL Mismatch - Align | Align to M365, ProvisionPoint instance, a defined value |
We always recommend starting with a Report rule to ensure the policy brings back the results you expect before applying the action rules (Align)
Mismatch Types
The mismatch you choose will set what is going to be flagged as non-compliant.
| Mismatch Type | Description |
| Instances | The M365 workspace does not match the service instance shown in ProvisionPoint |
| Service Definition default | The M365 workspace or the service instance do not match the service definition default |
|
Transform Tag
|
- The M365 workspace or service instance do not match a transform tag value.
A transform tag would be defined in a lookup or as a request variable in ProvisionPoint. This value would be used to set the Sensitivity label at provisioning. - Add the name of the request variable or lookup to the Mismatch value
|
| Defined values | The M365 workspace or ProvisionPoint service instance do not match any of the defined values |
Align Types
If non-compliance is found the align type will set what changes will be applied.
| Align Type | Description |
| O365 workspace | Will set ProvisionPoint service instance to match the M365 setting |
| Service Definition default | Will set the M365 workspace and the service instance to match the service definition default |
| Service Instance | Will set the M365 workspace to match the service instance setting shown in Info |
| Defined values | Will set the M365 workspace and service instance to match the Align value |
| Transform Tag | Will set the M365 and service instance to match the value set by the transform tag set in Align value. This will be the name of the request variable or lookup. |
Check the Results:
Once a Compliance policy is run you can check the results in the Job Queue > Compliance and in the Timeline if it is non-compliant.