Forum Discussion

Brass Contributor

Aug 17, 2023

Solved

way to find out which sensitivity label policies are assigned to a specific user

Is there a way to find out which sensitivity label policies, the ones that distribute the label to the user, are assigned to a specific user?

microsoft purview

TonyRedmond
Aug 21, 2023
franckma Try this:

Find Out Where Users Get Sensitivity Labels From

A question about finding out which sensitivity label policy makes a label available to a user requires some PowerShell to figure out the answer with some human-friendly results. The outcome is a script that analyzes sensitivity label policies to find where a user gets their labels from. It’s another example of how useful PowerShell can be.

https://office365itpros.com/2023/08/21/sensitivity-label-publishing/

VasilMichev

MVP

Aug 17, 2023

You can get the info via the InPlaceHolds property, which contains a list of all policies (including retention and sensitivity label ones). For example:

Get-Mailbox vasil | select InPlaceHolds

If the policy is scoped to all users instead, you need to check the org-wide policies, via:

Get-OrganizationConfig | select InPlaceHolds

The output will look something like "mbx1a7ad8841fb042fb939bb94965b050ac:1" - you need to remove the prefix/suffix out of it and you can match it against a Policy GUID:

Get-LabelPolicy 1a7ad8841fb042fb939bb94965b050ac

franckma

Brass Contributor

Aug 19, 2023

VasilMichev Thanks Vasil, will try this next week.

Need to check if i can do this with Sec Admin role or if i need Exchange Admin Role.

Regards,

Franck

TonyRedmond
MVP
Aug 21, 2023
franckma Try this:

Find Out Where Users Get Sensitivity Labels From

A question about finding out which sensitivity label policy makes a label available to a user requires some PowerShell to figure out the answer with some human-friendly results. The outcome is a script that analyzes sensitivity label policies to find where a user gets their labels from. It’s another example of how useful PowerShell can be.

https://office365itpros.com/2023/08/21/sensitivity-label-publishing/
- franckma
  Brass Contributor
  Aug 21, 2023
  Thanks Tony,
  that works brilliantly, at least on my Dev Tenant.
  On the Prod Tenant i do not have Global Admin or Exchange Admin rights and
  it did not work properly with my Sec Admin Role.
  Will test next time i am meeting with one of the gods... 🙂
  Cheers,
  Franck
  - TonyRedmond
    MVP
    Aug 21, 2023
    No worries. It was an interesting problem to consider. And answering questions like this helps us to improve/refresh/refine the content of the Office 365 for IT Pros eBook. https://gum.co/O365IT/