Audit changes to labels and policies in Azure Information Protection

Iron Contributor



I've been looking for a way to audit or monitor changes/deletions/creations of labels in Azure Information Protection.    I've enabled log workspace and all the logging through PowerShell module.  I made sure the admin is allowed access (thick at the button)   


Yet ... when I delete a label, I cannot seem to find out which user it was? 


Any ideas or tips?   Thanks  :)

3 Replies

Those operations are only audited client-side, unfortunately. So you will need to collect them centrally from each workstation, if you even have access to it. This article can get you started:

Hi Vasil


The link you sent me tells me how labels are used.   What I was looking for is the actions of labels in the Azure Portal.   Who creates a label, who modifies a label properties, etc ...


I can't seem to find that information.  

Whoops, I guess I've misunderstood you then. I'm not aware of any logs that list label operations, but if the label is associated with a corresponding Azure RMS template, you can use the RMS audit logs: