Forum Discussion

SeanMcAvinue's avatar
SeanMcAvinue
MVP
Oct 22, 2020
Solved

Assigning Sensitivity Label via Unattended Script

I've come across an interesting problem recently. I have a requirement to set a group sensitivity label as part of an unattended automation script which I'm using application permissions and Graph ca...
compliance
Microsoft 365 Groups
office 365
security
  • VasilMichev's avatar
    VasilMichev
    Oct 23, 2020

    Um, any particular error? The cmdlet you need for that is Set-UnifiedGroup, there's no REST-based one yet. The only difference the V2 module introduces is the way we authenticate, so you might as well use the "old" PS module just to check if it works there.

     

    Also dont forget that you need to update the Group settings first. Tony lists all the steps here: https://petri.com/moving-classifications-sensitivity-labels

SeanMcAvinue's avatar
SeanMcAvinue
MVP
Oct 23, 2020

VasilMichev Thanks Vasil, I did get it working eventually, the error(s) I was was:

  • Using app permissions & Cert auth it was unable to locate user mailbox (Sorry I closed the window after I got it working so don't remember the exact error)
  • Using regular sign in and MFA it would work but this wasn't feasible for the unattended automation job.
  • Using application permissions via Graph "this is not available using app-only permissions"

I ended up requesting a user token manually and then using a function to renew using the refresh token each time the script ran.

 

To set the label I used the below PATCH request (I originally missed the capital 'L' in 'assignedLabels' and it took me a while to find). The key to it was that it needs to be run in a user context and the user needs to have the label published to them. It can't be done this was via application permissions.

 

$body = @'
{
    "assignedLabels": [
        {
            "labelId": <LablelGUID>
        }
    ]
}
'@
Justin-GOV's avatar
Justin-GOV
Brass Contributor
Mar 18, 2022
Do you have more details of your solution? I am curious about your proposed authentication method: "I ended up requesting a user token manually and then using a function to renew using the refresh token each time the script ran."

I am having the same problem you describe in your bullets. I am trying to find another solution.

Resources