Find user who assigned a label

Hi dmarquesgn,

As mentioned in the previous reply post, there is no way to find out who assigned the label to the file by looking at the file itself or in any log. The only way to find out is to search the audit logs. However, you can try the following:

1. Check the file's version history to see if there is a previous version of the file that doesn't have the label. If there is, you can see who modified the file to add the label. To do this, follow the steps below:

1. Open the file in SharePoint or OneDrive.
2. Click the File tab.
3. Click Info.
4. Under Version history, click Version history.
5. Click the version of the file that you want to review.
6. Click Compare.
7. Select the current version of the file from the left drop-down menu.
8. Select the version of the file that you want to compare it to from the right drop-down menu.
9. Click OK.
10. Review the changes between the two versions of the file. If the label was added in one of the versions, you can see who made the change.

1. Check the file's metadata to see if there is any information about the label, such as the date and time it was applied and the user who applied it. To do this, follow the steps below:

1. Open the file in SharePoint or OneDrive.
2. Click the File tab.
3. Click Info.
4. Under Properties, click Properties.
5. Review the metadata for the file. If there is any information about the label, it will be listed here.

• If you are able to identify the date and time that the label was applied, you can search the audit logs for that specific time frame.
• If you know the department or team that the file belongs to, you can search the audit logs for that department or team.
  
  

Here is a PowerShell script that you can use to search the audit logs for information about sensitivity labels:

# Import the SharePoint Online Management Shell module.
Import-Module -Name Microsoft.Online.SharePoint.PowerShell

# Connect to SharePoint Online.
Connect-SPOService -Url https://[your-tenant-name].sharepoint.com

# Get a list of all sensitivity labels in the tenant.
$sensitivityLabels = Get-SPOSensitivityLabel

# Search the audit logs for all events related to sensitivity labels.
$auditLogs = Search-SPOServiceAuditLog -StartTime [start-date] -EndTime [end-date] -EventType SensitivityLabel

# Filter the audit logs to only include events that are related to the specific sensitivity label that you are interested in.
$filteredAuditLogs = $auditLogs | Where-Object {$_.SensitivityLabel -eq "[sensitivity-label-name]"}

# Write the audit logs to a file.
$filteredAuditLogs | Out-GridView

You can modify the script to change the start and end dates of the search, as well as the name of the sensitivity label that you are interested in.