Forum Discussion

kpsingh69's avatar
kpsingh69
Copper Contributor
Jul 26, 2023

Sensitivity Labels backups

Hello, 

Is there a way to keep a backup of Sensitivity labels for a scenario where someone accidently deletes the labels and needs to be restored?

 

Thanks ,

5 Replies

  • Graham_hosking's avatar
    Graham_hosking
    Copper Contributor
    Agreed with the comments here, you have a few workarounds:
    Manual Documentation: Maintain a manual record of all your sensitivity labels, their settings, and conditions. This is a tedious process and may not be efficient for larger organizations with many labels.

    Powershell Scripting: You could use PowerShell scripting to export all the label configurations and save it locally. This will be a more technical approach and would require expertise in PowerShell.

    Regular Auditing: Regularly audit your sensitivity labels to detect any accidental deletions or modifications quickly and respond accordingly. You could use the 365 auditing or Sentiel to monitor for changes.

    A method for track changes using GitHub:

    The method to automatically backup and track changes in sensitivity labels involves the following steps:

    1. **Create a Git Repository:** Make a directory and initialize it as a Git repository. This serves as the place where all your backups will be stored and changes will be tracked.

    2. **Export Labels Using PowerShell:** Use a PowerShell script that connects to Exchange Online and exports all the sensitivity label configurations. Run this script regularly to create an up-to-date backup of your labels.

    3. **Commit Changes to the Git Repository:** After running the PowerShell script, add the updated file to the Git repository and commit the changes with a relevant message (like the date of the backup).

    4. **Repeat:** Repeat steps 2 and 3 on a regular basis (daily, weekly, etc.) to keep the backup updated and track changes over time.

    5. **Review Changes:** Use Git's built-in tools to track changes, revert to previous versions, and more. For example, you can use `git diff` to see what changes were made between two dates.

    6. **Automate:** You can automate this entire process by setting up a cron job (on Unix-like systems) or a scheduled task (on Windows) to run the PowerShell script and commit changes to the Git repository.

    7. **Security:** Ensure access to the Git repository is limited and well-protected, as it will contain sensitive information about your label configurations.

    This approach gives you a manual but effective way to track changes in your sensitivity labels over time, helping you quickly identify and revert undesired changes. However, always consider your organization's specific needs and security requirements before implementing such a method.
  • miller34mike's avatar
    miller34mike
    Steel Contributor

    Hi, kpsingh69,

     

    There is no official back-up that can be performed on sensitivity labels. You could use PowerShell to export your labels to a csv file if you wanted, but it is hardly a perfect solution for creating a "back-up" of your labels.

     

    Connect-IPPSSession
    
    # There is no module needed to install in order to connect to IPPSSession, which is the Security and COmpliance center
    
    Get-Label | Format-List | Out-File C:\labels.csv
    
    #Creates a .csv file of the label export

     

    If you have a deleted label at this time, I recommend you review this Microsoft documentation to understand what that impact may be.

     

    https://learn.microsoft.com/en-us/purview/create-sensitivity-labels#removing-and-deleting-labels

     

     

     

Resources