deleted sensitivity label

Brace yourself, this is a long one and actually two separate issues. 

Why you can't recreate a label with the same name

This is expected behavior and it catches a lot of people off guard. When a sensitivity label gets deleted from the Purview portal, the label object is not fully purged from the system. If the label had encryption settings, the underlying protection template gets archived so that any content previously encrypted with that label can still be opened. That archived template blocks you from reusing the same name.

Even without encryption, the label GUID and name mapping can persist in the backend for a period of time after deletion.

If you need the "Internal-1" label back, you have a couple of options. You can try restoring it through Security & Compliance PowerShell using Get-Label to check if the label still exists in a soft-deleted state. If it does, you may be able to work with it from there. Otherwise, you'll need to create the label with a slightly different name, like "Internal-1-v2", and update your policies accordingly.

One thing worth noting. Deleted labels will show up as GUIDs rather than friendly names in tools like Content Explorer and Activity Explorer, since the GUID-to-name mapping is no longer available after deletion. Keep that in mind if you're auditing label activity on content that had "Internal-1" applied.

Reference:

• https://learn.microsoft.com/purview/create-sensitivity-labels#removing-and-deleting-labels

The second issue of auditing when and where the label was deleted is a bit more manual.

Finding who deleted the label in Audit

You can track this down through the unified audit log in the Microsoft Purview portal. The label deletion is captured as an admin activity.

1. Go to Microsoft Purview portal > Audit
2. Set your date range to cover when you last saw the label and when you noticed it was gone
3. For the Activities filter, search under Sensitivity label policy and label activities. You're looking for operations related to removing or deleting a label. You can also filter by Record types and select MIPLabel to narrow results to sensitivity label administration events
4. Run the search and review the results. The audit record will show the User who performed the deletion along with a timestamp

Please mark as solution, if you find the answer helpful. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided. 🖖