Clarity on "Label Removed" activity

Hello SaqibSyed,

1. “Label Removed” activity in Activity Explorer
   The Label Removed event is generated when an existing sensitivity label is removed from a document or email. This event represents a labeling action captured in audit logs and does not always mean the item was left unlabeled.
   You can refer to below for details on how labeling events are logged.
   https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer-available-events#sensitivity-label-removed 
2. Recent changes to the label or its scope
   If there were recent changes made to the sensitivity label—especially updates to its scope or policy conditions, then this might be possible. Refer to: https://learn.microsoft.com/en-us/purview/sensitivity-labels-office-apps#scope-labels-to-just-files-or-emails 
   
   

To investigate further, you can:

1. Identify the workload involved (Word, SharePoint/OneDrive, Exchange, etc.) and the specific label reported in the activity.
2. Review the label scope and any recent changes made to the label or its publishing policy.
3. Check the Sensitivity label changes report in the Microsoft Purview portal: Microsoft Purview portal → Information Protection → Reports → Sensitivity label changes

This should provide additional context around why the activity was logged.

Hope this helps!

Please mark as solution, if you find the answer helpful. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided.

 

Hello Saqib!
Thanks for reaching out. 
I would expect any downgrade or change in label to be recorded as an event but typically means another compliant label has been enforced. However, as long as it is mandatory- users cannot save/send unlabeled content. It is not a control failure. 
Relevant documentation

https://learn.microsoft.com/en-us/purview/data-classification-activity-explorer-available-events#sensitivity-label-removed