Our previous blog post covered the basics of creating and configuring sensitivity labels in PowerShell. Let’s take it up a notch and explore more advanced Item Sensitivity Labels. These labels provide fine-grained control over data protection, encryption, and content marking. Buckle up—we’re diving into the details!

Scenario overview

Imagine a scenario where you’re working on a top-secret project called Project Chimney. You must create a sensitivity label that ensures confidentiality, restricts access, and adds content markings. Let’s break down the advanced features step by step.

Encryption Settings

• Objective: Add encryption to limit access to Project Chimney Microsoft 365 group members who are co-authors.
• Details:
  • Offline Access: Allow offline access for one day.
  • Re-authentication: Users must re-authenticate for access.

Content Marking

• Objective: Add a footer to documents and emails.
• Details:
  • Text: “Highly Confidential - Project Chimney”
  • Alignment: Left
  • Font Color: Black (#000000)
  • Font Size: 8
  • Margin: 5

Prerequisites

You first need to run the following commands in PowerShell to install and import the Exchange Online PS Module:

Install-Module ExchangeOnlineManagement
Import-Module ExchangeOnlineManagement

This example connects to Security & Compliance Center PowerShell in a Microsoft 365 organization:

Connect-IPPSSession

PowerShell Implementation

Let’s create this advanced label using PowerShell.

Creating the Label

If we follow best practices, creating the label would look something like this:

New-Label -Name "Project Chimney"`
          -DisplayName "Project Chimney"`
          -Tooltip "Confidential data that can be shared outside the organization, in the context of the collaboration project"`
          -ContentType File,Email `
          -ApplyContentMarkingFooterAlignment Left `
          -ApplyContentMarkingFooterEnabled $true `
          -ApplyContentMarkingFooterFontColor "#000000"`
          -ApplyContentMarkingFooterFontSize 8 `
          -ApplyContentMarkingFooterMargin 5 `
          -ApplyContentMarkingFooterText "Highly Confidential - Project Chimney"`
          -EncryptionContentExpiredOnDateInDaysOrNever Never `
          -EncryptionEnabled $true `
          -EncryptionOfflineAccessDays 1 `
          -EncryptionProtectionType Template `
          -EncryptionRightsDefinitions "ProjectChimney@M365x97995154.onmicrosoft.com", "Rights": "VIEW,VIEWRIGHTSDATA,DOCEDIT,EDIT,PRINT,EXTRACT,REPLY,REPLYALL,FORWARD,OBJMODEL"`
          -ParentId ac790122-f36d-42d7-912f-12643bdb1295

Stay tuned for more advanced label management tips in our next blog post! 🚀🔒

Thank you for reading
/Simon