rules/findings/m365/microsoft_purview/information_protection/ms-purview-lack-of-information-protection-label-policies.json
|
{
"args": [ ], "provider": "Microsoft365", "serviceType": "Purview", "serviceName": "Microsoft 365", "displayName": "Ensure Information Protection sensitivity label policies are published", "description": 'Sensitivity labels enable organizations to classify and label content across Microsoft 365 based on its sensitivity and business impact. These labels can be applied manually by users or automatically based on the content. When applied, labels can automatically encrypt content, provide "Confidential" watermarks, restrict access, and offer various data protection features.', "rationale": "Consistent usage of sensitivity labels can help reduce the risk of data loss or exposure and enable more effective incident response if a breach does occur. They can also help organizations comply with regulatory requirements and provide visibility and control over sensitive information.", "impact": "Encryption configurations (control access, DKE, BYOK) in the individual labels may impact users’ ability to access site documents and information. Careful consideration of the individual sensitivity label configurations should be exercised prior to applying an auto labeling policy, publishing policy, sensitivity label configuration, or PowerShell based label settings to SharePoint sites.\r\nAdditionally, when updating or deleting Sensitivity Labels, an assessment of the potential impacts should be conducted to avoid unintended consequences. If tenants are configured for sharing with guests or external domains and Sensitivity Labels have encryption applied, this can affect the ability to share documents via email stored in SharePoint. Some recipients may be unable to open the document depending on their email client, which could trigger Purview Advanced Encryptions and OME flows based on the recipient type and the cloud license from which the email is sent (e.g., government clouds vs. commercial clouds).", "remediation": { "text": "\r\n\t\t###### To set up Information Protection: \r\n\t\t1. Navigate to Microsoft Purview compliance portal https://purview.microsoft.com. \r\n\t\t2. Under Solutions select Information protection. \r\n\t\t3. Click on the Label policies tab. \r\n\t\t4. Click Create a label to create a label. \r\n\t\t5. Select the label and click on the Publish label. \r\n\t\t6. Fill out the forms to create the policy.\r\n\t", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/purview/sensitivity-labels", "https://learn.microsoft.com/en-us/purview/create-sensitivity-labels?tabs=classic-label-scheme" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "6.1.0", "reference": "3.3.1", "profile": [ "E3 Level 1", "E5 Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "o365_secomp_label_policy", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "Enabled", "eq", "False" ], [ "IsValid", "eq", "False" ], [ "Mode", "ne", "Enforce" ] ], "operator": "or" } ] } ], "shouldExist": true, "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "Name": "Label Policy", "Comment": "Comment", "Enabled": "Enabled", "Mode": "Mode" }, "expandObject": null }, "table": "default", "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ ], "expandObject": null, "limit": null }, "showGoToButton": "True", "showModalButton": "True", "directLink": null } }, "text": { "data": { "properties": { "Name": "Label Policy", "Comment": "Comment", "Enabled": "Enabled", "Mode": "Mode" }, "expandObject": null }, "status": { "keyName": [ ], "message": "Ensure SharePoint Online Information Protection policies are set up and used", "defaultMessage": null }, "properties": { "resourceName": "Name", "resourceId": "ExchangeObjectId", "resourceType": "LabelPolicy" }, "onlyStatus": false } }, "idSuffix": "m365_purview_lack_information_protection_policies", "notes": [ ], "categories": [ ], "immutable_properties": [ ], "id": "microsoft365_2162" } |